joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010c1a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x20], 0
jne 0x14010c1bf
mov dword [rsp + 0x30], 1
jmp 0x14010c1c7
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14010c1e9
mov r8d, 0x8a
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 8
jb 0x14010c213
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
jmp 0x14010c221
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14010c25c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 5
je 0x14010c24a
jmp 0x14010c24e
xor al, al
jmp 0x14010c25e
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
mov al, 1
add rsp, 0x58
ret

Function at 0x14010c270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x20], 0
jne 0x14010c28f
mov dword [rsp + 0x30], 1
jmp 0x14010c297
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14010c2b9
mov r8d, 0x9d
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 8
jb 0x14010c2e3
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
jmp 0x14010c2f1
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14010c315
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
jne 0x14010c32a
mov dword [rsp + 0x40], 1
jmp 0x14010c332
mov dword [rsp + 0x40], 0
mov al, byte [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x14010c470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x20], 0
jne 0x14010c48f
mov dword [rsp + 0x30], 1
jmp 0x14010c497
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14010c4b9
mov r8d, 0xb5
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 8
jb 0x14010c4e3
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
jmp 0x14010c4f1
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14010c515
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x14010c52a
mov dword [rsp + 0x40], 1
jmp 0x14010c532
mov dword [rsp + 0x40], 0
mov al, byte [rsp + 0x40]
add rsp, 0x58
ret

Function at 0x14010c6d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x20], 0
jne 0x14010c6ef
mov dword [rsp + 0x30], 1
jmp 0x14010c6f7
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14010c719
mov r8d, 0xd4
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 8
jb 0x14010c743
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
jmp 0x14010c751
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14010c775
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
mov eax, dword [rsp + 0x20]
and eax, 2
test eax, eax
je 0x14010c78a
mov dword [rsp + 0x40], 1
jmp 0x14010c792
mov dword [rsp + 0x40], 0
mov al, byte [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x14010cd60
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x20], 0
jne 0x14010cd83
mov dword [rsp + 0x38], 1
jmp 0x14010cd8b
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x14010cdad
mov r8d, 0x121
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 8
jb 0x14010cdd7
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
jmp 0x14010cde5
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14010ce09
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
movzx eax, byte [rsp + 0x68]
test eax, eax
je 0x14010ce1f
mov eax, dword [rsp + 0x20]
and eax, 0xfffffffe
mov dword [rsp + 0x20], eax
jmp 0x14010ce2a
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x20], 8
jb 0x14010ce54
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
jmp 0x14010ce62
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x48], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14010ce83
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
add rsp, 0x58
ret
Function at 0x14010cea0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x148
mov qword [rsp + 0x118], 0xfffffffffffffffe
mov rax, qword [rsp + 0x150]
cmp qword [rax + 0x20], 0
jne 0x14010ced9
mov dword [rsp + 0x120], 1
jmp 0x14010cee4
mov dword [rsp + 0x120], 0
movzx eax, byte [rsp + 0x120]
test eax, eax
je 0x14010cf09
mov r8d, 0x137
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x158]
call fcn.140043d00
cmp qword [rsp + 0x40], 8
jb 0x14010cf52
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x128], rax
jmp 0x14010cf5f
lea rax, [rsp + 0x28]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x150]
add rax, 0x30
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
cmp qword [rax + 0x20], 8
jb 0x14010cf98
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x130], rax
jmp 0x14010cfac
mov rax, qword [rsp + 0xe8]
add rax, 8
mov qword [rsp + 0x130], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14010cff5
mov rdx, qword [rsp + 0x158]
lea rcx, [rsp + 0x50]
call fcn.14010ba60
nop
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.14010cd60
nop
lea rcx, [rsp + 0x50]
call fcn.14010bd80
jmp 0x14010d007
mov rcx, qword [rsp + 0x150]
add rcx, 8
call fcn.14010d480
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400010c0
add rsp, 0x148
ret

Function at 0x14010d030
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov rax, qword [rsp + 0xe0]
cmp qword [rax + 0x20], 0
jne 0x14010d069
mov dword [rsp + 0xb8], 1
jmp 0x14010d074
mov dword [rsp + 0xb8], 0
movzx eax, byte [rsp + 0xb8]
test eax, eax
je 0x14010d099
mov r8d, 0x146
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0xe8]
call fcn.140043d00
cmp qword [rsp + 0x40], 8
jb 0x14010d0dc
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xc0], rax
jmp 0x14010d0e9
lea rax, [rsp + 0x28]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xe0]
add rax, 0x30
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x20], 8
jb 0x14010d122
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rax
jmp 0x14010d136
mov rax, qword [rsp + 0x80]
add rax, 8
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14010d162
mov rcx, qword [rsp + 0xe0]
add rcx, 8
call fcn.14010d480
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400010c0
add rsp, 0xd8
ret
Function at 0x14010d180
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x20], 0
jne 0x14010d19f
mov dword [rsp + 0x30], 1
jmp 0x14010d1a7
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14010d1c9
mov r8d, 0x151
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
mov rcx, qword [rsp + 0x60]
call fcn.14010c470
movzx eax, al
test eax, eax
je 0x14010d231
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 8
jb 0x14010d204
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
jmp 0x14010d212
mov rax, qword [rsp + 0x20]
add rax, 8
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x14010d22f
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
jmp 0x14010d286
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 8
jb 0x14010d25b
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x40], rax
jmp 0x14010d269
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14010d286
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
add rsp, 0x58
ret

Function at 0x14010d3a0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0x20], 0
jne 0x14010d3bf
mov dword [rsp + 0x28], 1
jmp 0x14010d3c7
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
test eax, eax
je 0x14010d3e9
mov r8d, 0x174
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
mov rcx, qword [rsp + 0x50]
call fcn.14010c0c0
movzx eax, al
test eax, eax
je 0x14010d40f
mov rcx, qword [rsp + 0x50]
call fcn.14010c470
movzx eax, al
test eax, eax
je 0x14010d40f
xor al, al
jmp 0x14010d468
mov rax, qword [rsp + 0x50]
add rax, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 8
jb 0x14010d439
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
jmp 0x14010d447
mov rax, qword [rsp + 0x20]
add rax, 8
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14010d466
mov rcx, qword [rsp + 0x50]
add rcx, 8
call fcn.14010d480
mov al, 1
add rsp, 0x48
ret
Function at 0x140112650
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1d8
mov qword [rsp + 0x1b0], 0xfffffffffffffffe
mov dword [rsp + 0xd8], 0
lea rax, [rsp + 0xdc]
mov qword [rsp + 0xe0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x1e8]
call fcn.140043d00
cmp qword [rsp + 0x40], 8
jb 0x1401126c1
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x1b8], rax
jmp 0x1401126ce
lea rax, [rsp + 0x28]
mov qword [rsp + 0x1b8], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x140112718
xor r8d, r8d
mov rdx, qword [rsp + 0x1e8]
lea rcx, [rsp + 0x88]
call fcn.14003d800
lea rdx, [0x1401d6c50]
lea rcx, [rsp + 0x88]
call fcn.1400e0fa4
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x78], rax
mov eax, 2
mul qword [rsp + 0xf0]
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.1400dd688
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0x40], 8
jb 0x140112790
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x1c0], rax
jmp 0x14011279d
lea rax, [rsp + 0x28]
mov qword [rsp + 0x1c0], rax
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r11, [rsp + 0x100]
mov qword [rsp + 0x108], r11
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140011d00
nop
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x130], rax
mov edx, dword [rsp + 0x48]
sub edx, 1
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x130]
call fcn.1400441f0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1e0]
call fcn.140011d00
mov r9, qword [0x14019e5a0]
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x1e0]
call fcn.140011b30
mov eax, dword [rsp + 0xd8]
or eax, 1
mov dword [rsp + 0xd8], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.140011d00
nop
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x180], rax
mov rcx, qword [rsp + 0x180]
call fcn.1400df11c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400010c0
mov rax, qword [rsp + 0x1e0]
add rsp, 0x1d8
ret
Function at 0x1401128a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0xa8], 0xfffffffffffffffe
lea rax, [rsp + 0x4d]
mov qword [rsp + 0x50], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0xd0]
call fcn.140043d00
cmp qword [rsp + 0x40], 8
jb 0x1401128fb
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xb0], rax
jmp 0x140112908
lea rax, [rsp + 0x28]
mov qword [rsp + 0xb0], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jbe 0x140112933
mov dword [rsp + 0xb8], 1
jmp 0x14011293e
mov dword [rsp + 0xb8], 0
movzx eax, byte [rsp + 0xb8]
mov byte [rsp + 0x4c], al
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400010c0
mov al, byte [rsp + 0x4c]
add rsp, 0xc8
ret

Function at 0x140112970
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x208
mov qword [rsp + 0x1e8], 0xfffffffffffffffe
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.1400010c0
nop
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x100], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x210]
call fcn.140043d00
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x218]
call fcn.140043d00
cmp qword [rsp + 0x40], 8
jb 0x140112a08
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x1f0], rax
jmp 0x140112a15
lea rax, [rsp + 0x28]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x68], 8
jb 0x140112a2c
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1f8], rax
jmp 0x140112a39
lea rax, [rsp + 0x50]
mov qword [rsp + 0x1f8], rax
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140112abb
lea rdx, str.cannot_set_environment_variable:
lea rcx, [rsp + 0x70]
call fcn.14000ffd0
nop
mov r9, qword [0x14019e5a0]
xor r8d, r8d
mov rdx, qword [rsp + 0x210]
lea rcx, [rsp + 0x70]
call fcn.14002de50
xor r8d, r8d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x98]
call fcn.14003e070
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0x98]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x70]
call fcn.140011d00
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400010c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.1400010c0
add rsp, 0x208
ret
Function at 0x140113500
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1d0
mov qword [rsp + 0x1c8], 0xfffffffffffffffe
mov dword [rsp + 0xe8], 0
mov dword [rsp + 0x20], 0x10
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1401135de
lea rax, [rsp + 0xec]
mov qword [rsp + 0xf0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140011d00
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.Cannot_get_computer_name
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x118], rcx
mov r8, qword [rsp + 0x118]
lea rdx, str.Cannot_get_computer_name
lea rcx, [rsp + 0xc0]
call fcn.1400128b0
nop
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x70]
call fcn.14003e070
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0x70]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc0]
call fcn.140011d00
nop
lea rax, [rsp + 0x141]
mov qword [rsp + 0x148], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140011d00
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.1400442b0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1e0]
call fcn.140011d00
mov r9, qword [0x14019e5a0]
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x1e0]
call fcn.140011b30
mov eax, dword [rsp + 0xe8]
or eax, 1
mov dword [rsp + 0xe8], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x48]
call fcn.140011d00
mov rax, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret
Function at 0x1401152d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
cmp qword [rax + 0xb8], 0xffffffffffffffff
je 0x14011530c
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x88]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
and eax, 1
test eax, eax
jne 0x140115316
mov eax, 0xffffffff
jmp 0x1401153ae
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x88]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
and eax, 2
test eax, eax
je 0x140115340
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x50]
call qword [rax + 0x60]
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0xb8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14011538e
mov rcx, qword [rsp + 0x50]
add rcx, 0x90
call fcn.14010ea70
mov ecx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x50]
add rcx, qword [rax + 0xc0]
mov rax, qword [rsp + 0x50]
mov qword [rax + 0xc0], rcx
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x1401153c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0xb8], 0xffffffffffffffff
je 0x1401153fc
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x88]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
and eax, 2
test eax, eax
jne 0x140115406
mov eax, 0xffffffff
jmp 0x1401154ef
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x88]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
and eax, 8
test eax, eax
je 0x140115481
mov qword [rsp + 0x38], 0
mov r9d, 2
lea r8, [rsp + 0x3c]
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0xb8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0xffffffff
jne 0x140115470
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140115470
mov rcx, qword [rsp + 0x60]
add rcx, 0x90
call fcn.14010ea70
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0xc0], rax
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0xb8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x1401154cf
mov rcx, qword [rsp + 0x60]
add rcx, 0x90
call fcn.14010ea70
mov ecx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x60]
add rcx, qword [rax + 0xc0]
mov rax, qword [rsp + 0x60]
mov qword [rax + 0xc0], rcx
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret