joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800608f0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x180060924
lea ecx, [rbx + 0x57]
mov dword [0x180153070], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18006094a
test al, 0x10
jne 0x18006098a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18006098a
mov rcx, rbx
call fcn.180060520
test eax, eax
jne 0x18006098a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x18006097d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x180060999
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800609b0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1800609e4
lea ecx, [rbx + 0x57]
mov dword [0x180153070], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180060a0a
test al, 0x10
jne 0x180060a4a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180060a4a
mov rcx, rbx
call fcn.1800606f0
test eax, eax
jne 0x180060a4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x180060a3d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x180060a59
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180062230
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180062259
lea ecx, [rbx + 0x57]
mov dword [0x180153070], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800620b0]
lea edx, [r9 + 0x20]
call fcn.180060f70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test eax, eax
jne 0x1800622aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x1800622aa
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800622c0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800622e9
lea ecx, [rbx + 0x57]
mov dword [0x180153070], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x180062170]
lea edx, [r9 + 0x20]
call fcn.1800610e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x18006233a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x18006233a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180063a50
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006f140
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x18005da84
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005d750
jmp 0x18005da8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180153070], eax
test eax, eax
je 0x18005da9e
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18005da20
Function at 0x180063da0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.18009fe50
test eax, eax
je 0x18005df4d
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005ddc0
jmp 0x18005dfc4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006f140
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18005dfa3
lea rdx, [0x1800e3420]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.1800772f0
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005d750
jmp 0x18005dfa9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x180153070], eax
test eax, eax
je 0x18005dfbd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18005df10

Function at 0x180064020
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006f140
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x180064136
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800640a6
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.18005d510
test eax, eax
je 0x180064122
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18006f140
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800635a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180064122
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180071880
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.18005d750
jmp 0x18006413c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180153070], eax
test eax, eax
je 0x180064152
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x180064020
Function at 0x180064f10
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006f140
lea rdx, [rsp + 0x20]
lea rcx, [0x1800f9ab8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18006501c
lea rcx, [rsp + 0x20]
call fcn.18005d510
test eax, eax
je 0x180065003
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18006f140
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800635a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180064ffb
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180071880
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005d750
mov eax, 1
jmp 0x18006501e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180064f10

Function at 0x180065180
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006f140
lea rdx, [rsp + 0x20]
lea rcx, [0x1800f9ae8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18006528c
lea rcx, [rsp + 0x20]
call fcn.18005d510
test eax, eax
je 0x180065273
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18006f140
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800635a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18006526b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180071880
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005d750
mov eax, 1
jmp 0x18006528e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180065180
Function at 0x180065d20
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x250
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180065f10
test rdx, rdx
je 0x180065f10
xor edx, edx
call fcn.18005f2e0
test eax, eax
jne 0x180065d7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x180065d7b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180065dfe
mov qword [rsp + 0x280], rsi
mov qword [rsp + 0x288], r12
mov qword [rsp + 0x248], r13
mov qword [rsp + 0x240], r14
xor r14d, r14d
mov rcx, rbx
mov r12d, r14d
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea r13d, [r14 + 1]
cmp eax, 0xffffffff
je 0x180065dc8
test al, 0x10
jne 0x180065dc8
mov r12d, r13d
test r12b, al
cmovne esi, r13d
test r13b, bpl
je 0x180065e19
test r12d, r12d
je 0x180065e19
mov dword [0x180153070], 0x50
xor eax, eax
mov r13, qword [rsp + 0x248]
mov r12, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov r14, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x250
pop rdi
pop rbp
pop rbx
ret
test bpl, 2
je 0x180065e2f
test esi, esi
je 0x180065e2f
mov dword [0x180153070], 5
jmp 0x180065ddc
cmp eax, 0xffffffff
je 0x180065e47
mov rcx, rbx
test al, 0x10
je 0x180065e42
call fcn.1800622c0
jmp 0x180065e47
call fcn.18005f810
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov dword [0x180153070], r14d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
test eax, eax
jne 0x180065eec
test bpl, 4
jne 0x180065ef3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x180065ef3
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r14w
call fcn.18006f140
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.18005d2c0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18005fee0
test eax, eax
jne 0x180065ed4
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1800609b0
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x180065eec
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x180065dde
test bpl, 8
je 0x180065ed4
mov rdx, rbx
mov rcx, rdi
call fcn.18005fc40
test eax, eax
je 0x180065ed4
mov eax, r13d
jmp 0x180065dde
mov ecx, 0x57
mov dword [0x180153070], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180065dfe
Function at 0x180065f30
Capabilities:
Check if file exists
Move file

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x150
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x180066101
test rdx, rdx
je 0x180066101
xor edx, edx
call fcn.18005f270
test eax, eax
jne 0x180065f8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x180065f8b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180065ffb
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x148], r12
mov rcx, rbx
mov qword [rsp + 0x140], r13
xor r12d, r12d
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea r13d, [r12 + 1]
cmp eax, 0xffffffff
je 0x180065fcd
test al, 0x10
jne 0x180065fcd
mov r12d, r13d
test r12b, al
cmovne edi, r13d
test r13b, bpl
je 0x180066016
test r12d, r12d
je 0x180066016
mov dword [0x180153070], 0x50
xor eax, eax
mov r12, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x180]
mov r13, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x150
pop rsi
pop rbp
pop rbx
ret
test bpl, 2
je 0x18006602c
test edi, edi
je 0x18006602c
mov dword [0x180153070], 5
jmp 0x180065fe1
cmp eax, 0xffffffff
je 0x180066044
mov rcx, rbx
test al, 0x10
je 0x18006603f
call fcn.180062230
jmp 0x180066044
call fcn.18005f790
mov rdx, rbx
mov rcx, rsi
mov dword [0x180153070], 0
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
test eax, eax
jne 0x1800660dd
test bpl, 4
jne 0x1800660e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1800660e4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], dil
call fcn.18006f140
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.18005d250
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18005fe60
test eax, eax
jne 0x1800660c5
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1800608f0
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x1800660dd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x180065fe3
test bpl, 8
je 0x1800660c5
mov rdx, rbx
mov rcx, rsi
call fcn.18005fd00
test eax, eax
je 0x1800660c5
mov eax, r13d
jmp 0x180065fe3
mov ecx, 0x57
mov dword [0x180153070], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180065ffb
jmp 0x180065f30
Function at 0x180066120
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x250
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180066302
test rdx, rdx
je 0x180066302
xor edx, edx
call fcn.18005f2e0
test eax, eax
jne 0x18006617f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x18006617b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800661fe
mov qword [rsp + 0x280], rsi
mov qword [rsp + 0x288], r12
mov qword [rsp + 0x248], r13
mov qword [rsp + 0x240], r14
xor r14d, r14d
mov rcx, rbx
mov r12d, r14d
mov esi, r14d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea r13d, [r14 + 1]
cmp eax, 0xffffffff
je 0x1800661c8
test al, 0x10
jne 0x1800661c8
mov r12d, r13d
test r12b, al
cmovne esi, r13d
test r13b, bpl
je 0x180066219
test r12d, r12d
je 0x180066219
mov dword [0x180153070], 0x50
xor eax, eax
mov r13, qword [rsp + 0x248]
mov r12, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov r14, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x250
pop rdi
pop rbp
pop rbx
ret
test bpl, 2
je 0x18006622f
test esi, esi
je 0x18006622f
mov dword [0x180153070], 5
jmp 0x1800661dc
cmp eax, 0xffffffff
je 0x180066247
mov rcx, rbx
test al, 0x10
je 0x180066242
call fcn.1800622c0
jmp 0x180066247
call fcn.18005f810
mov rdx, rbx
mov rcx, rdi
mov dword [0x180153070], r14d
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
test eax, eax
jne 0x1800662de
test bpl, 4
jne 0x1800662e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1800662e5
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r14w
call fcn.18006f140
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.18005d2c0
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18005fee0
test eax, eax
jne 0x1800662c6
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.1800609b0
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x180153070], eax
test eax, eax
je 0x1800662de
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
jmp 0x1800661de
test bpl, 8
je 0x1800662c6
mov rdx, rbx
mov rcx, rdi
call fcn.18005fdb0
test eax, eax
je 0x1800662c6
mov eax, r13d
jmp 0x1800661de
mov ecx, 0x57
mov dword [0x180153070], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800661fe
Function at 0x180066d90
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006f140
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x180064136
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800640a6
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.18005d510
test eax, eax
je 0x180064122
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18006f140
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800635a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180064122
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180071880
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.18005d750
jmp 0x18006413c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x180153070], eax
test eax, eax
je 0x180064152
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x180064020

Function at 0x180067210
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006f140
lea rdx, [rsp + 0x20]
lea rcx, [0x1800f9ab8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18006501c
lea rcx, [rsp + 0x20]
call fcn.18005d510
test eax, eax
je 0x180065003
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18006f140
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800635a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180064ffb
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180071880
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005d750
mov eax, 1
jmp 0x18006501e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180064f10
Function at 0x1800672d0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1801345d0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18006f140
lea rdx, [rsp + 0x20]
lea rcx, [0x1800f9ae8]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18006528c
lea rcx, [rsp + 0x20]
call fcn.18005d510
test eax, eax
je 0x180065273
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18006f140
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800635a0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18006526b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180071880
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005d750
mov eax, 1
jmp 0x18006528e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18006f110
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180065180