joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000276c
Capabilities:
Accept command line arguments

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rcx
call fcn.1400031e8
test eax, eax
js 0x14000280a
cmp qword [rdi], 0
je 0x14000280a
mov rax, qword [0x14003a140]
lea rcx, [0x14003a140]
mov rax, qword [rax + 0x18]
call qword [0x140025fc8]
add rax, 0x18
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov r8, rax
lea rdx, str.Failed_validating_command_line:__s
lea rcx, [rsp + 0x58]
call fcn.140004dd8
mov rbx, qword [rsp + 0x58]
mov r8, rbx
mov edx, 1
mov rcx, qword [rdi]
call fcn.1400189f0
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000280a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140025fc8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140005fa4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x40
cmp qword [0x14003c190], 0
mov rdi, rdx
je 0x140006082
call fcn.140006098
test eax, eax
je 0x140005ff8
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x60]
mov rdx, rdi
mov rcx, qword [0x14003c190]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
nop dword [rax + rax]
jmp 0x140006082
mov edx, dword [rsp + 0x60]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140006082
and qword [rsp + 0x38], 0
xor edx, edx
mov r9d, dword [rsp + 0x60]
mov r8, rdi
and qword [rsp + 0x30], 0
lea ecx, [r9 + r9]
mov dword [rsp + 0x28], ecx
lea ecx, [rdx + 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov dword [rsp + 0x60], eax
test eax, eax
je 0x140006073
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rcx, qword [0x14003c190]
mov r8d, eax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1400074cc
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov r14, rcx
xor edi, edi
mov esi, edi
cmp dword [rcx + 0x38], edi
jne 0x14000757b
cmp dword [rcx + 0xc4], 1
jle 0x14000757b
cmp dword [rcx + 0x70], edi
jne 0x14000752d
cmp dword [rcx + 0x78], edi
jne 0x14000751d
cmp dword [rcx + 0x44], edi
jne 0x140007515
mov dword [rdx], 0xc1500039
jmp 0x140007523
mov dword [rdx], 0xc150000e
jmp 0x140007523
mov dword [rdx], 0xc1500035
mov esi, 0x80070667
jmp 0x1400075fb
cmp dword [rcx + 0x50], edi
je 0x140007547
cmp dword [rcx + 0x44], edi
jne 0x140007547
mov dword [rdx], 0xc1500012
mov esi, 0x80070057
jmp 0x1400075fb
cmp dword [rcx + 0x78], edi
je 0x14000755e
cmp dword [rcx + 0x50], edi
je 0x140007559
mov dword [rdx], 0xc1500019
jmp 0x14000753d
cmp dword [rcx + 0x44], edi
jne 0x140007551
cmp dword [rcx + 0x58], edi
je 0x140007688
cmp dword [rcx + 0xb8], edi
jne 0x140007688
mov dword [rdx], 0xc1500032
jmp 0x14000753d
mov dword [rcx + 0x38], 1
mov rax, qword [rcx + 0x30]
cmp dword [rax - 0x10], edi
jne 0x140007688
mov r8d, 0x3e8
lea rdx, [rsp + 0x78]
mov rcx, qword [0x14003c0d0]
call fcn.140019744
mov esi, eax
test eax, eax
js 0x1400075fb
mov rbx, qword [rsp + 0x78]
test rbx, rbx
jne 0x1400075ba
mov ecx, edi
jmp 0x1400075c7
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], di
jne 0x1400075be
mov r8d, ecx
mov rdx, rbx
lea rcx, [r14 + 0x30]
call fcn.1400053fc
nop
mov rcx, rbx
call sub.msvcrt.dll_free
mov esi, edi
jmp 0x140007688
cmp qword [r14 + 0xb0], rdi
je 0x140007688
mov rax, qword [0x14003a140]
lea rcx, [0x14003a140]
mov rax, qword [rax + 0x18]
call qword [0x140025fc8]
add rax, 0x18
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
nop dword [rax + rax]
mov r8, rax
lea rdx, str.Failed_validating_command_line:__s
lea rcx, [rsp + 0x60]
call fcn.140004dd8
mov rbx, qword [rsp + 0x60]
mov r8, rbx
mov edx, 1
mov rcx, qword [r14 + 0xb0]
call fcn.1400189f0
nop
lea rdx, [rbx - 0x18]
or rcx, 0xffffffffffffffff
mov eax, ecx
lock xadd dword [rdx + 0x10], eax
add eax, ecx
test eax, eax
jg 0x140007688
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140025fc8]
mov eax, esi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400084ac
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
and qword [rcx + 8], 0
and qword [rcx + 0x18], 0
and dword [rcx + 0x20], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rax
mov byte [rcx + 0x50], al
add rcx, 0x58
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
mov qword [rcx + 0x20], rax
call fcn.140004fcc
test eax, eax
js 0x1400085d0
lea rsi, [rbx + 0x80]
mov dword [rsi], 1
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftOle
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400085af
mov rdi, qword [rsp + 0x70]
mov dword [rsp + 0x68], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.EnableATLEnumClassLock
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140008594
cmp dword [rsp + 0x60], 4
jne 0x140008594
test eax, eax
je 0x14000859a
mov dword [rsi], 1
test rdi, rdi
je 0x1400085af
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
lea rax, [0x140025120]
mov qword [rbx], rax
mov rax, qword [0x14003c088]
lock inc dword [rax + 0xc]
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov ecx, eax
call fcn.1400055ac
int3

Function at 0x14000924c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
xor r14d, r14d
test rax, rax
je 0x1400092da
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400092da
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400092ca
cmp rbx, rcx
jae 0x1400092da
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400092b5
cmp rbx, rcx
jae 0x1400092da
cmp word [rbx], r14w
je 0x1400092da
mov rax, rbx
jmp 0x1400092dc
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140011f44
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x140011f60
xor eax, eax
jmp 0x140011f7c
test al, 0x10
jne 0x140011f77
mov ecx, 0x10b
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
jmp 0x140011f5c
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400186e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
and qword [rcx + 8], 0
and qword [rcx + 0x18], 0
and dword [rcx + 0x20], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rax
mov byte [rcx + 0x50], al
add rcx, 0x58
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
mov qword [rcx + 0x20], rax
call fcn.140004fcc
test eax, eax
js 0x14001880c
lea rsi, [rbx + 0x80]
mov dword [rsi], 1
and qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftOle
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400187eb
mov rdi, qword [rsp + 0x70]
mov dword [rsp + 0x68], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.EnableATLEnumClassLock
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400187d0
cmp dword [rsp + 0x60], 4
jne 0x1400187d0
test eax, eax
je 0x1400187d6
mov dword [rsi], 1
test rdi, rdi
je 0x1400187eb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
nop
lea rax, [0x1400253b0]
mov qword [rbx], rax
mov rax, qword [0x14003c088]
lock inc dword [rax + 0xc]
mov rax, rbx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov ecx, eax
call fcn.1400055ac
int3

Function at 0x1400189f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov esi, edx
mov rbx, rcx
jne 0x140018a22
lea rcx, str.Attempting_to_write_log_message_before_LogWrapper_has_been_fully_initialized.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop dword [rax + rax]
xor eax, eax
jmp 0x140018a72
mov rcx, r8
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140018a40
mov ebx, 0x8007000e
jmp 0x140018a70
mov rcx, qword [rbx + 0x10]
mov edx, esi
mov r9, qword [rbx]
mov r8d, dword [rbx + 8]
mov qword [rsp + 0x20], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x140025fc8]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14001a264
Capabilities:
Query environment variable

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov r15, rcx
xor edi, edi
mov ebx, edi
mov esi, edi
mov qword [rsp + 0x68], rdi
mov rcx, qword [rcx]
cmp dword [rcx - 0x10], edi
je 0x14001a36c
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov r13d, eax
test eax, eax
jne 0x14001a2d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14001a384
lea r12d, [rax + 1]
mov eax, 2
mul r12
mov r14, 0xffffffffffffffff
cmovo rax, r14
lea rdx, [0x140026580]
mov rcx, rax
call fcn.140021760
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x14001a310
mov ebx, 0x8007000e
jmp 0x14001a384
lea r8, [r12 + r12]
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov r8d, r13d
mov rdx, rsi
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x14001a353
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x14001a377
inc r14
cmp word [rsi + r14*2], di
jne 0x14001a353
mov r8d, r14d
mov rdx, rsi
mov rcx, r15
call fcn.1400053fc
nop
jmp 0x14001a377
test rsi, rsi
je 0x14001a384
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14001a770
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
xor edi, edi
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x14002b9d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14001a7e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x14001a82b
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x4000000
lea rcx, [rsp + 0x40]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
je 0x14001a7c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140021520
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret

Function at 0x14001c330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
xor r9d, r9d
lea rdx, [0x14002ba50]
mov rbx, rcx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
test rax, rax
jne 0x14001c35f
add rsp, 0x20
pop rbx
ret
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadResource]
Function at 0x14001c46c
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x14003c1bc]
test eax, eax
jne 0x14001c570
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001c4db
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x30]
xor eax, eax
mov edx, dword [rsp + 0x24]
mov dword [0x14003c1bc], eax
sub ecx, 1
je 0x14001c54c
cmp ecx, 1
jne 0x14001c570
cmp edx, 5
jne 0x14001c53a
mov eax, dword [rsp + 0x28]
test eax, eax
je 0x14001c533
sub eax, ecx
je 0x14001c519
cmp eax, ecx
je 0x14001c50f
lea eax, [rdx + 0xf]
jmp 0x14001c58e
mov edx, 0x10
lea ecx, [rdx - 0xf]
jmp 0x14001c521
mov edx, 8
lea ecx, [rdx - 6]
xor eax, eax
cmp word [rsp + 0x134], cx
cmovae eax, edx
or eax, 4
jmp 0x14001c58e
mov eax, 4
jmp 0x14001c58e
cmp edx, 4
ja 0x14001c589
mov ecx, 2
mov eax, ecx
mov dword [0x14003c1bc], ecx
cmp edx, 4
jne 0x14001c570
mov ecx, dword [rsp + 0x28]
test ecx, ecx
je 0x14001c563
cmp ecx, 0xa
je 0x14001c563
cmp ecx, 0x5a
jne 0x14001c570
mov ecx, 1
mov eax, ecx
mov dword [0x14003c1bc], ecx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140021520
add rsp, 0x158
ret
mov eax, 0x20
mov dword [0x14003c1bc], eax
jmp 0x14001c570

Function at 0x14001cce4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
xor ebx, ebx
mov r14, r9
mov r15d, r8d
mov rsi, rdx
test rcx, rcx
je 0x14001cdde
test rdx, rdx
je 0x14001cdde
xor edx, edx
call fcn.14001f070
mov rdi, rax
test rax, rax
je 0x14001cd74
xor edx, edx
mov rcx, rsi
call fcn.14001f070
mov rbx, rax
test rax, rax
je 0x14001cd74
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001cd5a
xor edx, edx
mov rcx, rbx
call fcn.14001d44c
mov r9, qword [rsp + 0x70]
mov r8, r14
mov rdx, rbx
mov dword [rsp + 0x28], r15d
mov rcx, rdi
call fcn.14001ce14
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov esi, eax
test rdi, rdi
je 0x14001cda7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test rbx, rbx
je 0x14001cdcc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebp
jmp 0x14001cdf1
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14001db74
Capabilities:
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rsi, rcx
mov ebp, r14d
mov edi, r14d
test rcx, rcx
je 0x14001dc9e
cmp r14w, word [rcx]
je 0x14001dc9e
xor edx, edx
call fcn.14001f070
mov rbx, rax
test rax, rax
je 0x14001dc3a
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x14001dc00
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rbx
lea r8, str.WdsRemoveDirectory:_Unable_to_clear_attributes_on___s___GLE__0x_x
lea rcx, [0x14003c1d0]
mov dword [rsp + 0x20], eax
mov edx, 0x3000000
mov edi, eax
call fcn.14001cc5c
xor edx, edx
mov rcx, rbx
call fcn.14001d44c
mov ebp, eax
test eax, eax
jne 0x14001dc67
test edi, edi
jne 0x14001dc22
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rbx
lea r8, str.WdsRemoveDirectory:_Unable_to_remove_directory___s___GLE__0x_x
jmp 0x14001dc52
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rsi
lea r8, str.WdsRemoveDirectory:_Unable_to_prepare_path___s___GLE__0x_x
mov edi, eax
mov edx, 0x3000000
mov dword [rsp + 0x20], eax
lea rcx, [0x14003c1d0]
call fcn.14001cc5c
test rbx, rbx
je 0x14001dc8c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebp
jmp 0x14001dcb1
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14001dcd4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, ebx
test rcx, rcx
je 0x14001dd7a
cmp bx, word [rcx]
je 0x14001dd7a
xor edx, edx
call fcn.14001f070
mov rsi, rax
test rax, rax
je 0x14001dd76
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001dd25
test al, 0x10
je 0x14001dd25
lea edi, [rbx + 1]
jmp 0x14001dd48
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
mov ecx, 0x10b
cmove eax, ecx
mov ecx, 3
cmp eax, 2
cmove eax, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, edi
jmp 0x14001dd8d
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001dda4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
test rcx, rcx
je 0x14001de49
cmp bx, word [rcx]
je 0x14001de49
xor edx, edx
call fcn.14001f070
mov rsi, rax
test rax, rax
je 0x14001de29
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14001ddf9
and eax, 0x10
sete bl
neg eax
sbb edi, edi
and edi, 2
jmp 0x14001de07
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x14001de37
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14001de5c
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14001df04
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
xor ebx, ebx
xor edx, edx
call fcn.14001f070
mov rsi, rax
test rax, rax
je 0x14001df96
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
cmp edi, 0xffffffff
je 0x14001df5e
lea eax, [rbx + 1]
bt edi, 0xa
jb 0x14001df60
mov eax, ebx
test ebp, ebp
mov dword [r14], eax
sete bl
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001ee28
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r14, r8
mov rsi, rdx
mov r15, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8d, ebp
lea edx, [rdi + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14001eea9
mov r8d, dword [r14]
lea ecx, [rdi + 3]
mov r9d, ebp
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
nop dword [rax + rax]
test eax, eax
je 0x14001eeba
test rsi, rsi
je 0x14001eea2
mov qword [rsi], rbx
xor ebx, ebx
mov edi, 1
jmp 0x14001eeba
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
test rbx, rbx
je 0x14001eedf
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x50]
mov eax, edi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14001f924
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14003ba58]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
jne 0x14001f94e
xor eax, eax
jmp 0x14001fa1e
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x14001f952
mov r8d, 2
mov ecx, ebx
cmp rax, r8
setae cl
jb 0x14001f988
lea rdx, [0x14002cae8]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
mov ecx, ebx
sete cl
test ecx, ecx
je 0x14001f9b4
mov edx, 0x5c
lea rcx, [rdi + 4]
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x14001fa1c
mov edx, 0x5c
lea rcx, [rax + 2]
call sub.msvcrt.dll_wcschr
mov ebx, 1
jmp 0x14001fa1c
movabs rax, 0x5c003a003f
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.14001f880
cmp ax, 0x61
jb 0x14001f9e4
mov rcx, rdi
call fcn.14001f880
mov word [rsp + 0x20], ax
cmp ax, 0x7a
jbe 0x14001fa05
mov rcx, rdi
call fcn.14001f880
cmp ax, 0x41
jb 0x14001fa1c
mov rcx, rdi
call fcn.14001f880
mov word [rsp + 0x20], ax
cmp ax, 0x5a
ja 0x14001fa1c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp eax, 4
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140021520
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret