joyce8/EMBER2024-capa huggingface dataset:
Function at 0x583810
Capabilities:
Create thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov esi, r8d
mov rdi, rdx
mov rbp, rcx
call fcn.00583710
mov ecx, 0x20a0
call fcn.004df170
xor edx, edx
mov rbx, rax
mov r8d, 0x20a0
mov rcx, rax
call sub.msvcrt.dll_memset
mov qword [rbx], rbp
lea rbp, [rsp + 0x40]
mov dword [rbx + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
lea rdx, [0x00664680]
mov r8d, eax
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
call fcn.00590d10
lea rdx, [0x00664685]
mov r8, rbx
mov rcx, rdi
mov qword [rbx + 0x30], rax
call sub.msvcrt.dll_sprintf
lea rcx, str.console
mov r9d, esi
mov r8, rbx
mov rdx, rdi
call fcn.00534060
test sil, 2
mov qword [rbx + 0x18], rax
jne 0x5839b1
and esi, 4
jne 0x583934
mov rdx, qword [rbx + 0x18]
lea r9, [0x0066468d]
lea r8, [0x00664692]
xor ecx, ecx
call fcn.00539ef0
mov rdx, qword [rbx + 0x18]
lea r9, [0x0066469f]
lea r8, [0x006646a4]
xor ecx, ecx
call fcn.00539ef0
mov rax, qword [0x00670c10]
mov rdx, qword [rbx + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
test eax, eax
jne 0x583912
lea r8, str._encoding
mov r9, rbp
xor ecx, ecx
call fcn.00539ef0
mov rax, qword [rbx + 0x18]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea r9, [0x006646ad]
lea r8, str._encoding
xor ecx, ecx
call fcn.00539ef0
mov rax, qword [rbx + 0x18]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rsi, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor ecx, ecx
mov r8d, 1
mov edx, 1
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x48], rax
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x58], rax
call rsi
mov qword [rbx + 0x60], rax
lea rax, [rsp + 0x38]
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x00582c40]
mov qword [rsp + 0x28], rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 2
mov qword [rbx + 0x38], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x5838ae
lea rdx, [rsp + 0x3c]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rbx]
and edx, 0xffffffe7
or edx, 2
mov dword [rsp + 0x3c], edx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor ecx, ecx
mov r8d, 1
mov edx, 1
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x50], rax
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0x68], rax
call rdi
mov qword [rbx + 0x70], rax
lea rax, [rsp + 0x38]
xor ecx, ecx
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x00582d20]
mov qword [rsp + 0x28], rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 2
mov qword [rbx + 0x40], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x5838a5
Function at 0x583e40
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [rsp + 0xa0]
mov rbx, rcx
mov r12, rdx
mov ebp, r8d
lea rdi, [rbx + 0x98]
mov r13, r9
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rdi
mov r14, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call r14
sub dword [rbx + 0xf0], ebp
mov rdx, r12
mov dword [rsi + 0x14], 0
mov dword [rsi + 0x10], 0
mov r9, r13
mov r8d, ebp
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r15d, eax
mov rcx, rdi
mov r12, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call r12
test r15d, r15d
jne 0x583ed6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x583f14
cmp eax, 0x461
jne 0x583f10
mov rcx, rdi
call r14
mov eax, dword [rbx + 0xf0]
add eax, dword [r13]
mov rcx, rdi
sub eax, ebp
mov dword [rbx + 0xf0], eax
call r12
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x583ef9
mov r9d, 1
mov r8, r13
mov rdx, rsi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x583ed6
jmp 0x583ef9
Function at 0x585920
Capabilities:
Create thread

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov esi, r8d
mov rbp, rcx
mov r12, rdx
call fcn.005853a0
mov ecx, 0xf8
call fcn.004df170
lea rdi, [rax + 8]
mov r10, rax
mov rbx, rax
mov qword [rax + 0xf0], 0
xor eax, eax
and rdi, 0xfffffffffffffff8
sub r10, rdi
add r10d, 0xf8
shr r10d, 3
mov ecx, r10d
rep stosq qword [rdi], rax
mov dword [rbx + 0x18], esi
mov qword [rbx], rbp
mov qword [rbx + 0x10], 0
mov dword [rbx + 0x24], 0
mov dword [rbx + 0x28], 1
mov dword [rbx + 0xf0], 0
mov dword [rbx + 0xec], 0
mov dword [rbx + 0x2c], 0xa
mov dword [rbx + 0x30], 0
mov dword [rbx + 0x34], 0
mov dword [rbx + 0x38], 0
call fcn.00590d10
lea rdx, [0x00664a87]
mov r8, rbx
mov rcx, r12
mov qword [rbx + 0x48], rax
mov dword [rbx + 0x3c], 0x1000
mov dword [rbx + 0x40], 0x1000
call sub.msvcrt.dll_sprintf
lea rcx, str.serial
mov r9d, esi
mov r8, rbx
mov rdx, r12
call fcn.00534060
mov r8d, dword [rbx + 0x40]
mov edx, dword [rbx + 0x3c]
mov rcx, rbp
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_SetupComm]
mov edx, 0xf
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_PurgeComm]
lea rdx, [0x006a0fe0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
lea rcx, [rbx + 0x98]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test sil, 2
jne 0x585b20
and esi, 4
je 0x585ad9
mov rsi, qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call rsi
xor r9d, r9d
mov r8d, 1
mov edx, 1
xor ecx, ecx
mov qword [rbx + 0x88], rax
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0xc0], rax
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rbx + 0xc8], rax
call rsi
mov qword [rbx + 0xd0], rax
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x00583f30]
mov edx, 0x100
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x90], rax
mov rdx, qword [rbx + 0x10]
lea r9, [0x00664a8f]
lea r8, [0x00664a94]
xor ecx, ecx
call fcn.00539ef0
mov rdx, qword [rbx + 0x10]
lea r9, [0x00664aa1]
lea r8, [0x00664aa6]
xor ecx, ecx
call fcn.00539ef0
mov rax, qword [rbx + 0x10]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x68], rax
jmp 0x585a44
Function at 0x585e40
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
test rcx, rcx
mov r15, rcx
mov ebp, edx
mov rbx, r8
je 0x585e65
cmp byte [rcx], 0
jne 0x585ea0
mov ecx, 2
call fcn.00540d10
test rbx, rbx
je 0x585e84
mov r8, rbx
mov edx, 0xffffffff
mov rcx, r15
call fcn.00581b80
mov eax, 1
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r12, qword [0x00670c10]
mov rax, qword [r12]
call qword [rax + 0x60]
test ah, 4
jne 0x585f10
mov rax, qword [r12]
mov rcx, r15
call qword [rax + 0xb0]
test eax, eax
jne 0x585f1e
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov ecx, eax
call fcn.00585b40
call fcn.00540cf0
cmp eax, 0xd
je 0x585f25
call fcn.00540cf0
cmp eax, 0x5d
je 0x586090
test ebp, ebp
je 0x585e6f
call fcn.00540cf0
cmp eax, 0x11
jne 0x585e6f
jmp 0x585e84
xor edx, edx
mov rcx, r15
call fcn.00588be0
test eax, eax
jne 0x585ec4
xor eax, eax
jmp 0x585e89
mov rax, qword [r12]
mov rcx, r15
call qword [rax + 0x60]
cmp eax, 0xffffffff
mov r14d, eax
je 0x585edf
test al, 0x10
je 0x58609f
test ah, 4
jne 0x5860ae
test r14b, 1
je 0x585fa0
mov rax, qword [r12]
and r14d, 0xfffffffe
mov rcx, r15
mov edx, r14d
call qword [rax + 0xc8]
test eax, eax
je 0x585e6f
mov rax, qword [r12]
mov rcx, r15
call qword [rax + 0xb0]
test eax, eax
jne 0x585f1e
call r13
mov ecx, eax
call fcn.00585b40
mov rax, qword [r12]
mov edx, r14d
mov rcx, r15
or edx, 1
call qword [rax + 0xc8]
nop dword [rax + rax]
call fcn.005814b0
cmp eax, 2
je 0x585edf
lea rax, [rsp + 0x30]
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x28], rax
call fcn.005757e0
mov rcx, r15
call sub.msvcrt.dll_strlen
mov rdx, r15
mov rsi, rax
mov r8d, eax
mov rcx, rdi
call fcn.00575800
test esi, esi
jle 0x585fff
movsxd rsi, esi
cmp byte [rax + rsi - 1], 0x5c
je 0x585fff
lea rdx, [0x00664d12]
mov r8d, 1
mov rcx, rdi
call fcn.00575800
mov rcx, qword [rsp + 0x28]
lea rdx, [0x00664d14]
lea r12, [rsp + 0x110]
mov r8d, 3
call fcn.00575800
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov r13, rax
je 0x586081
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word [rax + rax]
lea rax, [r12 + 0x2c]
lea rdi, [0x00664d18]
mov ecx, 2
mov rsi, rax
repe cmpsb byte [rsi], byte [rdi]
je 0x58606b
lea rdi, [0x00664d1a]
mov rsi, rax
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
jne 0x5860c8
mov rdx, r12
mov rcx, r13
call r14
test eax, eax
jne 0x586040
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x28]
call fcn.00575950
jmp 0x585edf
mov ecx, 0x11
call fcn.00540d10
jmp 0x585eed
mov ecx, 0x14
call fcn.00540d10
jmp 0x585e6f
mov edx, 1
mov rcx, r15
call fcn.00588be0
test eax, eax
je 0x585f48
jmp 0x585e6f
mov ecx, 0x11
call fcn.00540d10
jmp 0x586078
Function at 0x589370
Capabilities:
Get common file path
Read .ini file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x338
mov rbp, rcx
mov rcx, rdx
mov rdi, rdx
call fcn.005757e0
lea rcx, str.netapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x5894e9
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NetApiBufferFree
mov rcx, rax
call rsi
lea rdx, str.NetGetDCName
mov rcx, rbx
mov r13, rax
call rsi
mov r12, rax
lea rdx, str.NetUserGetInfo
mov rcx, rbx
call rsi
test r12, r12
mov rsi, rax
setne dl
test rax, rax
setne al
test dl, al
je 0x5894e0
test r13, r13
je 0x5894e0
mov edx, 0x40
mov rcx, rbp
mov qword [rsp + 0x38], 0
call sub.msvcrt.dll_strchr
test rax, rax
mov r15, rax
je 0x589490
lea r14, [rsp + 0x40]
mov rcx, r14
call fcn.005757e0
lea rcx, [r15 + 1]
mov r8, r14
mov edx, 0xffffffff
call fcn.00571b80
xor ecx, ecx
lea r8, [rsp + 0x38]
mov rdx, rax
call r12
mov rcx, r14
mov r12d, eax
call fcn.00575950
test r12d, r12d
je 0x5895f8
mov rcx, qword [rsp + 0x38]
xor esi, esi
test rcx, rcx
je 0x5894e0
call r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rsi, rsi
je 0x5894e9
mov rax, rsi
add rsp, 0x338
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r14, [rsp + 0x40]
mov r15d, 0xffffffff
mov rcx, r14
call fcn.005757e0
mov r8, r14
mov edx, r15d
mov rcx, rbp
call fcn.00571b80
lea r9, [rsp + 0x30]
mov r8d, 1
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call rsi
test eax, eax
je 0x589534
mov rcx, r14
xor esi, esi
call fcn.00575950
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x589464
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [rbp], 0x2a
je 0x58952d
lea rax, str.system.ini
lea rbx, [rsp + 0x120]
mov dword [rsp + 0x20], 0x104
lea r8, [0x00664f1e]
mov rdx, rbp
lea rcx, str.Password_Lists
mov qword [rsp + 0x28], rax
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x5895b0
xor esi, esi
jmp 0x589475
mov rax, qword [rsp + 0x30]
mov rsi, qword [rax + 0x18]
test rsi, rsi
je 0x58954c
cmp word [rsi], 0
jne 0x5895e0
lea rsi, [rsp + 0x120]
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov r8, rdi
mov edx, 2
mov rcx, rsi
call fcn.00571a50
lea rdx, str._users_default
mov r8d, 0xffffffff
mov rcx, rdi
call fcn.00575800
mov rcx, qword [rsp + 0x30]
mov rsi, qword [rdi]
call r13
mov rcx, r14
call fcn.00575950
mov rcx, qword [rsp + 0x38]
test rcx, rcx
jne 0x589464
jmp 0x589467
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov r8d, 3
mov rdx, rbx
mov rcx, rdi
call fcn.00575800
mov rsi, qword [rdi]
jmp 0x589475
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
mov rcx, rsi
call fcn.00571a50
jmp 0x589587
sub r15d, ebp
jmp 0x58949b
Function at 0x58ae40
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
mov rcx, qword [0x006a0f90]
call fcn.00517640
test ebx, ebx
jne 0x581610
cmp qword [0x00610ad0], 0
lea rax, [0x00610a00]
mov qword [0x006a0f90], 0
mov qword [0x006a2d80], rax
je 0x5817b0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [0x006108c0]
lea rdx, [0x006643f3]
xor ecx, ecx
mov qword [0x006a2d80], rax
call fcn.00518260
mov qword [0x006a0f90], rax
mov rax, qword [0x006a2d80]
cmp qword [rax + 0xd0], 0
jne 0x581601
lea rcx, str.kernel32
mov rdi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rdi
test rax, rax
mov rbx, rax
je 0x5816f2
mov rbp, qword [0x006a2d80]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExW
mov rcx, rax
call rsi
mov qword [rbp + 0xd0], rax
mov rbp, qword [0x006a2d80]
lea rdx, str.CreateHardLinkW
mov rcx, rbx
call rsi
mov qword [rbp + 0xd8], rax
mov rbp, qword [0x006a2d80]
lea rdx, str.FindFirstFileExW
mov rcx, rbx
call rsi
mov qword [rbp + 0xe0], rax
mov rbp, qword [0x006a2d80]
lea rdx, str.GetVolumeNameForVolumeMountPointW
mov rcx, rbx
call rsi
mov qword [rbp + 0xe8], rax
mov rbp, qword [0x006a2d80]
mov rcx, rbx
lea rdx, str.GetLongPathNameW
call rsi
mov rcx, rbx
mov qword [rbp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.advapi32
call rdi
test rax, rax
mov rbx, rax
je 0x581601
mov rdi, qword [0x006a2d80]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileSecurityW
mov rcx, rax
call rsi
mov qword [rdi + 0xf8], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.ImpersonateSelf
mov rcx, rbx
call rsi
mov qword [rdi + 0x100], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.OpenThreadToken
mov rcx, rbx
call rsi
mov qword [rdi + 0x108], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.RevertToSelf
mov rcx, rbx
call rsi
mov qword [rdi + 0x110], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.MapGenericMask
mov rcx, rbx
call rsi
mov qword [rdi + 0x118], rax
mov rdi, qword [0x006a2d80]
lea rdx, str.AccessCheck
mov rcx, rbx
call rsi
mov qword [rdi + 0x120], rax
jmp 0x581834
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbx, rax
je 0x581601
mov rsi, qword [0x006a2d80]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetFileAttributesExA
mov rcx, rax
call rdi
mov qword [rsi + 0xd0], rax
mov rsi, qword [0x006a2d80]
lea rdx, str.CreateHardLinkA
mov rcx, rbx
call rdi
mov qword [rsi + 0xd8], rax
mov rsi, qword [0x006a2d80]
lea rdx, str.GetVolumeNameForVolumeMountPointA
mov rcx, rbx
mov qword [rsi + 0xe0], 0
mov qword [rsi + 0xf0], 0
call rdi
mov qword [rsi + 0xe8], rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
sub rsp, 0x28
call fcn.005814b0
sub eax, 2
xor ecx, ecx
cmp eax, 1
setbe cl
add rsp, 0x28
jmp 0x5815c0
Function at 0x58aef0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x438
mov rbx, rcx
lea rcx, [0x00610dc0]
mov dword [rsp + 0x3c], 0x100
call fcn.00576500
lea rdx, str.tclDefaultLibrary
xor r8d, r8d
mov r9, rax
mov rcx, rbx
mov dword [rsp + 0x20], 1
call fcn.0057a620
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea r9, str.windows
lea r8, str.platform
lea rdx, str.tcl_platform
mov dword [rsp + 0x20], 1
mov rcx, rbx
call fcn.0057a720
mov eax, dword [rsp + 0xb0]
cmp eax, 3
jbe 0x58b070
lea rsi, [rsp + 0x40]
mov r9d, dword [rsp + 0xa8]
mov r8d, dword [rsp + 0xa4]
lea rdx, str._d._d
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, str.osVersion
lea rdx, str.tcl_platform
mov dword [rsp + 0x20], 1
mov r9, rsi
mov rcx, rbx
call fcn.0057a720
movzx eax, word [rsp + 0x70]
cmp ax, 0xa
jbe 0x58b0a0
lea rsi, [rsp + 0x140]
mov rcx, rsi
call fcn.005757e0
lea r8, str.HOME
lea rdx, [0x00665023]
mov r9d, 1
mov rcx, rbx
call fcn.0057a480
test rax, rax
je 0x58b120
mov rcx, rsi
call fcn.005757e0
lea rcx, str.USERNAME
mov rdx, rsi
call fcn.0051a4f0
test rax, rax
je 0x58b0d0
mov r9, qword [rsp + 0x140]
lea r8, str.user
lea rdx, str.tcl_platform
mov rcx, rbx
mov dword [rsp + 0x20], 1
call fcn.0057a720
mov rcx, rsi
call fcn.00575950
nop
add rsp, 0x438
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, str.Win32s
lea r8, [0x00665003]
mov dword [rsp + 0x20], 1
mov rcx, rbx
mov r9, qword [rdx + rax*8]
lea rdx, str.tcl_platform
call fcn.0057a720
jmp 0x58af88
lea rdx, str.intel
lea r8, str.machine
mov dword [rsp + 0x20], 1
mov rcx, rbx
mov r9, qword [rdx + rax*8]
lea rdx, str.tcl_platform
call fcn.0057a720
jmp 0x58afdd
mov rbp, qword [0x00670c10]
lea rdi, [rsp + 0x220]
lea rdx, [rsp + 0x3c]
mov rcx, rdi
mov rax, qword [rbp]
call qword [rax + 0x138]
test eax, eax
je 0x58b032
mov rcx, qword [rbp]
mov eax, dword [rsp + 0x3c]
mov r8, rsi
mov ecx, dword [rcx]
sub eax, 1
lea edx, [rax + rax]
test ecx, ecx
mov rcx, rdi
cmove edx, eax
call fcn.00581b80
jmp 0x58b032
lea r8, str.HOMEDRIVE
lea rdx, [0x00665023]
mov r9d, 1
mov rcx, rbx
call fcn.0057a480
test rax, rax
je 0x58b152
mov r8d, 0xffffffff
mov rdx, rax
mov rcx, rsi
call fcn.00575800
lea r8, str.HOMEPATH
lea rdx, [0x00665023]
mov r9d, 1
mov rcx, rbx
call fcn.0057a480
test rax, rax
je 0x58b184
mov r8d, 0xffffffff
mov rdx, rax
mov rcx, rsi
call fcn.00575800
mov r8d, dword [rsp + 0x148]
mov dword [rsp + 0x20], 1
test r8d, r8d
jle 0x58b1c0
mov r9, qword [rsp + 0x140]
lea r8, str.HOME
lea rdx, [0x00665023]
mov rcx, rbx
call fcn.0057a720
jmp 0x58b012
lea r9, [0x0066503a]
lea r8, str.HOME
lea rdx, [0x00665023]
mov rcx, rbx
call fcn.0057a720
jmp 0x58b012
Function at 0x58b5c0
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x458
mov rbp, qword [0x00670c10]
mov r12, rcx
mov rax, qword [rbp]
mov edx, dword [rax]
test edx, edx
je 0x58b607
lea rdx, [rsp + 0x30]
mov r8d, 0x104
lea rcx, [0x006652c8]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x58b6b0
lea rcx, [0x006a1010]
lea rbx, [rsp + 0x240]
call fcn.00590ee0
cmp qword [0x006a1018], 0
je 0x58b6c0
lea rcx, [0x006a1010]
call fcn.00590f50
mov rcx, qword [0x006a1018]
call fcn.0058a660
test rax, rax
je 0x58b666
mov rcx, rax
call fcn.00551200
lea rdx, str.::bitrock_dll_dir
mov r8, rax
mov r9d, 1
mov rcx, r12
call fcn.0057a7c0
mov rax, qword [rbp]
xor r8d, r8d
lea rdx, [0x0066537c]
mov r9, rbx
mov rcx, qword [0x006a1018]
call qword [rax + pe_nt_image_headers64]
mov edx, eax
xor eax, eax
test edx, edx
je 0x58b694
mov rcx, rbx
call fcn.0058a660
add rsp, 0x458
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.0058d080
jmp 0x58b694
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x58b800
lea rdx, str.AddDllDirectory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x58b800
mov dword [0x00610e00], 1
lea rbx, [rsp + 0x240]
mov ecx, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, eax
cmp rax, 0xf7
mov qword [rsp + 0x28], rax
ja 0x58b810
mov rax, qword [rsp + 0x28]
lea rdx, str.BRLXXXXXXXX
lea rdi, [rax + rax]
lea rcx, [rbx + rdi]
call sub.msvcrt.dll_wcscpy
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
lea rax, [rbx + rdi + 6]
mov r14, qword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x100
mov r13, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r15, qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x20], rax
jmp 0x58b78d
call r15
cmp eax, 0xb7
jne 0x58b850
imul esi, esi, 0x1000193
sub edi, 1
je 0x58b850
mov r8d, esi
lea rdx, str._08x
mov rcx, qword [rsp + 0x20]
call r14
xor edx, edx
mov rcx, rbx
call r13
test eax, eax
je 0x58b770
mov rax, qword [rsp + 0x28]
lea ecx, [rax + rax + 0x18]
call fcn.004df170
mov rdx, rbx
mov rcx, rax
mov qword [0x006a1018], rax
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x00610e00]
lea r8, [0x006652c4]
lea rdx, str.::bitrock_tcl_is_using_only_s32_dll_path
mov r9d, 1
mov rcx, r12
test eax, eax
lea rax, [0x006652c6]
cmove r8, rax
call fcn.0057a7c0
jmp 0x58b629
mov dword [0x00610e00], 0
jmp 0x58b6f9
mov ecx, 0x26
call fcn.00540d10
mov rcx, r12
call fcn.00540d30
lea rcx, str.couldnt_create_temporary_directory:__s
mov rdx, rax
call fcn.00565840
mov rcx, r12
mov rdx, rax
call fcn.00561670
lea rcx, [0x006a1010]
call fcn.00590f50
xor eax, eax
jmp 0x58b694
mov ecx, eax
call fcn.00585b40
jmp 0x58b81a
Function at 0x58c3c0
Capabilities:
Create directory
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x160
mov rsi, qword [0x00670c10]
lea rdi, [0x006653f0]
mov rbx, rcx
mov rax, qword [rsi]
mov r9d, dword [rax]
test r9d, r9d
je 0x58c40e
mov rdx, rcx
mov r8d, 0x104
lea rcx, str.BITROCK_TEMP_FOLDER
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x58c490
mov rax, qword [rsi]
lea rdi, [0x006653f4]
mov rdx, rbx
mov ecx, 0x104
call qword [rax + 0x88]
test eax, eax
jne 0x58c462
mov rax, qword [rsi]
mov r8d, dword [rax]
test r8d, r8d
jne 0x58c452
mov byte [rbx], 0x2e
mov byte [rbx + 1], 0
mov rax, qword [rsi]
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
add rsp, 0x160
pop rbx
pop rsi
pop rdi
ret
mov edx, 0x2e
xor ecx, ecx
mov word [rbx], dx
mov word [rbx + 2], cx
jmp 0x58c435
mov rax, qword [rsi]
xor r8d, r8d
mov rdx, rdi
mov r9, rbx
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
mov edx, eax
mov eax, 1
test edx, edx
je 0x58c420
add rsp, 0x160
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x58c404
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test byte [rsp + 0x20], 0x10
je 0x58c404
mov rax, qword [rsi]
xor r8d, r8d
mov r9, rbx
lea rdx, [0x006653f4]
mov rcx, rbx
call qword [rax + pe_nt_image_headers64]
test eax, eax
je 0x58c404
mov eax, 1
jmp 0x58c447