joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010f90
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x508
movaps xmmword [rsp + 0x4f0], xmm6
mov ebx, r9d
mov r14, r8
mov r15, rcx
mov rsi, qword [rsp + 0x570]
lea r12, [rsi + 0x10]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
lea rcx, [rsp + 0x70]
mov r8, r12
mov r9, rsi
call fcn.1400350a0
mov r13, qword [rsp + 0x70]
test r13, r13
je 0x1400111d1
mov rbp, qword [rsp + 0x78]
movaps xmmword [rsp + 0xf0], xmm6
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov rdx, r15
mov r8, r12
mov r9, rsi
call fcn.1400350a0
mov r8, qword [rsp + 0xf0]
test r8, r8
je 0x140011028
cmp qword [rsp + 0xf8], 0
je 0x1400111f6
mov eax, 0x80000001
lea rcx, [rax + 1]
test r14, r14
lea r9, str.Environment
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
cmove rdx, r9
cmove rcx, rax
add ebp, ebp
movzx r9d, bl
inc r9d
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r13
call sub.ADVAPI32.dll_RegSetKeyValueW
mov dword [rsp + 0x4c], eax
test eax, eax
je 0x1400111d8
xorps xmm6, xmm6
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x50], rax
movabs rax, 0x410000000000001b
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov rbx, qword [0x1400ab0f8]
mov r8d, 0x400
mov rcx, rdi
xor edx, edx
call fcn.14007da20
movups xmmword [rsp + 0xe0], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x38], rbx
lea rax, [0x140038110]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 0
mov dword [rsp + 0xe0], 0
movups xmmword [rsp + 0xb8], xmm6
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], 0x400
movaps xmmword [rsp + 0x30], xmm6
lea rdi, [rsp + 0xa8]
mov qword [rsp + 0x38], rdi
lea rax, [0x140041e20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
lea rdx, str.error_setting_value:_:x_n
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x60]
mov r9, rsi
call fcn.140028fc0
mov rcx, rdi
mov rdx, rsi
call fcn.14003cee0
xor eax, eax
cmp dword [rsp + 0x4c], 5
sete al
lea rax, [rax + rax*2]
inc rax
jmp 0x1400111da
mov eax, 3
jmp 0x1400111da
xor eax, eax
movaps xmm6, xmmword [rsp + 0x4f0]
add rsp, 0x508
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.c:_programs_odin_core_sys_windows_util.odin
mov edx, 0x39
mov r8d, 0xf
xor r9d, r9d
call fcn.14005d190
int3
Function at 0x140011820
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor ecx, ecx
xor edx, edx
call sub.KERNEL32.dll_GetTempPathW
test eax, eax
je 0x1400118c5
cmp eax, 0x105
mov ecx, 0x104
cmovae ecx, eax
lea rdx, [rbx + 0x10]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rbx
lea r8, str.C:_repos_PortableBuildTools_src_install.odin
lea r9, [rsp + 0x30]
call fcn.140057110
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov ecx, r14d
mov rdx, r15
call sub.KERNEL32.dll_GetTempPathW
mov edx, eax
test eax, eax
je 0x1400118e2
cmp eax, 3
jne 0x1400118cf
cmp r14, 1
jbe 0x14001196e
cmp word [r15 + 2], 0x3a
jne 0x1400118cf
cmp r14, 2
jbe 0x140011990
cmp word [r15 + 4], 0x5c
jne 0x1400118cf
mov edx, 3
cmp r14, 3
jge 0x1400118ec
jmp 0x14001192e
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x140011922
lea r9d, [rdx - 1]
cmp r14, r9
jbe 0x140011952
cmp word [r15 + r9*2], 0x5c
cmove edx, r9d
cmp rdx, r14
jg 0x14001192e
test rdx, rdx
je 0x140011915
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
mov rcx, r15
mov r8, rdi
call fcn.1400352a0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
jmp 0x14001191b
xor ecx, ecx
xor edx, edx
xor eax, eax
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdx
lea rcx, str.C:_repos_PortableBuildTools_src_install.odin
mov edx, 0x95
mov r8d, 0x1e
xor r9d, r9d
call fcn.14000e260
mov qword [rsp + 0x20], r14
lea rcx, str.C:_repos_PortableBuildTools_src_install.odin
mov edx, 0x92
mov r8d, 0x17
call fcn.14005d190
mov qword [rsp + 0x20], r14
lea rcx, str.C:_repos_PortableBuildTools_src_install.odin
mov r9d, 1
mov edx, 0x90
mov r8d, 0x11
call fcn.14005d190
mov qword [rsp + 0x20], r14
lea rcx, str.C:_repos_PortableBuildTools_src_install.odin
mov r9d, 2
mov edx, 0x90
mov r8d, 0x20
call fcn.14005d190
int3
Function at 0x140013680
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x100
movaps xmmword [rsp + 0xf0], xmm6
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov rcx, rdx
call fcn.14003e330
mov rcx, qword [r14 + 8]
test rax, rax
js 0x140013899
cmp rax, rcx
jg 0x140013899
mov rcx, qword [r14]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x1400136ff
movups xmm0, xmmword [r14]
jmp 0x140013878
lea r15, [rsi + 0x10]
lea rcx, [0x1400ab0e0]
call sub.KERNEL32.dll_AcquireSRWLockExclusive
xorps xmm6, xmm6
movaps xmmword [rsp + 0xd0], xmm6
mov qword [rsp + 0xe0], 0
lea rax, str.c:_programs_odin_core_os_file_windows.odin
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0x2a
movabs rax, 0x20000017f
mov qword [rsp + 0x78], rax
lea rax, str.get_current_directory
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0x15
xor ecx, ecx
xor edx, edx
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ecx, eax
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x20], rsi
lea r8, str.c:_programs_odin_core_os_file_windows.odin
lea r9, [rsp + 0x40]
mov rdx, r15
call fcn.140057110
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov ecx, r13d
mov rdx, r12
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov eax, eax
inc rax
cmp rax, r13
jne 0x1400138bd
lea rcx, [0x1400ab0e0]
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
test r13, r13
je 0x1400137fb
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov rcx, r12
mov rdx, r13
mov r8, r15
call fcn.1400352a0
xor r15d, r15d
mov r12d, 0
test al, al
jne 0x140013801
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
jmp 0x140013801
xor r15d, r15d
xor r12d, r12d
lea rcx, [rsp + 0xd0]
lea rdx, [rsp + 0x68]
mov r8, rsi
call fcn.140056d50
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [r14]
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], r12
movaps xmmword [rsp + 0xc0], xmm1
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
movaps xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x30]
mov r8, rbx
mov r9, rsi
call fcn.1400422c0
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [rdi], xmm0
mov rax, rdi
movaps xmm6, xmmword [rsp + 0xf0]
add rsp, 0x100
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, str.c:_programs_odin_core_path_filepath_path.odin
mov edx, 0x2a
mov r8d, 0xd
xor r9d, r9d
call fcn.14000e260
mov rax, qword [rsi + 0x20]
test rax, rax
lea r10, [0x14000d6e0]
cmovne r10, rax
lea rcx, str.runtime_assertion
lea rdx, [0x14008e9a8]
lea r8, str.c:_programs_odin_core_os_file_windows.odin
mov r9, rsi
call r10
int3
Function at 0x1400138f0
Capabilities:
Move file

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x130
movaps xmmword [rsp + 0x120], xmm6
mov rsi, r8
movabs r15, 0x600000000000001
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0xb8], xmm0
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0xa8], xmm0
lea rdi, [r8 + 0x10]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x90], xmm6
lea rcx, [rsp + 0x90]
lea r14, [rsp + 0xb8]
mov rdx, r14
mov r8, rdi
mov r9, rsi
call fcn.140013680
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0xb8], xmm0
movaps xmmword [rsp + 0x80], xmm6
lea rcx, [rsp + 0x80]
lea rbx, [rsp + 0xa8]
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.140013680
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0xa8], xmm0
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 1
movaps xmmword [rsp + 0x110], xmm6
lea rdx, [0x14008a468]
lea r14, [rsp + 0x110]
lea r8, [rsp + 0x70]
mov rcx, r14
mov r9, rsi
call fcn.140028950
movaps xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8, rdi
mov r9, rsi
call fcn.1400350a0
mov r14, qword [rsp + 0x30]
test r14, r14
je 0x140013a18
cmp qword [rsp + 0x38], 0
je 0x140013afd
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
movaps xmmword [rsp + 0x100], xmm6
lea rdx, [0x14008a468]
lea rbx, [rsp + 0x100]
lea r8, [rsp + 0x50]
mov rcx, rbx
mov r9, rsi
call fcn.140028950
movaps xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.1400350a0
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x140013a90
cmp qword [rsp + 0x38], 0
je 0x140013afd
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 1
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xe0], rax
mov word [rsp + 0xe8], 0x414
xorps xmm0, xmm0
movups xmmword [rsp + 0xea], xmm0
mov qword [rsp + 0xf8], 0
lea rcx, [rsp + 0xc8]
call sub.SHELL32.dll_SHFileOperationW
movaps xmm6, xmmword [rsp + 0x120]
add rsp, 0x130
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.c:_programs_odin_core_sys_windows_util.odin
mov edx, 0x39
mov r8d, 0xf
xor r9d, r9d
call fcn.14005d190
int3
Function at 0x14001be50
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rdx
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x50], xmm0
lea rdi, [rdx + 0x10]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm6
lea rcx, [rsp + 0x40]
lea rbx, [rsp + 0x50]
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.140013680
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.1400350a0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14001bebf
cmp qword [rsp + 0x38], 0
je 0x14001bee0
xor esi, esi
xor ecx, ecx
xor r8d, r8d
call sub.SHELL32.dll_SHCreateDirectoryExW
cmp eax, 0xb7
cmove eax, esi
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x20], 0
lea rcx, str.c:_programs_odin_core_sys_windows_util.odin
mov edx, 0x39
mov r8d, 0xf
xor r9d, r9d
call fcn.14005d190
int3

Function at 0x14001bf10
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
mov rsi, rdx
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x78], xmm0
lea rdi, [rdx + 0x10]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x60], xmm6
lea rcx, [rsp + 0x60]
lea rbx, [rsp + 0x78]
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.140013680
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x78], xmm0
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x30], rbx
movabs rax, 0x600000000000001
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 1
movaps xmmword [rsp + 0xc0], xmm6
lea rdx, [0x14008a468]
lea rbx, [rsp + 0xc0]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov r9, rsi
call fcn.140028950
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x50]
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.1400350a0
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14001bfdd
cmp qword [rsp + 0x58], 0
je 0x14001c047
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 3
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], 0
mov word [rsp + 0xa8], 0x414
movups xmmword [rsp + 0xaa], xmm6
mov qword [rsp + 0xb8], 0
lea rcx, [rsp + 0x88]
call sub.SHELL32.dll_SHFileOperationW
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0x20], 0
lea rcx, str.c:_programs_odin_core_sys_windows_util.odin
mov edx, 0x39
mov r8d, 0xf
xor r9d, r9d
call fcn.14005d190
int3
Function at 0x14001c070
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1a0
movaps xmmword [rsp + 0x190], xmm6
mov rsi, r8
mov rbx, rdx
mov rdx, rcx
lea rdi, [r8 + 0x10]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x100], xmm6
lea r14, [rsp + 0x100]
mov rcx, r14
mov r8, rdi
mov r9, rsi
call fcn.140013680
movaps xmmword [rsp + 0xf0], xmm6
lea r15, [rsp + 0xf0]
mov rcx, r15
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call fcn.140013680
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x50], r14
movabs rax, 0x600000000000001
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 2
movaps xmmword [rsp + 0x70], xmm6
lea rdx, str._a_____quiet__qn_TARGETDIR__
lea rcx, [rsp + 0x70]
lea r8, [rsp + 0x30]
mov r9, rsi
call fcn.140028950
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x110], xmm0
movaps xmm0, xmmword [0x14008a540]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x14008a530]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x14008a550]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [0x14008a560]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmm0, xmmword [0x14008a570]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [0x14008a580]
movaps xmmword [rsp + 0xd0], xmm0
movaps xmm0, xmmword [0x14008a590]
movaps xmmword [rsp + 0xe0], xmm0
lea rax, str.msiexec.exe
mov qword [rsp + 0x98], rax
movaps xmmword [rsp + 0x40], xmm6
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x110]
mov r8, rdi
mov r9, rsi
call fcn.1400350a0
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14001c1eb
cmp qword [rsp + 0x48], 0
je 0x14001c2b3
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [rsp + 0x80]
movaps xmm1, xmmword [rsp + 0x90]
movaps xmm2, xmmword [rsp + 0xb0]
movaps xmm3, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0x120], xmm0
movaps xmmword [rsp + 0x130], xmm1
movaps xmmword [rsp + 0x150], xmm2
movaps xmmword [rsp + 0x160], xmm3
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x170], xmm0
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmmword [rsp + 0x180], xmm0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x148], rax
lea rcx, [rsp + 0x120]
call sub.SHELL32.dll_ShellExecuteExW
test eax, eax
je 0x14001c29a
mov rcx, qword [rsp + 0x188]
mov edx, 0xffffffff
call sub.KERNEL32.dll_WaitForSingleObject
mov al, 1
jmp 0x14001c29c
xor eax, eax
movaps xmm6, xmmword [rsp + 0x190]
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.c:_programs_odin_core_sys_windows_util.odin
mov edx, 0x39
mov r8d, 0xf
xor r9d, r9d
call fcn.14005d190
int3
Function at 0x140024900
Capabilities:
Get disk size

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm6
mov rsi, rcx
mov qword [0x14009d160], 0xffffffffffffffff
call fcn.140023d30
test al, al
je 0x140024a70
xorps xmm6, xmm6
movaps xmmword [rsp + 0x80], xmm6
lea rcx, [rsp + 0x80]
mov rdx, rsi
call fcn.140024b40
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x68], 0
lea rdi, [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
mov r8, rdi
mov r9, rsi
call fcn.1400350a0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400249ac
cmp qword [rsp + 0x38], 0
je 0x140024b1a
lea rbx, [rsp + 0x78]
lea r8, [rsp + 0x70]
lea r14, [rsp + 0x68]
mov rdx, rbx
mov r9, r14
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x140024ac5
cmp byte [0x1400aabd0], 0
cmove r14, rbx
mov rax, qword [r14]
mov qword [0x14009d160], rax
mov rbx, qword [0x1400aac68]
lea rcx, [rax + 0x3fffffff]
test rax, rax
cmovns rcx, rax
sar rcx, 0x1e
xorps xmm6, xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x60], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
movabs rax, 0x4100000000000004
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
movaps xmmword [rsp + 0x90], xmm6
lea rdx, str.Space_available:__GB
lea r14, [rsp + 0x90]
lea r8, [rsp + 0x50]
mov rcx, r14
mov r9, rsi
call fcn.140028950
movaps xmmword [rsp + 0x30], xmm6
lea rcx, [rsp + 0x30]
mov rdx, r14
jmp 0x140024ae0
mov rdi, qword [0x1400aac68]
lea r8, [rsi + 0x10]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, str.Space_available:_Unknown
lea rcx, [rsp + 0x30]
mov r9, rsi
call fcn.1400350a0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140024aa9
cmp qword [rsp + 0x38], 0
je 0x140024b1a
mov rcx, rdi
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
jmp sub.USER32.dll_SetWindowTextW
mov rbx, qword [0x1400aac68]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, str.Space_available:_Unknown
lea rcx, [rsp + 0x30]
mov r8, rdi
mov r9, rsi
call fcn.1400350a0
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140024afd
cmp qword [rsp + 0x38], 0
je 0x140024b1a
mov rcx, rbx
call sub.USER32.dll_SetWindowTextW
movaps xmm6, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 0
lea rcx, str.c:_programs_odin_core_sys_windows_util.odin
mov edx, 0x39
mov r8d, 0xf
xor r9d, r9d
call fcn.14005d190
int3
Function at 0x140034f90
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
call sub.USER32.dll_GetWindowTextLengthW
cmp qword [rbx + 8], 0
je 0x140035052
mov r14d, eax
mov rdx, qword [rbx]
lea r8d, [r14 + 1]
mov rcx, r15
call sub.USER32.dll_GetWindowTextW
test eax, eax
jle 0x14003501e
mov rax, qword [rbx + 8]
movsxd rdx, r14d
test r14d, r14d
js 0x140035075
cmp rax, rdx
jl 0x140035075
test r14d, r14d
je 0x140035028
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rbx]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8, rdi
call fcn.1400352a0
test al, al
je 0x14003502e
movups xmmword [rsi], xmm6
jmp 0x140035024
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x140035041
xor eax, eax
xor ecx, ecx
jmp 0x140035038
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov al, 1
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsp + 0x20], 0
lea rcx, str.C:_repos_PortableBuildTools_src_widgets_widgets.odin
mov edx, 0x11a
mov r8d, 0x23
xor r9d, r9d
call fcn.14005d190
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, str.C:_repos_PortableBuildTools_src_widgets_widgets.odin
mov edx, 0x11c
mov r8d, 0x28
xor r9d, r9d
call fcn.14000e260
int3
Function at 0x140037dc0
Capabilities:
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
add byte [rax], al
add byte [rdi], cl
sub dword [rsp + 0xe0], esi
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov rax, qword [rsp + 0x160]
movups xmm0, xmmword [rax + 0x50]
movaps xmmword [rsp + 0xd0], xmm0
movups xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0xc0], xmm0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movups xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0xb0], xmm3
movaps xmmword [rsp + 0xa0], xmm2
movaps xmmword [rsp + 0x90], xmm1
movaps xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
call sub.KERNEL32.dll_GetFileSizeEx
test eax, eax
je 0x140037f64
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jle 0x140037f79
xorps xmm6, xmm6
movaps xmmword [rsp + 0x70], xmm6
lea rbp, [rsp + 0x80]
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x70]
mov rdx, r14
mov r8, rbx
call fcn.140057510
mov r13, qword [rsp + 0x70]
test r13, r13
je 0x140037f98
mov r12, qword [rsp + 0x78]
xor ebx, ebx
test r12, r12
jle 0x140037f83
lea r14, [rsp + 0x50]
lea r15, [rsp + 0x68]
nop word [rax + rax]
test rbx, rbx
js 0x140037fb9
mov rax, r12
sub rax, rbx
jl 0x140037fb9
lea rcx, [rbx + r13]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0
mov rcx, rdi
mov rdx, r14
mov r8, r15
call fcn.140042dc0
mov rcx, qword [rsp + 0x68]
add rbx, rcx
test rcx, rcx
jle 0x140037f11
cmp rbx, r12
jge 0x140037f11
test rax, rax
je 0x140037ec0
cmp rbx, r12
jge 0x140037f83
test rax, rax
je 0x140037f83
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x140037f71
mov rcx, qword [rsp + 0x88]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], r14
lea rdx, str.c:_programs_odin_core_os_os.odin
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
mov dl, 1
xor r8d, r8d
xor r9d, r9d
call rax
jmp 0x140037f71
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x140037e5c
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140037f9b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov al, 1
jmp 0x140037f9d
test rbx, rbx
js 0x140037fdd
cmp rbx, r12
jg 0x140037fdd
mov qword [rsi], r13
mov qword [rsi + 8], rbx
mov al, 1
jmp 0x140037f9d
movups xmmword [rsi], xmm6
xor eax, eax
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea rcx, str.c:_programs_odin_core_os_os.odin
mov edx, 0x45
mov r8d, 0x19
mov r9, rbx
call fcn.14000e260
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
lea rcx, str.c:_programs_odin_core_os_os.odin
mov edx, 0x84
mov r8d, 0xd
xor r9d, r9d
call fcn.14000e260
int3
Function at 0x140038010
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r9, r8
mov rbx, rdx
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov edx, 0x241
call fcn.140042c50
test rax, rax
je 0x140038048
xor esi, esi
jmp 0x1400380d7
mov rdi, qword [rsp + 0x38]
mov r12, qword [rbx + 8]
mov sil, 1
test r12, r12
je 0x1400380c6
mov dword [rsp + 0x34], 0
jle 0x1400380c6
xor r14d, r14d
mov ebp, 0x40000000
lea r15, [rsp + 0x34]
mov rax, qword [rbx + 8]
cmp r14, rax
jae 0x1400380e8
mov r8d, r12d
sub r8d, r14d
cmp r8d, 0x40000000
cmovge r8d, ebp
mov rdx, qword [rbx]
add rdx, r14
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov r9, r15
call sub.KERNEL32.dll_WriteFile
mov ecx, dword [rsp + 0x34]
test rcx, rcx
je 0x1400380bb
test eax, eax
je 0x1400380bb
add r14, rcx
cmp r14, r12
jl 0x140038070
jmp 0x1400380c6
call sub.KERNEL32.dll_GetLastError
test eax, eax
sete sil
mov rcx, rdi
call sub.KERNEL32.dll_CloseHandle
test eax, eax
jne 0x1400380d7
call sub.KERNEL32.dll_GetLastError
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov qword [rsp + 0x20], rax
lea rcx, str.c:_programs_odin_core_os_file_windows.odin
mov edx, 0x5b
mov r8d, 0x30
mov r9, r14
call fcn.14005d190
int3