joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402d2750
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x1402d2814
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x1402d2770
not eax
ret
Function at 0x1402d87e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402d8832
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402d8832
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402d8832
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402d8832
cmp dword [rcx + 0x84], 0xe
jbe 0x1402d8832
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402d8834
xor al, al
add rsp, 0x28
ret

Function at 0x1402df134
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1402def9f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402def9f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402def9f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402def9f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402def9f
cmp dword [rcx + 0x84], 0xe
jbe 0x1402def9f
cmp dword [rcx + 0xf8], 0
je 0x1402def9f
mov ecx, ebx
call fcn.1402df050
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1402dee2c
nop
cmp dword [rbp + 0x20], 0
je 0x1402defed
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1402deff8
int3
xor r8d, r8d
xor edx, edx
jmp 0x1402def30
Function at 0x1402ef040
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1402ef0c7
mov rsi, rbx
cmp word [rax], bp
je 0x1402ef086
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1402ef070
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1402ef06c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1402eb26c
mov rdi, rax
test rax, rax
je 0x1402ef0b4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1402d8b10
mov rbp, rdi
xor ecx, ecx
call fcn.1402ea724
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1402f2478
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1402f248e
mov al, 1
jmp 0x1402f24ee
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1402f249f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1402f24ec
mov ecx, dword [rcx + 0x18]
nop
call fcn.1402ef388
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1402f24ec
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1402f24ec
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1402f24ec
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1402f24ee
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1402f4b50
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1402f4b78
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1402f4b78
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140011578
Capabilities:
Terminate process

Disassembly:
jmp 0x140022a10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400116c2
Capabilities:
Execute command

Disassembly:
jmp 0x14001f520
push rbp
push rsi
push rdi
sub rsp, 0x6b0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x114
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140032040]
xor rax, rbp
mov qword [rbp + 0x680], rax
lea rcx, [0x1400390f6]
call fcn.1400119dd
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.1400110dc
lea rdx, str.gmod.exe
lea rcx, [rbp + 0x620]
call fcn.14001146a
nop
lea rdx, str.hl2.exe
lea rcx, [rbp + 0x648]
call fcn.14001146a
nop
lea rcx, [rbp + 0x2c4]
call fcn.1400111cc
mov qword [rbp + 0x678], rax
lea rcx, [rbp + 0x670]
mov r8, rcx
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x2e8]
call fcn.140011983
lea rcx, [rbp + 0x390]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x678]
mov r8, rax
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 8]
call fcn.140011735
nop
lea r9, [fcn.1400111a4]
mov r8d, 2
mov edx, 0x28
lea rcx, [rbp + 0x620]
call fcn.140011267
mov edx, 0x20
lea rcx, [rbp + 0x48]
call fcn.1400110dc
lea rdx, str.exechack
lea rcx, [rbp + 0x3f0]
call fcn.14001146a
nop
lea rdx, str.urbanichka
lea rcx, [rbp + 0x418]
call fcn.14001146a
nop
lea rdx, str.onetap
lea rcx, [rbp + 0x440]
call fcn.14001146a
nop
lea rdx, str.aimbot
lea rcx, [rbp + 0x468]
call fcn.14001146a
nop
lea rdx, str.memoriam
lea rcx, [rbp + 0x490]
call fcn.14001146a
nop
lea rdx, str.neverpivo
lea rcx, [rbp + 0x4b8]
call fcn.14001146a
nop
lea rdx, str.ub3rhag
lea rcx, [rbp + 0x4e0]
call fcn.14001146a
nop
lea rdx, str.Lemi
lea rcx, [rbp + 0x508]
call fcn.14001146a
nop
lea rdx, str.LeeCheat
lea rcx, [rbp + 0x530]
call fcn.14001146a
nop
lea rdx, str.smeghack
lea rcx, [rbp + 0x558]
call fcn.14001146a
nop
lea rdx, str.oink.industrias
lea rcx, [rbp + 0x580]
call fcn.14001146a
nop
lea rdx, str.scripthook
lea rcx, [rbp + 0x5a8]
call fcn.14001146a
nop
lea rdx, str.antiaim
lea rcx, [rbp + 0x5d0]
call fcn.14001146a
nop
lea rcx, [rbp + 0x314]
call fcn.1400111cc
mov qword [rbp + 0x678], rax
lea rcx, [rbp + 0x5f8]
mov r8, rcx
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0x338]
call fcn.140011983
lea rcx, [rbp + 0x3c0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rbp + 0x678]
mov r8, rax
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0x48]
call fcn.140011735
nop
lea r9, [fcn.1400111a4]
mov r8d, 0xd
mov edx, 0x28
lea rcx, [rbp + 0x3f0]
call fcn.140011267
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.1400118fc
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x364], 0
lea rcx, [rbp + 0x48]
call fcn.14001197e
nop
lea rcx, [rbp + 8]
call fcn.14001197e
mov eax, dword [rbp + 0x364]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002b6c0]
call fcn.14001182a
mov eax, edi
mov rcx, qword [rbp + 0x680]
xor rcx, rbp
call fcn.1400114d3
lea rsp, [rbp + 0x690]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400116e0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140021dd0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140021df0
xor al, al
jmp 0x140021e71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140021e03
xor al, al
jmp 0x140021e71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140021e2d
xor al, al
jmp 0x140021e71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140021e41
xor al, al
jmp 0x140021e71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140021e53
xor al, al
jmp 0x140021e71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140021e6f
xor al, al
jmp 0x140021e71
mov al, 1
add rsp, 0x38
ret
Function at 0x140002ed0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140002f27
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.140002f30
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140002f17
mov qword [rsi], rdi
call fcn.140016840
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.14001d040
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000c1c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movdqa xmmword [rsp + 0x70], xmm13
movdqa xmmword [rsp + 0x60], xmm12
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqu xmm4, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rcx + 0x30]
movd xmm0, r8d
pxor xmm0, xmm4
lea r8, [rdx - 0x40]
lea r11, [rcx + 0x40]
mov eax, 0x40
cmp r8, rax
jb 0x14000c30d
add rdx, 0xffffffffffffff80
mov r9, rdx
and r9, 0xffffffffffffffc0
mov r10, r9
sub r10, 0xffffffffffffff80
movabs rax, 0x154442bd4
movq xmm9, rax
movdqa xmm8, xmmword [0x1400f3610]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm9, 0
movdqa xmm12, xmm3
pclmulqdq xmm12, xmm9, 0
movdqa xmm11, xmm2
pclmulqdq xmm11, xmm9, 0
movdqa xmm10, xmm1
pclmulqdq xmm10, xmm9, 0
movdqa xmm4, xmm0
pclmulqdq xmm4, xmm8, 0x11
movdqa xmm5, xmm3
pclmulqdq xmm5, xmm8, 0x11
movdqa xmm7, xmm2
pclmulqdq xmm7, xmm8, 0x11
movdqa xmm13, xmm1
pclmulqdq xmm13, xmm8, 0x11
movdqu xmm0, xmmword [r11]
pxor xmm0, xmm6
pxor xmm0, xmm4
movdqu xmm3, xmmword [r11 + 0x10]
pxor xmm3, xmm12
pxor xmm3, xmm5
movdqu xmm2, xmmword [r11 + 0x20]
pxor xmm2, xmm11
pxor xmm2, xmm7
movdqu xmm1, xmmword [r11 + 0x30]
pxor xmm1, xmm10
pxor xmm1, xmm13
add r8, 0xffffffffffffffc0
add r11, 0x40
cmp r8, 0x3f
ja 0x14000c258
sub rdx, r9
add rcx, r10
mov r8, rdx
mov r11, rcx
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x1400f3620]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp r8, 0x10
jb 0x14000c39d
movdqu xmm1, xmmword [r11]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm1
pxor xmm0, xmm2
add r11, 0x10
add r8, 0xfffffffffffffff0
cmp r8, 0xf
ja 0x14000c372
movdqa xmm1, xmmword [0x1400f3620]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pmovzxdq xmm1, xmm0
psrldq xmm0, 4
movabs rax, 0x163cd6124
movq xmm2, rax
pclmulqdq xmm2, xmm1, 0
pxor xmm2, xmm0
pmovzxdq xmm0, xmm2
pclmulqdq xmm0, xmmword [0x1400f3630], 0x10
pmovzxdq xmm0, xmm0
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000d370
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm6
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x140128a38], 0
je 0x14000d39d
xor esi, esi
jmp 0x14000d4be
mov ecx, 0x30
call fcn.1400a6840
mov rsi, rax
mov ecx, 0x20
call fcn.1400a6840
mov qword [rsi], rax
lea rcx, [rax + 0x20]
mov qword [rsi + 0x10], rcx
mov edx, 7
movq xmm6, rdx
pslldq xmm6, 8
movdqu xmmword [rax + 0x10], xmm6
mov word [rax], 0
mov qword [rsi + 8], rcx
mov qword [rsi + 0x20], 0
mov ecx, 0x60
call fcn.1400a6840
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], 1
mov qword [0x140128a38], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdi, rax
movdqu xmmword [rsp + 0x38], xmm6
mov word [rsp + 0x28], 0
mov rcx, rax
call fcn.1400de470
mov rbx, rax
cmp rax, 7
jbe 0x14000d44b
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov r9, rdi
call fcn.140003250
jmp 0x14000d46a
mov qword [rsp + 0x38], rbx
mov r8, rbx
add r8, rbx
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.1400ca590
mov word [rsp + rbx*2 + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14000d4f0
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14000d4bb
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000d4b6
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000d4da
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.1400a68b0
mov sil, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a6c00
mov eax, esi
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
call fcn.1400d7230
ud2

Function at 0x14000d4f0
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], 0
lea rdi, [rsp + 0x30]
mov rcx, rdx
mov edx, 3
mov r8, rdi
call fcn.140022ca0
cmp qword [rsp + 0x40], 0
je 0x14000d57f
mov dword [rsp + 0x2c], 0
cmp qword [rsp + 0x48], 7
jbe 0x14000d556
mov rdi, qword [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov edx, dword [rsp + 0x2c]
mov rcx, rsi
mov r8, rax
call fcn.14000cff0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x14000d5c3
mov rcx, qword [rsp + 0x30]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14000d5be
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14000d5d8
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.1400a68b0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a6c00
nop
add rsp, 0x58
pop rdi
pop rsi
ret
call fcn.1400d7230
ud2
Function at 0x140014e60
Capabilities:
Move file

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
xor edi, edi
xor edx, edx
call fcn.140024bd0
cmp qword [rsi + 0x10], 0x103
ja 0x140014eb1
cmp qword [rsi + 0x18], 7
jbe 0x140014e9a
mov rsi, qword [rsi]
mov rcx, rsi
xor edx, edx
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
lea rcx, [rsp + 0x28]
call fcn.140024cd0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a6c00
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140014ee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rsi, [rsp + 0x20]
mov rcx, rsi
xor edx, edx
call fcn.140024bd0
cmp qword [rdi + 0x18], 7
jbe 0x140014f12
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rsi
call fcn.140024cd0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a6c00
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140014f40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rsi, [rsp + 0x28]
mov rcx, rsi
xor edx, edx
call fcn.140024bd0
cmp qword [rdi + 0x18], 7
jbe 0x140014f71
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
setne al
and edi, 0x10
shr edi, 4
and dil, al
mov rcx, rsi
call fcn.140024cd0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a6c00
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140014fb0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x290
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x288], rax
lea rdi, [rsp + 0x70]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x102
jbe 0x140014ff0
xor esi, esi
jmp 0x140015055
mov qword [rsp + 0x20], rdi
cmp word [rsp + 0x70], 0
je 0x14001500e
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x72], 0
lea rax, [rax + 1]
jne 0x140015000
jmp 0x140015010
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400120b0
lea rbx, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
call fcn.140013d70
mov rcx, rsi
mov rdx, rbx
call fcn.140012240
mov rcx, rbx
call fcn.140012160
mov rcx, rdi
call fcn.140012160
mov sil, 1
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.1400a6c00
mov eax, esi
add rsp, 0x290
pop rbx
pop rdi
pop rsi
ret
Function at 0x140015080
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov rsi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400150f0
movzx eax, word [rsp + 0x70]
test ax, ax
je 0x1400150f0
mov qword [rsp + 0x40], rdi
xor eax, eax
cmp word [rsp + rax*2 + 0x72], 0
lea rax, [rax + 1]
jne 0x1400150d0
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400120b0
jmp 0x140015144
lea rdi, [rsp + 0x50]
mov rcx, rdi
call fcn.140011f80
mov rcx, rdi
call fcn.140014fb0
test al, al
je 0x140015118
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140012070
jmp 0x14001513a
lea rax, [0x1400f3708]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 3
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400120b0
lea rcx, [rsp + 0x50]
call fcn.140012160
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1400a6c00
mov rax, rsi
add rsp, 0x288
pop rdi
pop rsi
ret
Function at 0x140015580
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov r15, rdx
mov rdi, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.140024bd0
cmp qword [rdi + 0x18], 7
mov rbx, rdi
jbe 0x1400155ba
mov rbx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400155f0
mov bl, 1
test al, 0x10
jne 0x1400156e1
test r15, r15
je 0x1400155de
mov dword [r15], 0xfffffff7
mov ecx, 0x50
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1400156e1
lea rbp, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbp
call fcn.140012eb0
mov rax, qword [rdi + 0x10]
cmp qword [rsp + 0x60], rax
jne 0x140015657
test rax, rax
je 0x140015644
cmp qword [rdi + 0x18], 7
mov rcx, rdi
jbe 0x14001561d
mov rcx, qword [rdi]
cmp qword [rsp + 0x68], 7
jbe 0x14001562a
mov rbp, qword [rsp + 0x50]
xor edx, edx
nop dword [rax]
movzx esi, word [rbp + rdx*2]
cmp si, word [rcx + rdx*2]
jne 0x140015657
add rdx, 1
cmp rax, rdx
jne 0x140015630
test r15, r15
je 0x140015650
mov dword [r15], 0xfffffffc
mov ecx, 2
jmp 0x1400156cf
lea rcx, [rsp + 0x50]
mov rdx, r15
call fcn.140015580
test al, al
je 0x1400156d5
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1400156d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
cmp eax, 0xb7
jne 0x1400156be
lea r14, [rsp + 0x38]
mov rcx, r14
xor edx, edx
call fcn.140024bd0
cmp qword [rdi + 0x18], 7
jbe 0x1400156a1
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rcx, r14
call fcn.140024cd0
cmp edi, 0xffffffff
je 0x1400156be
and edi, 0x10
jne 0x1400156d7
test r15, r15
je 0x1400156cd
mov ecx, ebp
call fcn.140026540
mov dword [r15], eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea rcx, [rsp + 0x50]
call fcn.140012160
lea rcx, [rsp + 0x20]
call fcn.140024cd0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a6c00
mov eax, ebx
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140015c30
Capabilities:
Check if file exists
Copy file

Disassembly:
xor r8d, r8d
jmp 0x140015c40
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
xor edi, edi
xor edx, edx
call fcn.140024bd0
mov rcx, rbx
call fcn.140013e50
test al, al
jne 0x140015ce9
mov rcx, rsi
call fcn.140013e50
test al, al
jne 0x140015ce7
cmp qword [rbx + 0x10], 0x103
ja 0x140015ce7
cmp qword [rsi + 0x10], 0x103
ja 0x140015ce7
cmp qword [rsi + 0x18], 7
jbe 0x140015ca4
mov rsi, qword [rsi]
movzx r8d, bpl
cmp qword [rbx + 0x18], 7
jbe 0x140015cb2
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140015ce7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140015ce7
mov dil, 1
test al, 1
je 0x140015ce9
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140015ce9
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.140024cd0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a6c00
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140015c40
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
xor r8d, r8d
jmp 0x140015c40
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
mov rax, qword [0x140125058]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x28]
xor edi, edi
xor edx, edx
call fcn.140024bd0
mov rcx, rbx
call fcn.140013e50
test al, al
jne 0x140015ce9
mov rcx, rsi
call fcn.140013e50
test al, al
jne 0x140015ce7
cmp qword [rbx + 0x10], 0x103
ja 0x140015ce7
cmp qword [rsi + 0x10], 0x103
ja 0x140015ce7
cmp qword [rsi + 0x18], 7
jbe 0x140015ca4
mov rsi, qword [rsi]
movzx r8d, bpl
cmp qword [rbx + 0x18], 7
jbe 0x140015cb2
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140015ce7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140015ce7
mov dil, 1
test al, 1
je 0x140015ce9
and eax, 0xfffffffe
mov rcx, rsi
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x140015ce9
xor edi, edi
lea rcx, [rsp + 0x28]
call fcn.140024cd0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400a6c00
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret