joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d0e4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140061c08
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140061c08
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14006d234
cmp rax, 0xffffffffffffffff
je 0x14006d234
xor edi, edi
test rbp, rbp
jle 0x14006d1df
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14005c9a0
mov rbx, rax
test rax, rax
jne 0x14006d16c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14006d1d5
mov edx, 0x8000
mov ecx, r14d
call fcn.14005a25c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14005d4f8
cmp eax, 0xffffffff
je 0x14006d1b5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14006d17c
mov edx, r15d
mov ecx, r14d
call fcn.14005a25c
jmp 0x14006d1d5
cmp byte [rsi + 0x38], dil
je 0x14006d1cc
cmp dword [rsi + 0x34], 5
jne 0x14006d1cc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14006d1d5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14005d800
jmp 0x14006d248
jns 0x14006d248
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140061c08
cmp rax, 0xffffffffffffffff
jne 0x14006d200
cmp byte [rsi + 0x30], dil
je 0x14006d248
mov edi, dword [rsi + 0x2c]
jmp 0x14006d248
mov ecx, r14d
call fcn.140065d44
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14006d248
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14006d248
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14006d241
mov eax, dword [rsi + 0x2c]
jmp 0x14006d246
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140061c08
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140002930
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140002a9c
cmp dword [rsp + 0x20], 2
jl 0x140002a9c
lea rcx, [rsp + 0x38]
call fcn.140003230
nop
mov dword [rsp + 0x40], 1
jmp 0x14000299c
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x40], eax
jge 0x140002a56
movsxd rax, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x48]
call fcn.140003250
nop
lea rdx, [0x140064afc]
lea rcx, [rsp + 0x48]
call fcn.140003510
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0xffffffff
je 0x140002a19
lea rdx, [0x140064b00]
lea rcx, [rsp + 0x48]
call fcn.140003450
movsxd r11, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + r11*8]
lea rcx, [rsp + 0x48]
call fcn.1400034d0
lea rdx, [0x140064b04]
lea rcx, [rsp + 0x48]
call fcn.1400034d0
mov eax, dword [rsp + 0x40]
add eax, 1
cmp eax, dword [rsp + 0x20]
jge 0x140002a37
lea rdx, [0x140064b08]
lea rcx, [rsp + 0x48]
call fcn.1400034d0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140003490
nop
lea rcx, [rsp + 0x48]
call fcn.1400038a0
jmp 0x140002991
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x38]
call fcn.140011510
mov r8, rax
mov edx, 0x410
lea rcx, [0x14007c2b0]
call fcn.140003f30
lea rax, [0x14007c2b0]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.1400038a0
mov rax, qword [rsp + 0x50]
jmp 0x140002ab1
cmp qword [rsp + 0x28], 0
je 0x140002aaf
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x68
ret
Function at 0x1400049a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x40], rax
movzx edx, word [rsp + 0x68]
lea r8, [0x140064e58]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400049ef
xor eax, eax
jmp 0x140004aad
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140004a11
xor eax, eax
jmp 0x140004aad
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140004a32
xor eax, eax
jmp 0x140004aad
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
cmp qword [rsp + 0x20], 0
je 0x140004a65
cmp dword [rsp + 0x28], 0
jne 0x140004a69
xor eax, eax
jmp 0x140004aad
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.1400040f0
test eax, eax
jne 0x140004a85
xor eax, eax
jmp 0x140004aad
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
call fcn.14004c0a0
mov r11, qword [rsp + 0x78]
mov eax, dword [rsp + 0x28]
mov dword [r11], eax
mov eax, 1
add rsp, 0x58
ret
Function at 0x140005400
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x2b0], 0xfffffffffffffffe
mov rax, qword [0x14007a9b0]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x2d0]
call fcn.140030440
test rax, rax
jne 0x140005456
xor eax, eax
jmp 0x14000567b
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x2d8]
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.140003f30
lea r8, str.Baymax64.Ini
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.140003fa0
cmp dword [rsp + 0x2e0], 0
jne 0x1400054c0
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400054c0
mov eax, 1
jmp 0x14000567b
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 7
mov edx, 0xc0000000
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x140005509
xor eax, eax
jmp 0x14000567b
mov byte [rsp + 0x60], 0xff
mov byte [rsp + 0x61], 0xfe
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, 2
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str._BAYMAX64__r_n
lea rcx, [rsp + 0x50]
call fcn.140003250
nop
lea rcx, [rsp + 0x50]
call fcn.140006590
movsxd rdi, eax
shl rdi, 1
lea rcx, [rsp + 0x50]
call fcn.140011510
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, edi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.14000d360
lea rdx, [rsp + 0x298]
mov rcx, qword [rsp + 0x2d0]
call fcn.140031230
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140037b60
movzx eax, al
test eax, eax
je 0x140005654
lea rcx, [rsp + 0x290]
call fcn.140003230
nop
lea rcx, [rsp + 0x40]
call fcn.1400067f0
mov r8, qword [rax]
lea rdx, str._s_r_n
lea rcx, [rsp + 0x290]
call fcn.140005820
lea rcx, [rsp + 0x290]
call fcn.140006590
movsxd rdi, eax
shl rdi, 1
lea rcx, [rsp + 0x290]
call fcn.140011510
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, edi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x40]
call fcn.14001df30
nop
lea rcx, [rsp + 0x290]
call fcn.1400038a0
jmp 0x14000559c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x2a8], eax
lea rcx, [rsp + 0x50]
call fcn.1400038a0
mov eax, dword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.14004c470
add rsp, 0x2c0
pop rdi
ret
Function at 0x14000af20
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rcx, qword [rsp + 0x90]
call fcn.14000b150
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000af8c
xor eax, eax
jmp 0x14000b0f2
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x54], eax
cmp qword [rsp + 0xa0], 0
je 0x14000afe7
mov rcx, qword [rsp + 0xa0]
mov eax, dword [rsp + 0x54]
mov dword [rcx], eax
cmp dword [rsp + 0x40], 0
jne 0x14000b0c5
cmp dword [rsp + 0x54], 0xa00000
jge 0x14000b0c5
cmp dword [rsp + 0x54], 6
jle 0x14000b0c5
mov eax, dword [rsp + 0x54]
add eax, 4
mov dword [rsp + 0x60], eax
movsxd rcx, dword [rsp + 0x60]
call fcn.14004cc90
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14000b0c5
movsxd r8, dword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.14004d750
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000b0a8
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x64], eax
jne 0x14000b0a8
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.14000b250
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x50], 1
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.14004c490
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
add rsp, 0x88
ret
Function at 0x140010d30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x6b0
mov qword [rsp + 0x680], 0xfffffffffffffffe
mov rax, qword [0x14007a9b0]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rsp + 0x480]
call fcn.140001000
mov rcx, qword [rsp + 0x6c8]
call fcn.140011510
mov rdx, rax
lea rcx, [rsp + 0x4e0]
call fcn.140011450
mov qword [rsp + 0x688], rax
mov rcx, qword [rsp + 0x688]
call fcn.140011510
lea rdx, [0x140065d84]
mov rcx, rax
call fcn.14004ddd4
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x4e0]
call fcn.1400114e0
cmp qword [rsp + 0x58], 0
jne 0x140010dff
mov dword [rsp + 0x568], 0
mov rcx, qword [rsp + 0x6c8]
call fcn.1400038a0
mov eax, dword [rsp + 0x568]
jmp 0x140010f0b
mov r9, qword [rsp + 0x58]
mov r8d, 0x400
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.14004dc7c
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x140010e43
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x480]
call fcn.140001060
jmp 0x140010dff
mov rcx, qword [rsp + 0x58]
call fcn.14004d8e8
mov qword [rsp + 0x58], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x480]
call fcn.1400027f0
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x21
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0x20
mov r9d, dword [rsp + 0x50]
lea r8, [rsp + 0x28]
mov edx, 0x10
lea rcx, [rsp + 0x60]
call fcn.140010b90
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x570]
call fcn.1400114a0
mov qword [rsp + 0x690], rax
mov rax, qword [rsp + 0x690]
mov qword [rsp + 0x698], rax
mov rcx, qword [rsp + 0x698]
call fcn.140011510
mov rdx, rax
mov rcx, qword [rsp + 0x6d0]
call fcn.140003450
nop
lea rcx, [rsp + 0x570]
call fcn.1400114e0
mov dword [rsp + 0x678], 1
mov rcx, qword [rsp + 0x6c8]
call fcn.1400038a0
mov eax, dword [rsp + 0x678]
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.14004c470
add rsp, 0x6b0
pop rdi
ret
Function at 0x140010f30
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xb0
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x140010fa1
mov eax, dword [rsp + 0x5c]
jmp 0x1400110f8
mov dword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0x19000
jae 0x140010fce
cmp dword [rsp + 0x58], 0
je 0x140010fe2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x5c]
jmp 0x1400110f8
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140003230
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x78]
call fcn.140003250
mov qword [rsp + 0xa8], rax
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xc0]
call fcn.140010d30
test eax, eax
jne 0x14001105b
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x80], eax
lea rcx, [rsp + 0x50]
call fcn.1400038a0
mov eax, dword [rsp + 0x80]
jmp 0x1400110f8
lea rcx, [rsp + 0x50]
call fcn.140011510
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xc0]
call fcn.1400287a0
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0xc0]
call fcn.1400113a0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140014530
movzx eax, al
test eax, eax
je 0x1400110dc
lea rcx, [rsp + 0x50]
call fcn.140011510
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140011520
mov rdx, rbx
mov rcx, rax
call fcn.140011270
test eax, eax
jne 0x1400110d0
mov dword [rsp + 0x5c], 1
jmp 0x1400110dc
lea rcx, [rsp + 0x40]
call fcn.1400313d0
jmp 0x140011077
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x98], eax
lea rcx, [rsp + 0x50]
call fcn.1400038a0
mov eax, dword [rsp + 0x98]
add rsp, 0xb0
pop rbx
ret
Function at 0x140011110
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
call fcn.140012290
nop
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140011164
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x28]
call fcn.1400122c0
mov eax, dword [rsp + 0x48]
jmp 0x14001126a
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x28]
call fcn.140012330
test eax, eax
jne 0x14001117c
jmp 0x14001123a
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.1400112d0
nop
lea rdx, [0x140065dd8]
lea rcx, [rsp + 0x38]
call fcn.140006890
test eax, eax
je 0x1400111d7
lea rdx, [0x140065e08]
lea rcx, [rsp + 0x38]
call fcn.140006890
test eax, eax
je 0x1400111d7
lea rdx, str.Baymax_Patcher_Tools
lea rcx, [rsp + 0x38]
call fcn.140006890
test eax, eax
je 0x1400111d7
lea rcx, [rsp + 0x38]
call fcn.1400038a0
jmp 0x14001123a
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.140011320
nop
lea rdx, [0x140065e60]
lea rcx, [rsp + 0x40]
call fcn.140006890
test eax, eax
je 0x140011213
lea rcx, [rsp + 0x40]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x38]
call fcn.1400038a0
jmp 0x14001123a
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x40]
call fcn.1400038a0
nop
lea rcx, [rsp + 0x38]
call fcn.1400038a0
xor eax, eax
test eax, eax
jne 0x140011164
cmp dword [rsp + 0x20], 0
jne 0x140011254
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140010f30
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x28]
call fcn.1400122c0
mov eax, dword [rsp + 0x4c]
add rsp, 0x68
ret

Function at 0x140012330
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x58]
call fcn.14004cd00
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140012369
xor eax, eax
jmp 0x140012429
mov ecx, dword [rsp + 0x34]
call fcn.14004cc90
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov qword [rcx], rax
mov r9, qword [rsp + 0x50]
mov r9, qword [r9]
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1400123b1
mov rcx, qword [rsp + 0x50]
call fcn.1400122e0
xor eax, eax
jmp 0x140012429
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
lea rdx, str.VarFileInfoTranslation
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1400123e1
mov rcx, qword [rsp + 0x50]
call fcn.1400122e0
xor eax, eax
jmp 0x140012429
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
and rax, 0xffff
movzx ecx, ax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
and rax, 0xffff
movzx eax, ax
and rax, 0xffff
movzx eax, ax
shl eax, 0x10
or ecx, eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], ecx
mov eax, 1
add rsp, 0x48
ret
Function at 0x140017de0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xa8]
mov dword [rax], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x68], 0x200
movsxd rcx, dword [rsp + 0x68]
call fcn.14004cc90
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140017e73
jmp 0x140017f57
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x200
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140017ea7
jmp 0x140017f57
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x140017ee3
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x140017ee5
jmp 0x140017f57
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x140017f11
mov dword [rsp + 0x3c], 0
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x28]
mov dword [rcx], eax
jmp 0x140017f45
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140017f45
mov dword [rsp + 0x3c], 1
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x28]
mov dword [rcx], eax
mov dword [rsp + 0x48], 1
xor eax, eax
test eax, eax
jne 0x140017e45
cmp qword [rsp + 0x30], 0
je 0x140017f7c
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
call fcn.14004c498
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x48]
add rsp, 0x88
ret
Function at 0x1400181f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
mov rax, qword [0x14007a9b0]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov dword [rsp + 0x100], 0
call fcn.140018b00
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 8]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x148]
add rax, 0x30
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x148]
add rax, 0x40
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x148]
add rax, 0x38
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0x40]
call fcn.1400183f0
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x40]
call fcn.1400187e0
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x40]
call fcn.140018800
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0x40]
call fcn.1400187c0
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x40]
call fcn.140018820
mov rdx, qword [rsp + 0x110]
lea rcx, [rsp + 0x40]
call fcn.140018860
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x40]
call fcn.1400188a0
mov qword [rsp + 0x108], 0
mov dword [rsp + 0xd0], 0x8f
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x108], rax
cmp qword [rsp + 0x108], 0
jne 0x140018361
xor eax, eax
jmp 0x1400183cb
mov qword [rsp + 0x30], 0
movsxd r9, dword [rsp + 0xd0]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 0
jne 0x1400183b1
mov eax, dword [rsp + 0x100]
jmp 0x1400183cb
mov rcx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x108]
mov qword [rcx], rax
mov eax, dword [rsp + 0x100]
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.14004c470
add rsp, 0x128
ret
Function at 0x1400188e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14007a9b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x40]
call fcn.140018a00
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.140018ab0
mov dword [rsp + 0x58], 0x10
mov dword [rsp + 0x30], 0
movsxd r8, dword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140018970
mov eax, dword [rsp + 0x5c]
jmp 0x1400189e6
mov qword [rsp + 0x50], 0
movsxd r9, dword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
jne 0x1400189b4
mov eax, dword [rsp + 0x5c]
jmp 0x1400189e6
movsxd r8, dword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14004c470
add rsp, 0x78
ret

Function at 0x140018d20
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x258
mov rax, qword [0x14007a9b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x14007cbc0], 0
jne 0x140018d8b
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str._ntdll.dll
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140003fa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007cbc0], rax
mov rax, qword [0x14007cbc0]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14004c470
add rsp, 0x258
ret