joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180060240
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800603a5
test rdx, rdx
jne 0x18006027d
test r8, r8
je 0x1800603a5
mov qword [rsp + 0x498], rbp
lea rcx, [rsp + 0x242]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], bp
call fcn.18002f310
lea r8, [0x180089640]
lea rcx, [rsp + 0x240]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], rbx
call fcn.180030e74
lea rcx, [rsp + 0x240]
xor edx, edx
call fcn.18005fb30
test eax, eax
jne 0x180060310
mov dword [0x1800add7c], 2
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbp, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x460
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bp
call fcn.18002f310
lea r8, [0x180089640]
lea rcx, [rsp + 0x30]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], rdi
call fcn.180030e74
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.18005fb30
test eax, eax
je 0x180060369
mov dword [0x1800add7c], 0xb7
mov ecx, 0xb7
jmp 0x1800602e5
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x18006039b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1800add7c], eax
test eax, eax
je 0x1800602eb
mov ecx, eax
jmp 0x1800602e5
mov eax, 1
jmp 0x1800602ed
mov ecx, 0x57
mov dword [0x1800add7c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800602f5
Function at 0x180060d70
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x150
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r12, rcx
test rcx, rcx
jne 0x180060d9a
xor eax, eax
jmp 0x180060f23
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x170], rbp
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x148], rsi
mov ebx, 1
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x140], rdi
call fcn.18002f310
lea rcx, [rsp + 0x20]
mov r8d, 0x103
mov rdx, r12
call fcn.180030f90
lea edx, [rbx + 0x5b]
lea rcx, [rsp + 0x20]
call fcn.180030e58
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rsi, rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x180060e45
cmp byte [rsp + 0x20], 0x5c
jne 0x180060e45
cmp byte [rsp + 0x21], 0x5c
jne 0x180060e45
lea edx, [rbx + 0x5b]
lea rcx, [rsp + 0x22]
call fcn.180030e58
test rax, rax
je 0x180060ec1
lea rcx, [rax + 1]
lea edx, [rbx + 0x5b]
call fcn.180030e58
mov rsi, rax
test rsi, rsi
je 0x180060ec1
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov byte [rsi], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, eax
mov edi, eax
and ebp, 0x10
jne 0x180060e8c
test al, 1
je 0x180060e7b
mov edx, eax
lea rcx, [rsp + 0x20]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test eax, eax
je 0x180060f01
cmp edi, 0xffffffff
je 0x180060e95
test ebp, ebp
jne 0x180060ea4
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
test ebx, ebx
je 0x180060f01
lea rcx, [rsi + 1]
mov edx, 0x5c
mov byte [rsi], 0x5c
call fcn.180030e58
mov rsi, rax
test rax, rax
jne 0x180060e50
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180060ef4
test al, 0x10
jne 0x180060f01
test al, 1
je 0x180060ee5
and eax, 0xfffffffe
mov rcx, r12
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test eax, eax
je 0x180060f01
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
mov rdi, qword [rsp + 0x140]
mov rsi, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x170]
mov eax, ebx
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x150
pop r12
ret
Function at 0x180060f40
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x260
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r12, rcx
test rcx, rcx
jne 0x180060f6a
xor eax, eax
jmp 0x180061123
mov qword [rsp + 0x278], rbx
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x248], r13
lea rcx, [rsp + 0x22]
mov qword [rsp + 0x240], r14
xor r14d, r14d
xor edx, edx
mov r8d, 0x206
mov ebx, 1
mov word [rsp + 0x20], r14w
call fcn.18002f310
lea rcx, [rsp + 0x20]
mov r8d, 0x103
mov rdx, r12
call fcn.180030114
mov r13d, 0x5c
lea rcx, [rsp + 0x20]
mov edx, r13d
call fcn.180030e10
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rsi, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x180061032
cmp word [rsp + 0x20], r13w
jne 0x180061032
cmp word [rsp + 0x22], r13w
jne 0x180061032
lea rcx, [rsp + 0x24]
mov edx, r13d
call fcn.180030e10
test rax, rax
je 0x1800610b1
lea rcx, [rax + 2]
mov edx, r13d
call fcn.180030e10
mov rsi, rax
test rsi, rsi
je 0x1800610b1
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov word [rsi], r14w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
mov edi, eax
and ebp, 0x10
jne 0x18006107d
test al, 1
je 0x18006106c
mov edx, eax
lea rcx, [rsp + 0x20]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x1800610f1
cmp edi, 0xffffffff
je 0x180061086
test ebp, ebp
jne 0x180061095
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x1800610f1
lea rcx, [rsi + 2]
mov edx, r13d
mov word [rsi], r13w
call fcn.180030e10
mov rsi, rax
test rax, rax
jne 0x180061040
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800610e4
test al, 0x10
jne 0x1800610f1
test al, 1
je 0x1800610d5
and eax, 0xfffffffe
mov rcx, r12
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x1800610f1
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
mov r14, qword [rsp + 0x240]
mov r13, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rbp, qword [rsp + 0x280]
mov eax, ebx
mov rbx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x260
pop r12
ret
Function at 0x180061140
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x180061174
lea ecx, [rbx + 0x57]
mov dword [0x1800add7c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18006119a
test al, 0x10
jne 0x1800611da
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1800611da
mov rcx, rbx
call fcn.180060d70
test eax, eax
jne 0x1800611da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1800add7c], eax
test eax, eax
je 0x1800611cd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1800611e9
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180061200
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x180061234
lea ecx, [rbx + 0x57]
mov dword [0x1800add7c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18006125a
test al, 0x10
jne 0x18006129a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18006129a
mov rcx, rbx
call fcn.180060f40
test eax, eax
jne 0x18006129a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1800add7c], eax
test eax, eax
je 0x18006128d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1800612a9
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180063650
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180063679
lea ecx, [rbx + 0x57]
mov dword [0x1800add7c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800634d0]
lea edx, [r9 + 0x20]
call fcn.1800617c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test eax, eax
jne 0x1800636ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1800add7c], eax
test eax, eax
je 0x1800636ca
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800636e0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x180063709
lea ecx, [rbx + 0x57]
mov dword [0x1800add7c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x180063590]
lea edx, [r9 + 0x20]
call fcn.180061930
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x18006375a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1800add7c], eax
test eax, eax
je 0x18006375a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180064e70
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002f310
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x18005e2d4
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005dfa0
jmp 0x18005e2da
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1800add7c], eax
test eax, eax
je 0x18005e2ee
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18005e270
Function at 0x1800651c0
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.18005c9f0
test eax, eax
je 0x18005e79d
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005e610
jmp 0x18005e814
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002f310
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18005e7f3
lea rdx, [0x180089290]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.180071160
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.18005dfa0
jmp 0x18005e7f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1800add7c], eax
test eax, eax
je 0x18005e80d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x18005e760

Function at 0x180065440
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002f310
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x180065556
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800654c6
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.18005dd60
test eax, eax
je 0x180065542
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18002f310
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800649c0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180065542
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180030f90
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.18005dfa0
jmp 0x18006555c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x1800add7c], eax
test eax, eax
je 0x180065572
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x180065440
Function at 0x180066330
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002f310
lea rdx, [rsp + 0x20]
lea rcx, [0x18008f950]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18006643c
lea rcx, [rsp + 0x20]
call fcn.18005dd60
test eax, eax
je 0x180066423
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18002f310
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800649c0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18006641b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180030f90
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005dfa0
mov eax, 1
jmp 0x18006643e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180066330

Function at 0x1800665a0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002f310
lea rdx, [rsp + 0x20]
lea rcx, [0x18008f980]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800666ac
lea rcx, [rsp + 0x20]
call fcn.18005dd60
test eax, eax
je 0x180066693
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18002f310
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800649c0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18006668b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180030f90
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005dfa0
mov eax, 1
jmp 0x1800666ae
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800665a0
Function at 0x1800681b0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002f310
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x180065556
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800654c6
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.18005dd60
test eax, eax
je 0x180065542
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.18002f310
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800649c0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x180065542
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180030f90
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.18005dfa0
jmp 0x18006555c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x1800add7c], eax
test eax, eax
je 0x180065572
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x180065440

Function at 0x180068630
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002f310
lea rdx, [rsp + 0x20]
lea rcx, [0x18008f950]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18006643c
lea rcx, [rsp + 0x20]
call fcn.18005dd60
test eax, eax
je 0x180066423
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18002f310
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800649c0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18006641b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180030f90
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005dfa0
mov eax, 1
jmp 0x18006643e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180066330
Function at 0x1800686f0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x1800a5cc0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.18002f310
lea rdx, [rsp + 0x20]
lea rcx, [0x18008f980]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x1800666ac
lea rcx, [rsp + 0x20]
call fcn.18005dd60
test eax, eax
je 0x180066693
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.18002f310
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800649c0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18006668b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180030f90
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.18005dfa0
mov eax, 1
jmp 0x1800666ae
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18002f2e0
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800665a0
Function at 0x18006cc30
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
call fcn.18006baf0
mov r11, qword [0x1800ae298]
mov rdx, rbx
mov rcx, rdi
test r11, r11
je 0x18006cc7a
mov eax, dword [rsp + 0x60]
mov r9, rsi
mov r8, rbp
mov dword [rsp + 0x20], eax
call r11
jmp 0x18006cc80
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18006d150
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x40
xor edi, edi
mov qword [rsp + 0x38], rbp
mov rbp, rcx
lea r8, [rsp + 0x68]
lea rdx, str.SystemCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x18006d26f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006d26f
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x18006d26f
lea ecx, [rdi + 0x40]
mov edx, eax
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18006d26a
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18006d261
cmp dword [rsp + 0x60], 7
jne 0x18006d261
mov qword [rsp + 0x50], rbx
mov rbx, rsi
cmp byte [rsi], dil
je 0x18006d25c
nop dword [rax + rax]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x18006d257
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
cdqe
add rbx, rax
cmp byte [rbx], dil
jne 0x18006d230
jmp 0x18006d25c
mov edi, 1
mov rbx, qword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x38]
test rcx, rcx
je 0x18006d284
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x40
pop rdi
ret