joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002924c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c844
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c844
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002939c
cmp rax, 0xffffffffffffffff
je 0x14002939c
xor edi, edi
test rbp, rbp
jle 0x140029347
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f158
mov rbx, rax
test rax, rax
jne 0x1400292d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002933d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a178
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d520
cmp eax, 0xffffffff
je 0x14002931d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400292e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a178
jmp 0x14002933d
cmp byte [rsi + 0x38], dil
je 0x140029334
cmp dword [rsi + 0x34], 5
jne 0x140029334
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002933d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001af0c
jmp 0x1400293b0
jns 0x1400293b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c844
cmp rax, 0xffffffffffffffff
jne 0x140029368
cmp byte [rsi + 0x30], dil
je 0x1400293b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400293b0
mov ecx, r14d
call fcn.140018630
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400293b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400293b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400293a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400293ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c844
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140ed8ef0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140ed8efa
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140ed8f23
pop rbp
sub rbp, 0x33
sub rbp, 0xed8ef0
sub rsp, 0x20
in eax, dx
add byte [rax - 0x7f], cl
in al, dx
and byte [rax], al
add byte [rax], al
jmp 0x140ed8f42
mov rax, 0xed8ef0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff967a283f
xor byte [rax], dl
inc rax
dec rcx
jne 0x140ed8f61
jmp 0x140ed8f78
ja 0x140ed8f30
invalid
Function at 0x1400025eb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140004070]
jne 0x14000215a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002156
repz ret
ror rcx, 0x10
jmp 0x140002544
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140004160]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140004258]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400025c9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140004160]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400025eb
mov rax, qword [rsp + 0x88]
mov qword [0x140004258], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400041f8], rax
mov rax, qword [0x140004258]
mov qword [0x1400040d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400041e0], rax
mov dword [0x1400040c0], 0xc0000409
mov dword [0x1400040c4], 1
mov rax, qword [0x140004070]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140004078]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140004158], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140003320]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140004158], 0
jne 0x140002672
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400059f0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [rax + 8], 0
mov rdi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140005a9b
lea rdx, [rax + 8]
call fcn.1400044c4
mov ebx, eax
test eax, eax
jns 0x140005a38
lea rax, str.Failed_to_get_max_length_of_input_buffer.
mov edx, 0x417
jmp 0x140005b5d
mov rsi, qword [rsp + 0x40]
mov eax, 0xffffffff
cmp rsi, rax
cmova esi, eax
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
test eax, eax
jne 0x140005ac1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov edi, 0x424
or ebx, 0x80070000
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilpathutil.cpp
test eax, eax
mov edx, edi
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
lea rax, str.Failed_to_get_system_directory_path_with_default_size.
mov edx, edi
jmp 0x140005b5d
mov edx, 0x105
mov rcx, rdi
mov esi, edx
call fcn.140003094
mov ebx, eax
test eax, eax
jns 0x140005a48
lea rax, str.Failed_to_allocate_space_for_system_directory.
mov edx, 0x420
jmp 0x140005b5d
cmp ebp, esi
jbe 0x140005b43
mov rdx, rbp
mov rcx, rdi
call fcn.140003094
mov ebx, eax
test eax, eax
jns 0x140005ae4
lea rax, str.Failed_to_realloc_system_directory_path.
mov edx, 0x429
jmp 0x140005b5d
mov rcx, qword [rdi]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140005b33
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov edi, 0x42e
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilpathutil.cpp
mov edx, edi
call fcn.1400012b0
lea rax, str.Failed_to_get_system_directory_path_with_returned_size.
jmp 0x140005a94
cmp eax, ebp
jbe 0x140005b43
mov ebx, 0x8007007a
mov edi, 0x432
jmp 0x140005b16
mov rcx, rdi
call fcn.140004ab4
mov ebx, eax
test eax, eax
jns 0x140005b7c
lea rax, str.Failed_to_terminate_system_directory_path_with_backslash.
mov edx, 0x437
mov r9d, 0x20
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilpathutil.cpp
mov dword [rsp + 0x20], ebx
lea r8d, [r9 - 0x1b]
call fcn.1400012b4
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140005b94
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and qword [rax + 8], 0
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140005c3f
lea rdx, [rax + 8]
call fcn.1400044c4
mov ebx, eax
test eax, eax
jns 0x140005bdc
lea rax, str.Failed_to_get_max_length_of_input_buffer.
mov edx, 0x44a
jmp 0x140005d04
mov rbp, qword [rsp + 0x40]
mov eax, 0xffffffff
cmp rbp, rax
cmova ebp, eax
mov rcx, qword [rsi]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
mov edi, eax
test eax, eax
jne 0x140005c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov edi, 0x457
or ebx, 0x80070000
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilpathutil.cpp
test eax, eax
mov edx, edi
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
lea rax, str.Failed_to_get_system_wow64_directory_path_with_default_size.
mov edx, edi
jmp 0x140005d04
mov edx, 0x105
mov rcx, rsi
mov ebp, edx
call fcn.140003094
mov ebx, eax
test eax, eax
jns 0x140005bec
lea rax, str.Failed_to_allocate_space_for_system_wow64_directory.
mov edx, 0x453
jmp 0x140005d04
inc edi
cmp edi, ebp
jbe 0x140005cea
mov edx, edi
mov rcx, rsi
call fcn.140003094
mov ebx, eax
test eax, eax
jns 0x140005c89
lea rax, str.Failed_to_realloc_system_wow64_directory_path.
mov edx, 0x45e
jmp 0x140005d04
mov rcx, qword [rsi]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x140005cd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov edi, 0x463
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilpathutil.cpp
mov edx, edi
call fcn.1400012b0
lea rax, str.Failed_to_get_system_wow64_directory_path_with_returned_size.
jmp 0x140005c38
inc eax
cmp eax, edi
jbe 0x140005cea
mov ebx, 0x8007007a
mov edi, 0x469
jmp 0x140005cbb
mov rcx, rsi
call fcn.140004ab4
mov ebx, eax
test eax, eax
jns 0x140005d23
lea rax, str.Failed_to_terminate_system_wow64_directory_path_with_backslash.
mov edx, 0x46e
mov r9d, 0x20
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilpathutil.cpp
mov dword [rsp + 0x20], ebx
lea r8d, [r9 - 0x1b]
call fcn.1400012b4
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140006f9c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
and qword [rax + 0x10], 0
mov rbp, rcx
mov rcx, qword [rdx]
mov r15, r8
mov r14, rdx
test rcx, rcx
je 0x14000709c
lea rdx, [rax + 0x10]
call fcn.1400044c4
mov ebx, eax
test eax, eax
jns 0x14000700d
lea rax, str.Failed_to_get_max_length_of_input_buffer.
mov edx, 0x25
mov r8d, 5
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilenvutil.cpp
mov dword [rsp + 0x20], ebx
lea r9d, [r8 + 0x36]
call fcn.1400012b4
jmp 0x14000714a
mov rsi, qword [rsp + 0x68]
mov eax, 0xffffffff
cmp rsi, rax
cmova esi, eax
mov rdx, qword [r14]
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
jne 0x1400070c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x34
movzx ebx, ax
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilenvutil.cpp
or ebx, 0x80070000
mov edx, edi
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
mov r9d, 0x3b
mov qword [rsp + 0x30], rbp
lea rax, str.Failed_to_expand_environment_variables_in_string:__ls
mov edx, edi
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilenvutil.cpp
mov dword [rsp + 0x20], ebx
lea r8d, [r9 - 0x36]
call fcn.1400012b4
jmp 0x14000714a
mov edx, 0x40
mov rcx, r14
mov esi, edx
call fcn.140003094
mov ebx, eax
test eax, eax
jns 0x14000701d
lea rax, str.Failed_to_allocate_space_for_expanded_path.
mov edx, 0x2e
jmp 0x140006fe9
cmp esi, edi
jae 0x140007140
mov rdx, rdi
mov rcx, r14
mov esi, edi
call fcn.140003094
mov ebx, eax
test eax, eax
jns 0x1400070ee
lea rax, str.Failed_to_re_allocate_more_space_for_expanded_path.
mov edx, 0x3a
jmp 0x140006fe9
mov rdx, qword [r14]
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
jne 0x140007113
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x3f
jmp 0x140007041
cmp esi, eax
jae 0x140007140
mov ebx, 0x8007007a
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutilenvutil.cpp
mov edi, 0x43
mov r8d, ebx
mov edx, edi
call fcn.1400012b0
lea rax, str.Failed_to_allocate_buffer_for_expanded_string.
mov edx, edi
jmp 0x140006fe9
test r15, r15
je 0x14000714a
mov eax, edi
mov qword [r15], rax
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140007168
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
xor r14d, r14d
mov rdi, rcx
mov rdx, rcx
mov qword [rbp + 0x30], r14
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x38], r14
mov ebx, r14d
lea r8d, [r14 + 2]
call fcn.1400050b4
test eax, eax
jns 0x1400071bc
mov qword [rsp + 0x30], rdi
lea rcx, str.Failed_to_get_full_path_for:__ls
mov qword [rsp + 0x28], rcx
mov edx, 0x16b
mov dword [rsp + 0x20], eax
jmp 0x140007275
mov rcx, qword [rbp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.140006654
test rax, rax
jne 0x14000720b
mov edi, 0x80070057
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutildirutil.cpp
mov r8d, edi
mov edx, 0x16e
call fcn.1400012b0
mov rax, qword [rbp + 0x30]
mov edx, 0x16e
mov qword [rsp + 0x30], rax
lea rax, str.Full_path_was_not_rooted:__ls
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
jmp 0x140007275
mov rcx, qword [rbp + 0x30]
sub rax, rcx
sar rax, 1
mov qword [rbp + 0x38], rax
test rcx, rcx
je 0x140007299
cmp word [rcx + rax*2], r14w
je 0x14000728f
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14000728b
mov rcx, qword [rbp + 0x30]
lea r8, [rbp + 0x38]
lea rdx, [rbp + 0x30]
inc ebx
call fcn.1400058e0
mov ecx, eax
test eax, eax
js 0x140007257
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140007299
mov rax, qword [rbp + 0x38]
jmp 0x14000721e
mov rax, qword [rbp + 0x30]
mov edx, 0x177
mov qword [rsp + 0x30], rax
lea rax, str.Failed_to_get_parent_directory_for_path:__ls
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9d, 0xe
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutildirutil.cpp
lea r8d, [r9 - 9]
call fcn.1400012b4
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140007299
call fcn.140004278
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1400079e8
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x40
xor r14d, r14d
mov rbp, rdx
mov ebx, r14d
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140007b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140007b40
cmp eax, 3
je 0x140007a42
xor edx, edx
mov rcx, rdi
call fcn.140007b5c
test eax, eax
jne 0x140007b40
movzx ecx, word [rdi]
mov rsi, r14
mov rdx, rdi
test cx, cx
je 0x140007aff
mov r12d, 0x5c
cmp cx, r12w
mov rax, rdx
cmovne rax, rsi
add rdx, 2
mov rsi, rax
movzx ecx, word [rdx]
test cx, cx
jne 0x140007a5a
test rax, rax
je 0x140007aff
mov rdx, rbp
mov word [rax], r14w
mov rcx, rdi
call fcn.1400079e8
mov word [rsi], r12w
mov ebx, eax
test eax, eax
jns 0x140007ac6
mov edx, 0x71
mov qword [rsp + 0x30], rdi
lea rax, str.failed_to_create_path:__ls
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutildirutil.cpp
mov dword [rsp + 0x20], ebx
lea r9d, [rdx - 0x63]
lea r8d, [rdx - 0x6d]
call fcn.1400012b4
jmp 0x140007b40
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140007afa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140007aea
mov ebx, 1
jmp 0x140007b40
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140007b40
mov ebx, r14d
jmp 0x140007b40
mov ebx, 0x80070003
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutildirutil.cpp
mov edi, 0x6c
mov r8d, ebx
mov edx, edi
call fcn.1400012b0
lea rax, str.cannot_find_parent_path
mov edx, edi
mov qword [rsp + 0x28], rax
lea r9d, [rdi - 0x5e]
lea r8d, [rdi - 0x68]
mov dword [rsp + 0x20], ebx
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutildirutil.cpp
call fcn.1400012b4
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret

Function at 0x140007b5c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140007b86
test al, 0x10
je 0x140007b86
test rdi, rdi
je 0x140007b81
mov dword [rdi], eax
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007b94
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
and qword [rax + 8], 0
mov r15, rcx
mov rcx, qword [rcx]
xor ebp, ebp
mov r12, rdx
test rcx, rcx
je 0x140007c53
lea rdx, [rax + 8]
call fcn.1400044c4
mov ebx, eax
test eax, eax
jns 0x140007be4
lea rax, str.Failed_to_get_max_length_of_input_buffer.
mov edx, 0x196
jmp 0x140007ccc
mov rdi, qword [rsp + 0x60]
mov eax, 0xffffffff
cmp rdi, rax
cmova edi, eax
mov rdx, qword [r15]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
je 0x140007c8f
cmp r14d, edi
jb 0x140007c2a
mov edx, r14d
mov rcx, r15
call fcn.140003094
mov ebx, eax
test eax, eax
js 0x140007c76
inc ebp
mov edi, r14d
cmp ebp, 0xa
jb 0x140007bf4
cmp ebp, 0xa
jne 0x140007c84
mov ebx, 0x8007007a
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutildirutil.cpp
mov edi, 0x1b4
mov r8d, ebx
mov edx, edi
call fcn.1400012b0
lea rax, str.GetCurrentDirectoryW_results_never_converged.
jmp 0x140007cca
mov edx, 0x105
mov rcx, r15
mov edi, edx
call fcn.140003094
mov ebx, eax
test eax, eax
jns 0x140007bf4
lea rax, str.Failed_to_allocate_space_for_current_directory.
mov edx, 0x19f
jmp 0x140007ccc
lea rax, str.Failed_to_reallocate_space_for_current_directory.
mov edx, 0x1ad
jmp 0x140007ccc
test r12, r12
je 0x140007ceb
mov qword [r12], r14
jmp 0x140007ceb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov edi, 0x1a5
or ebx, 0x80070000
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutildirutil.cpp
test eax, eax
mov edx, edi
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
lea rax, str.Failed_to_get_current_directory.
mov edx, edi
mov r9d, 0xe
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_srclibsdutilwixtoolset.dutildirutil.cpp
mov dword [rsp + 0x20], ebx
lea r8d, [r9 - 9]
call fcn.1400012b4
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140013380
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax + 8], 0
lea r8, [rax + 8]
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x28]
xor r9d, r9d
mov rcx, rsi
call fcn.14000c5ac
mov ebx, eax
test eax, eax
jns 0x1400133c5
lea rax, str.Failed_to_format_variable_string.
mov edx, 0x274
jmp 0x1400134b4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140013469
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 1
lea ecx, [rax - 2]
cmp ecx, r8d
jbe 0x140013460
test eax, eax
je 0x140013488
movzx ebx, ax
lea rcx, str.d:_awixwix_src_burnengine_search.cpp
or ebx, 0x80070000
mov esi, 0x280
test eax, eax
mov edx, esi
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
call fcn.1400012b0
mov rax, qword [rdi + 0x28]
lea rcx, str.d:_awixwix_src_burnengine_search.cpp
mov qword [rsp + 0x38], rax
mov r9d, 0x100
mov rax, qword [rdi]
mov r8d, 5
mov qword [rsp + 0x30], rax
mov edx, esi
lea rax, str.Directory_search:__ls__failed_get_to_directory_attributes.__ls
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.1400012b4
jmp 0x1400134d5
lea rdx, str.Directory_search:__ls__did_not_find_path:__ls
jmp 0x140013477
and eax, 0x10
test al, al
jne 0x14001348d
lea rdx, str.Directory_search:__ls__found_file_at_path:__ls
mov r8, qword [rdi]
mov ecx, 2
mov r9, qword [rdi + 0x28]
call fcn.14000c0c0
xor r8d, r8d
jmp 0x140013493
mov r8d, 1
mov rdx, qword [rdi + 8]
xor r9d, r9d
mov rcx, rsi
call fcn.14000db48
mov ebx, eax
test eax, eax
jns 0x1400134d5
lea rax, str.Failed_to_set_variable.
mov edx, 0x28e
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_src_burnengine_search.cpp
mov r9d, 0x100
mov dword [rsp + 0x20], ebx
mov r8d, 5
call fcn.1400012b4
mov rcx, qword [rsp + 0x50]
call fcn.140004578
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400134f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and qword [rax + 8], 0
lea r8, [rax + 8]
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rcx + 0x28]
xor r9d, r9d
mov rcx, rsi
call fcn.14000c5ac
mov ebx, eax
test eax, eax
jns 0x14001355a
lea rax, str.Failed_to_format_variable_string.
mov edx, 0x2ad
mov qword [rsp + 0x28], rax
lea rcx, str.d:_awixwix_src_burnengine_search.cpp
mov r9d, 0x100
mov dword [rsp + 0x20], ebx
mov r8d, 5
call fcn.1400012b4
jmp 0x140013623
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140013580
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x1400135b6
test al, 0x10
je 0x1400135b1
mov r8, qword [rsp + 0x50]
xor r9d, r9d
mov rdx, qword [rdi + 8]
mov rcx, rsi
and dword [rsp + 0x20], 0
call fcn.14000db80
mov ebx, eax
test eax, eax
jns 0x1400135b6
lea rax, str.Failed_to_set_directory_search_path_variable.
mov edx, 0x2b7
jmp 0x140013534
mov ebx, 0x80070003
lea eax, [rbx + 0x7ff8fffe]
cmp eax, 1
jbe 0x140013605
test ebx, ebx
jns 0x140013623
mov rax, qword [rdi + 0x28]
lea rcx, str.d:_awixwix_src_burnengine_search.cpp
mov qword [rsp + 0x38], rax
mov edx, 0x2c3
mov rax, qword [rdi]
mov r9d, 0x100
mov qword [rsp + 0x30], rax
mov r8d, 5
lea rax, str.Failed_while_searching_directory_search:__ls__for_path:__ls
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.1400012b4
jmp 0x140013623
mov r9, qword [rdi + 0x28]
lea rdx, str.Directory_search:__ls__did_not_find_path:__ls__reason:_0x_x
mov r8, qword [rdi]
mov ecx, 2
mov dword [rsp + 0x20], ebx
call fcn.14000c0c0
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
call fcn.140004578
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret