joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022b00
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x78], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 3
call fcn.140034c20
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
cmp qword [rsi + 8], 0
je 0x140022d3c
mov dword [rsp + 0x5c], 0
lea rcx, str.api_ms_win_downlevel_shell32_l1_1_0.dll
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x140022ba9
lea rdx, [0x1400b1abe]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140022bbc
mov rbx, rax
mov rcx, qword [rsi]
lea rdx, [rsp + 0x5c]
call rax
jmp 0x140022bb7
mov rcx, qword [rsi]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
jmp 0x140022bbf
xor r15d, r15d
movsxd r12, dword [rsp + 0x5c]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
test r12, r12
je 0x140022cd3
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], r14
test r12d, r12d
js 0x140022d72
shl r12, 3
lea rdi, [r12 + r12*2]
mov rcx, rdi
call fcn.1400837ac
mov rsi, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
add rax, rdi
mov qword [rsp + 0x50], rax
xor r14d, r14d
xorps xmm6, xmm6
movabs rbp, 0x7ffffffffffffff0
mov qword [rsp + 0x38], r12
jmp 0x140022c62
lea eax, [rbx + rbx]
mov byte [rsi], al
lea rdi, [rsi + 2]
test rbx, rbx
je 0x140022c4f
mov r8, rbx
add r8, rbx
mov rcx, rdi
mov rdx, r13
call fcn.1400865f0
mov word [rdi + rbx*2], 0
add rsi, 0x18
add r14, 8
cmp r12, r14
je 0x140022cc4
mov r13, qword [r15 + r14]
movups xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
mov rcx, r13
call fcn.14009bbb8
cmp rax, rbp
jae 0x140022d65
mov rbx, rax
cmp rax, 0xb
jb 0x140022c30
mov r12, r15
lea r15, [rbx + 8]
and r15, 0xfffffffffffffff8
js 0x140022d6d
lea rcx, [r15 + r15]
call fcn.1400837ac
mov rdi, rax
mov qword [rsi + 0x10], rax
or r15, 1
mov qword [rsi], r15
mov qword [rsi + 8], rbx
mov r15, r12
mov r12, qword [rsp + 0x38]
jmp 0x140022c3e
mov qword [rsp + 0x48], rsi
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140022610
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x140022cf7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x140022d3c
mov rax, qword [rsp + 0x48]
cmp rax, rsi
jne 0x140022d18
mov rcx, rsi
jmp 0x140022d32
mov rax, rdi
cmp rsi, rdi
je 0x140022d2d
lea rdi, [rax - 0x18]
test byte [rax - 0x18], 1
je 0x140022d10
mov rcx, qword [rax - 8]
call fcn.140083808
jmp 0x140022d10
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rsi
call fcn.140083808
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140083c20
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rsi
call fcn.14001f2b4
call fcn.1400954ec
lea rcx, [rsp + 0x40]
call fcn.140021144
int3
Function at 0x14002b0f0
Capabilities:
Get file version info

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc0
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
lea rdx, str.CreateFileVersionInfoWin
lea r8, str..._.._base_file_version_info_win.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r9d, 0x4d
call fcn.1400418b0
lea rcx, [rsp + 0x50]
mov rdx, rsi
xor r8d, r8d
call fcn.1400418e0
mov dword [rsp + 0x2c], 0xaaaaaaaa
test byte [rdi], 1
je 0x14002b17f
mov rdi, qword [rdi + 0x10]
jmp 0x14002b183
add rdi, 2
lea rdx, [rsp + 0x2c]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x14002b2cd
mov ebp, eax
mov esi, eax
mov rcx, rsi
call fcn.1400837ac
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call fcn.140086a50
mov edx, dword [rsp + 0x2c]
mov rcx, rdi
mov r8d, ebp
mov r9, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14002b2bc
mov qword [rsp + 0x30], 0
mov dword [rsp + 0xa8], 0xaaaaaaaa
lea rdx, str.VarFileInfoTranslation
lea r8, [rsp + 0x30]
lea r9, [rsp + 0xa8]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14002b2bc
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x14002b2bc
mov rbp, rbx
add rbp, rsi
mov ecx, 0x38
call fcn.1400837ac
mov rsi, rax
mov eax, dword [rdi]
lea rcx, [0x1400b20c0]
mov qword [rsi], rcx
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], rbp
mov qword [rsi + 0x20], rbx
mov dword [rsi + 0x28], eax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0xb4], 0xaaaaaaaa
lea rdx, [0x1400b22e2]
lea r8, [rsp + 0x30]
lea r9, [rsp + 0xb4]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x14002b2ae
lea rdx, str..._.._base_file_version_info_win.cc
lea r9, str.::VerQueryValue_data__kRoot__fixed_file_info__dummy_size_
lea rdi, [rsp + 0xa8]
mov rcx, rdi
mov r8d, 0x2a
call fcn.1400348a0
mov rcx, rdi
call fcn.140034930
mov rcx, rdi
call fcn.140034940
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x30], rax
mov qword [r14], rsi
jmp 0x14002b2d4
mov qword [r14], 0
mov rcx, rbx
call fcn.140083808
jmp 0x14002b2d4
mov qword [r14], 0
lea rcx, [rsp + 0x50]
call fcn.140041a20
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140083c20
mov rax, r14
add rsp, 0xc0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14002be70
Capabilities:
Move file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a0
mov r14, r8
mov rbx, rdx
mov rdi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x498], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [0x1400b2359]
lea r8, str..._.._base_files_file_util_win.cc
lea rsi, [rsp + 0x290]
mov rcx, rsi
mov r9d, 0x19a
call fcn.1400418b0
lea rcx, [rsp + 0x30]
mov rdx, rsi
xor r8d, r8d
call fcn.1400418e0
lea rsi, [rsp + 0x290]
mov r8d, 0x208
mov rcx, rsi
mov dl, 0xaa
call fcn.140086a50
lea r15, [rdi + 2]
test byte [rdi], 1
mov rdx, r15
je 0x14002bf18
mov rdx, qword [rdi + 0x10]
mov r8d, 0x104
mov rcx, rsi
call fcn.140035840
mov rcx, rsi
call fcn.140004c40
lea rbp, [rsp + 0x80]
mov r8d, 0x208
mov rcx, rbp
mov dl, 0xaa
call fcn.140086a50
lea rsi, [rbx + 2]
test byte [rbx], 1
mov rdx, rsi
je 0x14002bf56
mov rdx, qword [rbx + 0x10]
mov r8d, 0x104
mov rcx, rbp
call fcn.140035840
mov rcx, rbp
call fcn.140004c40
test byte [rdi], 1
mov rdx, r15
je 0x14002bf78
mov rdx, qword [rdi + 0x10]
test byte [rbx], 1
mov rcx, rsi
je 0x14002bf84
mov rcx, qword [rbx + 0x10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov bpl, 1
test eax, eax
jne 0x14002bfec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140041fc0
mov r12d, eax
test byte [rbx], 1
je 0x14002bfbb
mov rsi, qword [rbx + 0x10]
test byte [rdi], 1
je 0x14002bfc4
mov r15, qword [rdi + 0x10]
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14002bfec
test r14, r14
je 0x14002bfea
cmp r12d, 0xfffffffc
jne 0x14002bfe7
call fcn.140041f50
mov r12d, eax
mov dword [r14], r12d
xor ebp, ebp
lea rcx, [rsp + 0x30]
call fcn.140041a20
mov rcx, qword [rsp + 0x498]
xor rcx, rsp
call fcn.140083c20
mov eax, ebp
add rsp, 0x4a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14002c020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1cd
call fcn.1400418b0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400418e0
test byte [rsi], 1
je 0x14002c0a1
mov rsi, qword [rsi + 0x10]
jmp 0x14002c0a5
add rsi, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rdi
call fcn.140041a20
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140083c20
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002c0e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x98], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1df
call fcn.1400418b0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.1400418e0
test byte [rsi], 1
je 0x14002c161
mov rsi, qword [rsi + 0x10]
jmp 0x14002c165
add rsi, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
setne al
and esi, 0x10
shr esi, 4
and sil, al
mov rcx, rdi
call fcn.140041a20
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140083c20
mov eax, esi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002c1b0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x60]
mov r8d, 0x20a
mov rcx, rdi
mov dl, 0xaa
call fcn.140086a50
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x102
jbe 0x14002c200
xor esi, esi
jmp 0x14002c265
mov qword [rsp + 0x20], rdi
cmp word [rsp + 0x60], 0
je 0x14002c21e
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x14002c210
jmp 0x14002c220
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140025360
lea rbx, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbx
call fcn.140026c70
mov rcx, rsi
mov rdx, rbx
call fcn.140025470
mov rcx, rbx
call fcn.140025440
mov rcx, rdi
call fcn.140025440
mov sil, 1
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140083c20
mov eax, esi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002c290
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x288
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x280], rax
lea rdi, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140086a50
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0x28
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14002c310
cmp word [rsp + 0x70], 0
je 0x14002c310
mov qword [rsp + 0x60], rdi
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x72], 0
lea rax, [rax + 1]
jne 0x14002c2f0
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140025360
jmp 0x14002c37f
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x40], xmm0
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.140025310
mov rcx, rdi
call fcn.14002c1b0
test al, al
je 0x14002c353
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140025340
jmp 0x14002c375
lea rax, [0x1400b2382]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 3
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140025360
lea rcx, [rsp + 0x40]
call fcn.140025440
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140083c20
mov rax, rsi
add rsp, 0x288
pop rdi
pop rsi
ret
Function at 0x14002cad0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x568
mov ebx, r8d
mov rbp, rdx
mov rsi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x560], rax
lea rdi, [rsp + 0x298]
mov r8d, 0x2c8
mov rcx, rdi
mov dl, 0xaa
call fcn.140086a50
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
xor ebp, ebp
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9d, 3
call fcn.140042610
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [section..rdata]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140042880
movzx eax, byte [rsp + 0x30]
test al, 1
je 0x14002cb76
mov rax, qword [rsp + 0x38]
test rax, rax
jne 0x14002cb82
jmp 0x14002cce0
shr rax, 1
test rax, rax
je 0x14002cce0
lea r13, [rsp + 0x32]
lea rdi, [rsp + 0x48]
lea rsi, [rsp + 0x298]
lea r15, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r14d, r14d
jmp 0x14002cbc1
mov rax, qword [rsp + 0x38]
mov r14d, ebp
test rax, rax
je 0x14002cce0
mov r8d, 0x250
mov rcx, rdi
mov dl, 0xaa
call fcn.140086a50
mov rcx, rsi
mov rdx, rdi
call fcn.1400427f0
mov edx, dword [rsp + 0x48]
test dl, 1
je 0x14002cc24
test bl, bl
jne 0x14002cc0c
mov rcx, rdi
call fcn.140042570
test al, al
je 0x14002cc08
mov rcx, rdi
call fcn.140042570
xor ebp, ebp
test al, al
je 0x14002cc70
jmp 0x14002cc9e
mov edx, dword [rsp + 0x48]
and edx, 0xfffffffe
test byte [rsp + 0x30], 1
mov rcx, r13
je 0x14002cc1e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call fcn.140042570
test al, al
je 0x14002cc70
xor ebp, ebp
test bl, bl
je 0x14002cc9e
mov rcx, r15
mov rdx, qword [rsp + 0x28]
mov r8b, 1
call fcn.14002cad0
mov ebp, eax
test eax, eax
jne 0x14002cc9e
test byte [rsp + 0x30], 1
mov rcx, r13
je 0x14002cc5b
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x14002cc9e
jmp 0x14002cc88
test byte [rsp + 0x30], 1
mov rcx, r13
je 0x14002cc7f
mov rcx, qword [rsp + 0x40]
call r12
xor ebp, ebp
test eax, eax
jne 0x14002cc9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
and eax, 0xfffffffe
cmp eax, 2
mov eax, 0
cmove ebp, eax
test r14d, r14d
cmovne ebp, r14d
mov rcx, rdi
call fcn.140004c40
mov rcx, rsi
mov rdx, rdi
call fcn.140042880
mov rcx, r15
mov rdx, rdi
call fcn.140025470
mov rcx, rdi
call fcn.140025440
movzx eax, byte [rsp + 0x30]
test al, 1
jne 0x14002cbb0
shr rax, 1
jmp 0x14002cbb5
lea rcx, [rsp + 0x30]
call fcn.140025440
lea rcx, [rsp + 0x298]
call fcn.140042780
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.140083c20
mov eax, ebp
add rsp, 0x568
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14002cd20
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x14002cda3
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x14002cd6e
call fcn.1400418d0
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.140043d40
mov rcx, qword [rsi]
call fcn.140043cd0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14002cd93
mov qword [rsi], rdi
call fcn.1400418d0
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.140043d00
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002ff7e
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r15, rdx
mov r14, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14002ffe0
mov ebx, eax
mov r12d, eax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
cmp eax, 0xb
jae 0x14002fff4
lea eax, [rbx + rbx]
lea rsi, [rsp + 0x20]
mov byte [rsi], al
lea r13, [rsp + 0x22]
jmp 0x14003001d
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
jmp 0x1400300c7
lea rdi, [r12 + 8]
and rdi, 0xfffffffffffffff8
lea rcx, [rdi + rdi]
call fcn.1400837ac
mov r13, rax
lea rsi, [rsp + 0x20]
mov qword [rsi + 0x10], rax
or rdi, 1
mov qword [rsi], rdi
mov qword [rsi + 8], r12
lea r8, [r12 + r12]
mov rcx, r13
xor edx, edx
call fcn.140086a50
mov word [r13 + r12*2], 0
test byte [rsp + 0x20], 1
je 0x140030041
mov rsi, qword [rsp + 0x30]
jmp 0x140030045
add rsi, 2
mov rcx, r15
mov rdx, rsi
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14003006a
mov edx, eax
movzx eax, byte [rsp + 0x20]
test al, 1
je 0x140030070
mov rcx, qword [rsp + 0x28]
jmp 0x140030076
mov al, byte [rsp + 0x20]
jmp 0x1400300aa
mov rcx, rax
shr rcx, 1
cmp rcx, rdx
jbe 0x1400300aa
lea rsi, [rsp + 0x20]
mov rcx, rsi
xor r8d, r8d
call fcn.14001fff8
mov rax, qword [rsi + 0x10]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [rsi]
movups xmmword [r14], xmm0
xorps xmm0, xmm0
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x1400300c7
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
test al, 1
je 0x1400300c7
mov rcx, qword [rsp + 0x30]
call fcn.140083808
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140083c20
mov rax, r14
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400300e7
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
test byte [rcx], 1
je 0x1400300f6
mov rcx, qword [rcx + 0x10]
jmp 0x1400300fa
add rcx, 2
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x140030497
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rbx, [rcx + 2]
test byte [rcx], 1
mov rsi, rbx
je 0x1400304c1
mov rsi, qword [rdi + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400304f0
test al, 0x10
jne 0x140030512
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.140030665
xor edi, edi
jmp 0x14003064d
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
movzx eax, byte [rdi]
test al, 1
je 0x140030530
mov rbx, qword [rdi + 0x10]
mov rax, qword [rdi + 8]
jmp 0x140030533
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.140030665
mov dil, 1
jmp 0x14003064d
shr rax, 1
test rax, rax
je 0x1400305a6
lea r9, [rbx + rax*2]
add r9, 0xfffffffffffffffe
add rax, rax
neg rax
movzx ecx, word [r9]
cmp cx, 0x5c
je 0x140030562
cmp cx, 0x2f
je 0x140030562
add r9, 0xfffffffffffffffe
add rax, 2
jne 0x140030546
jmp 0x1400305a6
sub r9, rbx
cmp r9, 0xfffffffffffffffe
je 0x1400305a6
sar r9, 1
lea rax, [rdi + 0x18]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.14001fe36
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
call fcn.140030497
test al, al
je 0x1400305e8
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14003063c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x140030628
lea rbp, [rsp + 0x28]
mov rcx, rbp
mov rdx, rsi
call fcn.14000278c
test byte [rbp], 1
je 0x1400305f6
mov rcx, qword [rsp + 0x38]
jmp 0x1400305fb
lea rcx, str.Failed_to_create_one_of_the_parent_directories
call fcn.140030665
jmp 0x14003063a
lea rcx, [rsp + 0x2a]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
setne al
and ebp, 0x10
shr ebp, 4
and bpl, al
test byte [rsp + 0x28], 1
je 0x140030623
mov rcx, qword [rsp + 0x38]
call fcn.140083808
test bpl, bpl
jne 0x14003063c
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.140030665
xor edi, edi
test byte [rsp + 0x40], 1
je 0x14003064d
mov rcx, qword [rsp + 0x50]
call fcn.140083808
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140083c20
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140030665
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.140002be3
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x1400dadb0]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.140087c94
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140083c20
nop
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140030c38
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov r14, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.140086a50
mov word [rdi], 0
xor ebx, ebx
lea r15, str.PROGRAMFILES
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r15]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call rsi
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140030cb7
mov edx, eax
mov rcx, rdi
mov r8, r14
call fcn.140030bb3
test al, al
jne 0x140030cc5
add rbx, 8
cmp rbx, 0x18
jne 0x140030c85
xor esi, esi
jmp 0x140030cc8
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140083c20
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400313e4
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov r13, rdx
mov r14, rcx
mov rax, qword [0x1400d7618]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdx, qword [0x1400db5b0]
test rdx, rdx
jne 0x1400314f6
mov ecx, 0x18
call fcn.1400837ac
mov rbx, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [0x1400db5b0], rax
mov ecx, 0x18
call fcn.1400837ac
mov rdi, rax
movups xmmword [rax], xmm6
mov qword [rax + 0x10], rsi
mov qword [0x1400db5b8], rax
call fcn.14002f676
mov rax, qword [rax + 8]
mov r15, qword [rax + 0x10]
lea rdx, str.user_data_dir
lea r12, [rsp + 0x38]
mov rcx, r12
call fcn.14000278c
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rsi, [rsp + 0x20]
mov rcx, rsi
mov rdx, rax
call fcn.14000278c
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, rsi
mov r8, r12
call fcn.14002fb86
mov rcx, rbp
mov rdx, r15
mov r8, rbx
mov r9, rdi
call fcn.140030f28
mov ebx, eax
test byte [rbp], 1
je 0x1400314c9
mov rcx, qword [rsp + 0x60]
call fcn.140083808
test byte [rsp + 0x20], 1
je 0x1400314da
mov rcx, qword [rsp + 0x30]
call fcn.140083808
test byte [rsp + 0x38], 1
je 0x1400314eb
mov rcx, qword [rsp + 0x48]
call fcn.140083808
test bl, bl
je 0x140031517
mov rdx, qword [0x1400db5b0]
mov rcx, r14
call fcn.14001ff2a
mov dil, 1
test r13, r13
je 0x140031519
mov rdx, qword [0x1400db5b8]
mov rcx, r13
call fcn.14001ff2a
jmp 0x140031519
xor edi, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140083c20
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret