joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100059bac
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rdi, rcx
mov byte [rcx + 0x6a4], 0
mov rcx, qword [rcx + 0x5e0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
lea rcx, [rdi + 0x5f0]
lea edx, [r8 + 6]
mov ebp, eax
call fcn.10004d5f0
xor r12d, r12d
lea rcx, [rdi + 0x5f0]
test eax, eax
sete r12b
xor r8d, r8d
lea edx, [r8 + 9]
call fcn.10004d5f0
xor r13d, r13d
lea rcx, [rdi + 0x5f0]
test eax, eax
sete r13b
xor r8d, r8d
lea edx, [r8 + 5]
call fcn.10004d5f0
xor r14d, r14d
mov rcx, rdi
test eax, eax
mov rax, qword [rdi]
sete r14b
call qword [rax + 0x78]
mov ebx, eax
test eax, eax
jns 0x100059ced
lea rcx, [rdi + 0x5f0]
mov r8d, r12d
mov edx, 6
call fcn.10004d5f0
lea rcx, [rdi + 0x5f0]
mov r8d, r13d
mov edx, 9
call fcn.10004d5f0
lea rcx, [rdi + 0x5f0]
mov r8d, r14d
mov edx, 5
call fcn.10004d5f0
mov rcx, qword [rdi + 0x5e0]
neg ebp
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x100059ccc
test byte [rcx + 0x1c], 1
je 0x100059ccc
mov rcx, qword [rcx + 0x10]
lea r8, [0x100004ee8]
mov edx, 0x15
mov r9d, ebx
call fcn.100040094
mov rcx, qword [0x1000c6ba0]
xor r9d, r9d
mov r8d, 0x8e
mov edx, ebx
mov dword [rsp + 0x20], SafeArrayGetElemsize
call fcn.100023cc8
jmp 0x100059cf9
mov rcx, qword [0x1000c6ba0]
call fcn.10002715c
mov rcx, qword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x44a
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x10005d2f0
Capabilities:
Hide graphical window

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov r13, rcx
xor edx, edx
mov rcx, qword [rcx + 0x3e8]
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov rcx, qword [r13 + 0x230]
call qword [sym.imp.USER32.dll_ShowWindow]
mov r11, qword [0x1000c6ba0]
cmp dword [r11 + 0x5c68], 0
je 0x10005d346
mov esi, 0x1771
lea ebp, [rsi - 1]
jmp 0x10005d366
cmp dword [r11 + 0x12c], 0
jge 0x10005d35c
mov esi, 0xbd9
mov ebp, 0x72
jmp 0x10005d366
mov esi, 0x9a
mov ebp, 0xbc3
cmp dword [r13 + 0x210], 2
je 0x10005d384
mov dword [r13 + 0x210], 2
lea rcx, [r13 + 0x70]
call fcn.10004510c
lea rcx, [0x1000c2120]
mov rax, qword [0x1000c2120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov rax, qword [0x1000c6ba0]
cmp dword [rax + 0x5c68], 0
je 0x10005d410
lea rcx, [0x1000c2120]
mov rax, qword [0x1000c2120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.10005e020
mov r12d, eax
mov rbx, qword [rsp + 0x68]
test eax, eax
js 0x10005d3f3
mov r8, rbx
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.10002bf40
mov r12d, eax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10005d41f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x10005d41f
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.10002c01c
mov r12d, eax
lea rbx, [0x1000c3470]
test r12d, r12d
js 0x10005d43b
lea rdx, [rsp + 0x60]
lea rcx, [r13 + 0x70]
call fcn.1000454dc
jmp 0x10005d465
mov rcx, qword [0x1000c3470]
cmp rcx, rbx
je 0x10005d465
test byte [rcx + 0x1c], 1
je 0x10005d465
mov edx, SafeArrayDestroy
mov r9d, r12d
lea r8, [0x100004dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100040094
lea rcx, [r13 + 0x70]
call fcn.100043f10
mov edx, ebp
lea rcx, [rsp + 0x60]
call fcn.10002c01c
test eax, eax
js 0x10005d491
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [r13 + 0x70]
call fcn.100043d1c
jmp 0x10005d4bb
mov rcx, qword [0x1000c3470]
cmp rcx, rbx
je 0x10005d4bb
test byte [rcx + 0x1c], 1
je 0x10005d4bb
mov edx, SafeArrayDestroy
mov r9d, eax
lea r8, [0x100004dd0]
mov rcx, qword [rcx + 0x10]
call fcn.100040094
mov rax, qword [0x1000c6ba0]
cmp dword [rax + 0x5c68], 0
je 0x10005d4e5
mov edx, 0x67
lea r9d, [rdx - 0x66]
mov r8d, 0x178e
lea rcx, [r13 + 0x70]
call fcn.10004551c
jmp 0x10005d4ee
lea rcx, [r13 + 0x70]
call fcn.1000456f8
lea rcx, [r13 + 0x170]
xor edx, edx
call fcn.100045aa0
lea rcx, [r13 + 0x70]
call fcn.100044200
mov edx, 5
mov rcx, qword [r13 + 0x78]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10005d535
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x10006873c
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov esi, dword [rcx + 0x24]
mov rbp, rdx
mov eax, 0x24924925
add esi, 5
xor r12d, r12d
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x400
mov rdi, r12
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
imul eax, eax, 7
sub esi, eax
lea edx, [rsi + 0x2a]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movsxd rbx, eax
lea eax, [rbx - 1]
cmp eax, 0x7ffffffd
ja 0x1000687fc
lea eax, [rbx + 1]
movsxd rcx, eax
lea eax, [r12 + 2]
mul rcx
lea rcx, [r12 - 1]
lea rdx, [0x1000c6b58]
cmovo rax, rcx
mov rcx, rax
call fcn.10001a99c
mov rdi, rax
cmp rax, r12
jne 0x1000687d1
mov ebx, 0x8007000e
jmp 0x100068803
lea edx, [rsi + 0x2a]
mov r9d, ebx
mov r8, rax
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, r12d
jle 0x1000687fc
mov rdx, rdi
mov rcx, rbp
mov word [rdi + rbx*2], r12w
call fcn.10002bba4
jmp 0x100068801
call fcn.10007ec64
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x10006efec
Capabilities:
Get file system object information

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x378
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1000c2110]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov r15d, r9d
mov rbp, r8
mov r13, rdx
mov r14, rcx
mov rsi, qword [rsp + 0x3e0]
xor edi, edi
xor r12d, r12d
lea rcx, [0x1000c2120]
mov rax, qword [0x1000c2120]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov r8d, 0x2b8
lea rcx, [rsp + 0xa0]
call sub.msvcrt.dll_memset
test r13, r13
je 0x10006f1b9
test rbp, rbp
je 0x10006f1b9
test rsi, rsi
je 0x10006f091
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.10002bba4
mov edi, eax
test eax, eax
js 0x10006f1b4
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.10002bb50
mov edi, eax
test eax, eax
js 0x10006f1b4
mov dword [rsp + 0x20], 0x210
mov r9d, 0x2b8
lea r8, [rsp + 0xa0]
mov edx, SafeArrayGetElemsize
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
jne 0x10006f0e0
mov edi, 0x80004005
jmp 0x10006f1b9
lea rdx, [0x1000c6b58]
mov ecx, 8
call fcn.10001a99c
mov rsi, rax
test rax, rax
je 0x10006f113
lea rcx, [0x1000c2120]
mov rdx, qword [0x1000c2120]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsi], rax
jmp 0x10006f115
xor esi, esi
test rsi, rsi
jne 0x10006f124
mov edi, 0x8007000e
jmp 0x10006f1b9
mov rdx, rbp
mov rcx, rsi
call fcn.10002bba4
mov edi, eax
test eax, eax
js 0x10006f1b9
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_memset
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 0xffffffffffff0002
mov dword [rsp + 0x50], 0x4d
mov dword [rsp + 0x64], 0xf000
mov dword [rsp + 0x7c], 1
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x60], r15d
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1132
mov rcx, qword [r14 + 0x50]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r12, rax
mov ecx, edi
mov edi, 0x80004005
test rax, rax
cmove ecx, edi
mov edi, ecx
jmp 0x10006f1b9
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x10006f1cc
call qword [sym.imp.USER32.dll_DestroyIcon]
test edi, edi
jns 0x10006f1f0
mov dword [rsp + 0x20], SafeArrayGetElemsize
xor r9d, r9d
mov r8d, 0x8e
mov edx, edi
mov rcx, qword [0x1000c6ba0]
call fcn.100023cc8
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10006f20b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.10009d3a0
add rsp, 0x378
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x10006f340
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2b0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1000c2110]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbx, rdx
mov edi, 1
mov rcx, qword [rdx]
test rcx, rcx
je 0x10006f394
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 3
sete cl
test ecx, ecx
jne 0x10006f484
lea rcx, [0x1000c2120]
mov rax, qword [0x1000c2120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea r9, [0x100008950]
mov r8, qword [rbx]
lea rdx, [0x100008998]
lea rcx, [rsp + 0x20]
call fcn.10002c994
test eax, eax
jns 0x10006f3f4
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10006f3ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x10006f487
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.10002b040
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, eax
and dword [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x54]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x50]
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x10006f43f
xor dil, dil
jmp 0x10006f448
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x10006f469
cmp qword [rsp + 0x30], 0
je 0x10006f469
call qword [sym.imp.USER32.dll_SetCursor]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10006f484
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, dil
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.10009d3a0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100070128
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r12, rdx
mov rsi, rcx
xor ebx, ebx
cmp dword [rcx + 0x10], ebx
jne 0x100070228
mov rcx, qword [rcx + 8]
mov rdi, rbx
cmp rcx, rbx
je 0x100070185
cmp word [rcx], bx
je 0x100070175
add rcx, 2
cmp word [rcx], bx
jne 0x10007016c
add rcx, 2
movzx eax, word [rcx]
neg ax
sbb rdi, rdi
and rdi, rcx
cmp rdi, rbx
je 0x1000701df
cmp rdi, rbx
je 0x1000701b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x1000701df
cmp eax, 3
je 0x1000701df
cmp eax, 4
je 0x1000701df
cmp eax, 5
je 0x1000701df
cmp eax, 6
je 0x1000701df
mov rax, rbx
cmp rdi, rbx
je 0x1000701d7
cmp word [rdi], bx
je 0x1000701c7
add rdi, 2
cmp word [rdi], bx
jne 0x1000701be
add rdi, 2
movzx eax, word [rdi]
neg ax
sbb rax, rax
and rax, rdi
mov rdi, rax
cmp rax, rbx
jne 0x10007018a
mov qword [rsi + 8], rdi
cmp rdi, rbx
jne 0x1000701f1
mov dword [rsi + 0x10], 1
jmp 0x100070228
mov dword [rsi + 0x10], ebx
mov rdx, qword [rsi + 8]
cmp rdx, rbx
jne 0x100070201
mov ecx, ebx
jmp 0x100070213
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r12
call fcn.10002d050
nop
jmp 0x100070228
cmp dword [rsi + 0x10], ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x10007024c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov r13, rdx
mov r12, rcx
mov rsi, qword [rcx]
xor ebx, ebx
cmp rsi, rbx
je 0x1000702bf
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x1000702bf
cmp eax, 3
je 0x1000702bf
cmp eax, 4
je 0x1000702bf
cmp eax, 5
je 0x1000702bf
cmp eax, 6
je 0x1000702bf
mov rcx, rsi
cmp word [rcx], bx
je 0x1000702ad
add rcx, 2
jmp 0x1000702a2
add rcx, 2
movzx eax, word [rcx]
neg ax
sbb rsi, rsi
and rsi, rcx
jmp 0x100070278
mov qword [r12 + 8], rsi
cmp rsi, rbx
jne 0x1000702d4
mov dword [r12 + 0x10], 1
jmp 0x1000702f8
mov dword [r12 + 0x10], ebx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
mov rcx, r13
call fcn.10002d050
nop
jmp 0x100070301
cmp dword [r12 + 0x10], ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x100070328
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, rcx
lea rcx, [0x1000c2120]
mov rax, qword [0x1000c2120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
xor esi, esi
mov qword [rbx + 8], rsi
mov dword [rbx + 0x10], esi
mov rax, qword [rbx]
lea ecx, [rsi + 1]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
lea edi, [rsi + 0x69]
sub eax, edi
or eax, ecx
jge 0x100070388
mov edx, edi
mov rcx, rbx
call fcn.10001d63c
mov rdx, qword [rbx]
cmp dword [rdx - 0xc], edi
jl 0x1000703d6
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
mov word [rax + 0xd2], si
cmp rdx, rsi
je 0x1000703ae
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp eax, edi
jbe 0x1000703b5
mov dword [rbx + 0x10], 1
mov rax, qword [rbx]
cmp dword [rax - 0xc], edi
jl 0x1000703cc
mov dword [rax - 0x10], edi
mov rax, qword [rbx]
mov word [rax + 0xd2], si
jmp 0x1000703e6
mov ecx, 0x80070057
call fcn.10001db00
mov ecx, 0x80070057
call fcn.10001db00
nop
mov rbx, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x100071144
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1000c2110]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ebx, ebx
mov rdi, rcx
cmp rcx, rbx
je 0x100071268
cmp word [rcx], bx
je 0x100071268
call qword [sym.imp.SHLWAPI.dll_PathIsUNCW]
cmp eax, ebx
jne 0x100071261
movzx eax, word [rdi]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
mov word [rsp + 0x20], ax
lea eax, [rbx + 0x3a]
mov word [rsp + 0x22], ax
lea eax, [rbx + 0x5c]
mov word [rsp + 0x24], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 2
je 0x10007126d
sub eax, 1
je 0x1000711d5
sub eax, 2
je 0x10007126d
cmp eax, 1
je 0x10007126d
jmp 0x100071261
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x24], bx
mov word [rsp + 0x30], bx
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp eax, ebx
jne 0x100071245
call fcn.10007ec64
mov ebx, eax
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10007126d
test byte [rcx + 0x1c], 1
je 0x10007126d
mov rcx, qword [rcx + 0x10]
lea r8, [0x100004c70]
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov r9d, ebx
call fcn.100040094
jmp 0x10007126d
lea rdx, [0x100008a40]
lea rcx, [rsp + 0x30]
mov r8d, 4
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, ebx
jne 0x10007126d
mov ebx, 0x800704b0
jmp 0x10007126d
mov ebx, 0x80070057
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.10009d3a0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x10007b7d0
Capabilities:
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov rsi, rcx
lea rcx, [0x1000c2120]
mov rax, qword [0x1000c2120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsi + 8]
call fcn.10002eb24
mov edi, eax
mov rbx, qword [rsp + 0x48]
test eax, eax
js 0x10007b882
cmp eax, 1
je 0x10007b882
mov rcx, rbx
call fcn.100071144
mov edi, eax
test eax, eax
js 0x10007b864
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x10007b84d
mov edi, 0x80070032
jmp 0x10007b864
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_PathIsExe]
mov ecx, edi
mov edi, 0x80070032
test eax, eax
cmove ecx, edi
mov edi, ecx
test edi, edi
js 0x10007b882
mov rax, qword [rsi]
mov r9d, 1
mov r8d, r9d
mov rdx, rbx
mov rcx, rsi
call qword [rax + 0x80]
mov edi, eax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x10007b89d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x10007eadc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1000c6c28]
test rcx, rcx
jne 0x10007eb02
call fcn.10007eb90
test eax, eax
je 0x10007eb29
mov rcx, qword [0x1000c6c28]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x10007eb7d
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x10007eb2d
xor eax, eax
jmp 0x10007eb7d
mov eax, dword [rax]
mov rcx, qword [0x1000c6c28]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x10007eb5a
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x10007eb7d
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x1000c6c28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x10007eb61
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x10007f8b8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x40]
mov r9, r8
mov rbx, rcx
xor edi, edi
mov r8, rdx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rbx], rax
cmp rax, rdi
je 0x10007f923
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10007f98d
test byte [rcx + 0x1c], 4
je 0x10007f98d
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x2f]
lea r8, [0x1000024d0]
call fcn.10001ea00
jmp 0x10007f98d
mov ebx, 0x80004005
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
sub ecx, 0xb
je 0x10007f952
sub ecx, 1
je 0x10007f944
sub ecx, 1
je 0x10007f94b
cmp ecx, 9
jne 0x10007f957
mov ebx, 0x8007000e
jmp 0x10007f957
mov ebx, 0x80070005
jmp 0x10007f957
mov ebx, 0x8007009b
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10007f988
test byte [rcx + 0x1c], 1
je 0x10007f988
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000024d0]
mov edx, 0x30
mov r9d, ebx
call fcn.100040094
cmp ebx, edi
cmovl edi, ebx
mov eax, edi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x10007f9a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10007f9ff
call fcn.10007ec64
mov ebx, eax
cmp eax, 0x80070002
je 0x10007f9fb
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10007f9fb
test byte [rcx + 0x1c], 1
je 0x10007f9fb
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000024d0]
mov edx, 0x35
mov r9, rdi
mov dword [rsp + 0x20], ebx
call fcn.10002f224
mov eax, ebx
jmp 0x10007fa3d
test al, 0x10
je 0x10007fa3b
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10007fa34
test byte [rcx + 0x1c], 1
je 0x10007fa34
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000024d0]
mov edx, 0x36
mov r9, rdi
call fcn.10001ae7c
mov eax, 0x800700b7
jmp 0x10007fa3d
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x10007fef8
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x60], 0
mov rbp, rdx
mov rdi, rcx
lea rdx, [rsp + 0x60]
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
jne 0x10007ff65
call fcn.10007ec64
mov ebx, eax
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10007ff5e
test byte [rcx + 0x1c], 2
je 0x10007ff5e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000024b0]
mov edx, 0xa
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10002f224
mov eax, ebx
jmp 0x10007fffe
and qword [rsp + 0x68], 0
lea rcx, [rsp + 0x68]
mov rdx, rsi
call fcn.10007f0b4
mov ebx, eax
test eax, eax
jns 0x10007ff90
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x10007ff5e
call qword [sym.imp.msvcrt.dll_free]
jmp 0x10007ff5e
mov rbx, qword [rsp + 0x68]
mov edx, dword [rsp + 0x60]
mov r8d, esi
mov r9, rbx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x10007fff9
call fcn.10007ec64
mov edi, eax
mov rcx, qword [0x1000c3470]
lea rax, [0x1000c3470]
cmp rcx, rax
je 0x10007ffe7
test byte [rcx + 0x1c], 1
je 0x10007ffe7
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000024b0]
mov edx, SafeArrayDestroy
mov r9, rbp
mov dword [rsp + 0x20], edi
call fcn.10002f224
test rbx, rbx
je 0x10007fff5
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
mov eax, edi
jmp 0x10007fffe
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret