joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011f10
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1801610c0]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
lea rax, vtable.Nvidia::Logging::ILogPrinter.0
mov qword [rcx], rax
lea rax, vtable.Nvidia::Logging::GenericLogPrinter_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___.0
mov qword [rcx], rax
xor esi, esi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rsi
mov dword [rcx + 0x28], esi
mov qword [rcx + 0x30], rsi
lea rax, vtable.Nvidia::Logging::XMLLogPrinter.0
mov qword [rcx], rax
xorps xmm0, xmm0
movdqu xmmword [r11 - 0x40], xmm0
movdqa xmm1, xmmword [0x18011d2a0]
movdqu xmmword [r11 - 0x40], xmm1
mov word [r11 - 0x50], si
lea rdx, str.MaxPrintingDepth
lea rcx, [r11 - 0x50]
call fcn.180038970
nop
mov dword [rsp + 0x30], 4
lea rdx, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae rdx, qword [rsp + 0x88]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x180012062
cmp dword [rsp + 0x34], 4
jne 0x18001205d
mov edx, dword [rsp + 0x38]
lea rcx, [rdi + 0x38]
mov qword [rsp + 0x50], rcx
lea rax, vtable.Nvidia::Logging::XMLContentsPrinter.0
mov qword [rcx], rax
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], rsi
mov dword [rcx + 0x20], edx
lea rcx, [rsp + 0x88]
call fcn.1800389f0
nop
mov rax, rdi
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1800916f0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ebx, 0x3bc6
lea rdx, str.RegQueryValueEx
lea rcx, [rsp + 0xa8]
call fcn.180037150
nop
mov r8d, ebx
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x58]
call fcn.180013dc0
mov r8, rax
lea rcx, [rsp + 0x70]
call fcn.180013020
mov rdx, rax
mov rcx, r8
call fcn.180012ff0
int3
Function at 0x180012880
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov r14, r8
mov rdi, rdx
mov r12, rcx
mov ecx, 0x800
call fcn.180091f10
mov qword [rbp - 0x28], rax
movzx r8d, byte [rbp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.180012790
nop
mov dword [rbp + 0x30], 0x800
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1800128df
mov rdx, qword [rdi]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov rbx, qword [rbp - 0x28]
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x38]
xor r8d, r8d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
or r15, 0xffffffffffffffff
cmp eax, 0xea
jne 0x1800129dc
mov ecx, dword [rbp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.180091f10
mov qword [rbp - 0x18], rax
movzx r8d, byte [rbp + 0x30]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.180012790
nop
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x18], rbx
mov rbx, rax
mov qword [rbp - 0x28], rax
mov rsi, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rsi
test rsi, rsi
je 0x1800129ae
mov eax, r15d
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1800129aa
mov rax, qword [rsi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.180001d00]
mov rcx, rsi
call rbx
mov eax, r15d
lock xadd dword [rsi + 0xc], eax
cmp eax, 1
jne 0x1800129aa
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.180001d00]
mov rcx, rsi
call rbx
mov rbx, qword [rbp - 0x28]
cmp qword [rdi + 0x18], 8
jb 0x1800129b8
mov rdi, qword [rdi]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x38]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x180012a30
mov r8d, dword [rbp + 0x30]
shr r8, 1
mov eax, dword [rbp + 0x38]
dec eax
cmp eax, 1
jbe 0x1800129f8
mov esi, 0x3bc6
jmp 0x180012a30
cmp word [rbx + r8*2 - 2], 0
jne 0x180012a0e
mov rdx, rbx
mov rcx, r14
call fcn.180038970
jmp 0x180012a30
xor ecx, ecx
mov qword [r14 + 0x10], rcx
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x180012a21
mov rax, qword [r14]
mov word [rax], cx
mov rdx, rbx
mov rcx, r14
call fcn.180029ad0
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x180012a84
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x180012a84
mov rdi, qword [rbp - 0x20]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.180001d00]
mov rcx, rdi
call rbx
lock xadd dword [rdi + 0xc], r15d
cmp r15d, 1
jne 0x180012a84
mov rdi, qword [rbp - 0x20]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.180001d00]
mov rcx, rdi
call rbx
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180016ac0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x48
mov rcx, qword [rcx]
lea rdx, [rsp + 0x50]
xor eax, eax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180016ae7
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x20]
lea rax, str.Cant_get_log_file_size._errorcode:
add rdx, rax
call fcn.180035d70
lea rdx, [0x18015ddd0]
lea rcx, [rsp + 0x20]
call fcn.1800b2060
int3
Function at 0x180017b00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rdi, rdx
mov r15, rcx
xor r12d, r12d
mov dword [rsp + 0xa0], r12d
mov ebp, r12d
mov r14, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x180017b3d
mov r8, qword [rdx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, r14d
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
mov rbx, r12
mov qword [rsp + 0xa8], rbx
test eax, eax
jle 0x180017bd0
mov rcx, rsi
call fcn.180091f10
mov rbp, rax
mov qword [rsp + 0xb0], rax
mov rbx, rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], r12
xor ecx, ecx
call fcn.180091f20
cmp qword [rdi + 0x18], 8
jb 0x180017baa
mov rdi, qword [rdi]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
mov r9d, r14d
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xa0]
mov r8d, esi
mov rdx, rbp
mov rcx, qword [r15]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180017c10
cmp dword [rsp + 0xa0], esi
jne 0x180017c10
mov rcx, rbx
call fcn.180091f20
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov edx, eax
lea rax, str.Error_writing_to_log._errorcode:
add rdx, rax
lea rcx, [rsp + 0x48]
call fcn.180035d70
lea rdx, [0x18015ddd0]
lea rcx, [rsp + 0x48]
call fcn.1800b2060
int3

Function at 0x180017d80
Capabilities:
Query environment variable

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rbx, rcx
mov ecx, 0xfffe
call fcn.180091f10
mov rdi, rax
mov qword [rsp + 0x40], rax
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x180017db6
mov rcx, qword [rbx]
mov r8d, 0x7fff
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, rdi
mov rcx, rbx
call fcn.180038970
nop
mov edx, 2
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.180091f20
Function at 0x180022550
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1801610c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x18011d2a0]
movdqu xmmword [rsp + 0x40], xmm1
mov word [rsp + 0x30], ax
mov edi, 1
mov dword [rsp + 0x20], edi
lea rsi, [rdx + 0x10]
mov rdx, qword [rsi]
inc rdx
lea rcx, [r11 - 0x38]
call fcn.18002fbc0
cmp qword [rbx + 0x18], 8
jb 0x1800225c2
mov rbx, qword [rbx]
mov r8, qword [rsi]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180029ad0
mov r8, rdi
lea rdx, [0x180118aa0]
lea rcx, [rsp + 0x30]
call fcn.180029ad0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
and edi, 0xfffffffe
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x30]
call fcn.1800389f0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800916f0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x180039e90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180039ec3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180039f0a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180039f05
nop
cmp rbx, rcx
jae 0x180039f0a
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x180039ef0
cmp rbx, rcx
jb 0x180039f0e
xor eax, eax
jmp 0x180039f1a
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18003f200
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0xd8]
sub rsp, 0x1c0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1801610c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rcx
mov qword [rbp - 0x78], rcx
lea rax, vtable.IWindowsFirewallImpl.0
mov qword [rcx], rax
lea rax, vtable.CWindowsFirewallBasicApi.0
mov qword [rcx], rax
lea rdi, [rcx + 8]
mov qword [rsp + 0x48], rdi
xor ebx, ebx
mov qword [rdi], rbx
lea r14, [rcx + 0x10]
mov qword [rsp + 0x48], r14
mov qword [r14], rbx
lea r15, [rcx + 0x18]
mov qword [rsp + 0x48], r15
mov qword [r15], rbx
lea rcx, [rbp - 0x70]
call fcn.1800537a0
movzx ecx, word [rbp + 0xa6]
movzx eax, word [rbp + 0xa4]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], ecx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], 2
mov qword [rsp + 0x50], 6
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 2
mov eax, dword [rbp - 0x6c]
mov dword [rsp + 0x34], eax
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x64]
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], 3
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x34]
call fcn.18000be90
shr eax, 0x1f
xor al, 1
jne 0x18003f3f8
mov qword [rsp + 0x34], 2
mov qword [rsp + 0x3c], rbx
mov dword [rsp + 0x44], 2
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x68]
call fcn.18000be90
test eax, eax
js 0x18003f3f8
mov qword [rsp + 0x20], rdi
lea r9, [0x18011b278]
xor edx, edx
lea r8d, [rbx + 0x17]
lea rcx, [0x1800fc800]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18003f3b6
mov rdi, qword [rdi]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [fcn.180001d00]
mov rdx, r14
mov rcx, rdi
call rbx
test eax, eax
js 0x18003f3cc
mov rdi, qword [r14]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [fcn.180001d00]
mov rdx, r15
mov rcx, rdi
call rbx
test eax, eax
js 0x18003f3e2
mov rax, rsi
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.1800916f0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor r9d, r9d
lea r8d, [r9 + 0x2a]
lea rdx, str.c:dvsp4_build_sw_relgpu_drvinstaller_coreinstaller_core_vs2017incWindowsFirewallBasicApi.h
mov ecx, eax
call fcn.18003abe0
int3
xor r9d, r9d
lea r8d, [r9 + 0x2b]
lea rdx, str.c:dvsp4_build_sw_relgpu_drvinstaller_coreinstaller_core_vs2017incWindowsFirewallBasicApi.h
mov ecx, eax
call fcn.18003abe0
int3
xor r9d, r9d
lea r8d, [r9 + 0x2c]
lea rdx, str.c:dvsp4_build_sw_relgpu_drvinstaller_coreinstaller_core_vs2017incWindowsFirewallBasicApi.h
mov ecx, eax
call fcn.18003abe0
int3
lea r9, str.CWindowsFirewallBasicApi_requires_WindowsXP__Service_Pack_2_or_later_service_pack
mov r8d, 0x28
lea rdx, str.c:dvsp4_build_sw_relgpu_drvinstaller_coreinstaller_core_vs2017incWindowsFirewallBasicApi.h
mov ecx, 0x80004001
call fcn.18003abe0
int3
Function at 0x18004d7f0
Capabilities:
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rcx
lea rdx, [rsp + 0x48]
call fcn.180052d30
nop
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18004d83c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp ebx, 0xffffffff
je 0x18004d84e
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, [rdi + 0x28]
lea rdx, str.Accessing_attributes_for_file
lea rcx, [rsp + 0x50]
call fcn.18000b150
nop
mov rcx, rax
call fcn.18000d6b0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov r9, rbx
mov r8d, 0x298
lea rdx, str.FilePath.cpp
call fcn.180051ba0
int3

Function at 0x18004da50
Capabilities:
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rdi, rcx
lea rdx, [rsp + 0x48]
call fcn.180052d30
nop
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18004da9c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp ebx, 0xffffffff
jne 0x18004dabe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea ecx, [rax - 2]
cmp ecx, 1
ja 0x18004dacb
xor al, al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
lea r8, [rdi + 0x28]
lea rdx, str.While_checking_exists
lea rcx, [rsp + 0x50]
call fcn.18000b150
nop
mov rcx, rax
call fcn.18000d6b0
mov r9, rax
mov r8d, 0x2a8
lea rdx, str.FilePath.cpp
mov ecx, ebx
call fcn.180051ba0
int3
Function at 0x18004f8a0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
call fcn.180039cb0
mov rcx, rax
test rax, rax
je 0x18004fa05
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov edi, 0x104
nop dword [rax + rax]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x18004f912
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.18003a2f0
mov rbx, qword [rsp + 0x58]
test edi, edi
js 0x18004fa8f
cmp edi, dword [rbx - 0xc]
jg 0x18004fa8f
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], bp
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x18004fa89
cmp eax, edi
je 0x18004fa89
jb 0x18004f956
mov edi, eax
test eax, eax
js 0x18004fa20
jmp 0x18004f8f0
cmp eax, 0x7fffffff
jae 0x18004fa3b
test eax, eax
js 0x18004fa6e
cmp eax, dword [rbx - 0xc]
jg 0x18004fa6e
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x18004f9b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x18004f9b3
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x18004fa56
lea rdi, [rsi + 0x28]
mov qword [rsp + 0x60], rdi
lea rcx, [rbx - 0x18]
call fcn.18003a990
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x20], 1
or eax, 0xffffffff
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x18004f9f5
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov r8d, 0xcd
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80004005
call fcn.18003abe0
nop
xor r9d, r9d
mov r8d, 0x325
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80070057
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0x950
lea rdx, str.FilePath.cpp
mov ecx, 0x80004005
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0xc3
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlcore.h
mov ecx, eax
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0x368
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80070057
call fcn.18003abe0
int3
call fcn.180039260
int3
xor r9d, r9d
mov r8d, 0x368
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80070057
call fcn.18003abe0
int3
Function at 0x18004fe90
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
movzx esi, r9b
movzx ebp, r8b
mov r14d, edx
mov rdi, rcx
xor r15d, r15d
mov dword [rax - 0x38], r15d
call fcn.180039cb0
mov rcx, rax
test rax, rax
je 0x18004ffdc
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x18004ff11
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.18003a2f0
mov rbx, qword [rsp + 0x38]
cmp dword [rbx - 0xc], 0x104
jl 0x18004fff7
mov dword [rbx - 0x10], 0x104
mov word [rbx + 0x208], r15w
movzx r8d, sil
xor r8, 1
dec r8
movzx edx, bpl
inc edx
shl edx, 0xe
or edx, r14d
bts edx, 0xc
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x180050012
cmp eax, 1
je 0x180050027
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1800c1660
test eax, eax
js 0x180050042
cmp eax, dword [rbx - 0xc]
jg 0x180050042
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.18000c620
mov dword [rsp + 0x30], 1
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18004ffbf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
xor r9d, r9d
mov r8d, 0xcd
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80004005
call fcn.18003abe0
nop
xor r9d, r9d
mov r8d, 0x368
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80070057
call fcn.18003abe0
int3
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18011a488]
mov ecx, eax
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0xa4c
lea rdx, str.FilePath.cpp
mov ecx, 0x80004005
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0x368
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80070057
call fcn.18003abe0
int3
Function at 0x1800504b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
call fcn.180039cb0
mov rcx, rax
test rax, rax
je 0x180050615
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov edi, 0x104
nop dword [rax + rax]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180050522
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.18003a2f0
mov rbx, qword [rsp + 0x58]
test edi, edi
js 0x18005069f
cmp edi, dword [rbx - 0xc]
jg 0x18005069f
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], bp
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180050699
cmp eax, edi
je 0x180050699
jb 0x180050566
mov edi, eax
test eax, eax
js 0x180050630
jmp 0x180050500
cmp eax, 0x7fffffff
jae 0x18005064b
test eax, eax
js 0x18005067e
cmp eax, dword [rbx - 0xc]
jg 0x18005067e
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x20], rax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x1800505c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1800505c3
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x180050666
lea rdi, [rsi + 0x28]
mov qword [rsp + 0x60], rdi
lea rcx, [rbx - 0x18]
call fcn.18003a990
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x20], 1
or eax, 0xffffffff
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x180050605
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov r8d, 0xcd
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80004005
call fcn.18003abe0
nop
xor r9d, r9d
mov r8d, 0x325
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80070057
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0x9f0
lea rdx, str.FilePath.cpp
mov ecx, 0x80004005
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0xc3
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlcore.h
mov ecx, eax
call fcn.18003abe0
int3
xor r9d, r9d
mov r8d, 0x368
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80070057
call fcn.18003abe0
int3
call fcn.180039260
int3
xor r9d, r9d
mov r8d, 0x368
lea rdx, str.C:dvsp4_build_sw_toolswin32msvc141u5VC_atlmfcinclude_atlsimpstr.h
mov ecx, 0x80070057
call fcn.18003abe0
int3