joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012ec
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x80
mov r15, r9
mov r13, rdx
lea r8, [0x140076b80]
lea r12, str.CAPIHook::UnhookImportedFunction
mov rdx, r12
mov ecx, 5
call fcn.140009480
nop
mov qword [rsp + 0x40], r13
mov eax, 0x5a4d
cmp word [r13], ax
je 0x140001346
xor eax, eax
jmp 0x140001590
movsxd rax, dword [r13 + 0x3c]
add rax, r13
cmp dword [rax], 0x4550
je 0x14000135c
xor eax, eax
jmp 0x140001590
mov esi, dword [rax + 0x90]
add rsi, r13
mov qword [rsp + 0x30], rsi
cmp rsi, rax
jne 0x140001376
xor eax, eax
jmp 0x140001590
xor edi, edi
lea r14d, [rdi + 4]
cmp dword [rsi + 0xc], edi
je 0x1400013ca
mov ebx, dword [rsi + 0xc]
add rbx, r13
mov r9, rbx
lea r8, str.pszModName___1_hs__n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
mov rdx, r15
mov rcx, rbx
call fcn.14005ae84
cmp eax, edi
jne 0x1400013bf
lea r8, str.Found_the_module._n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
jmp 0x1400013ca
add rsi, 0x14
mov qword [rsp + 0x30], rsi
jmp 0x14000137c
cmp dword [rsi + 0xc], edi
jne 0x1400013d6
xor eax, eax
jmp 0x140001590
lea r8, str.intercept_function._n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
mov ebx, dword [rsi + 0x10]
add rbx, r13
mov qword [rsp + 0x28], rbx
mov r9d, edi
mov dword [rsp + 0x20], edi
mov rax, rbx
cmp qword [rbx], rdi
je 0x140001413
inc r9d
mov dword [rsp + 0x20], r9d
add rax, 8
cmp qword [rax], rdi
jne 0x140001402
lea r8, str.cFuncs___1_d__n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
mov rsi, qword [rsp + 0xd0]
mov r13, qword [rsp + 0xc8]
cmp qword [rbx], rdi
je 0x14000158a
mov r9, qword [rbx]
lea r8, str.pThunk__u1.Function__0x_1_x__n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
mov r9, r13
lea r8, str.pfnOriginalProc__0x_1_x__n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
mov r9, rsi
lea r8, str.pfnNewProc__0x_1_x__n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
cmp qword [rbx], rsi
jne 0x14000157c
lea r8, str.Found_the_entry_point._n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
nop
mov qword [rbx], r13
jmp 0x140001551
lea r8, str.Set_alternative_function._n
mov rdx, r12
mov ecx, r14d
call fcn.140009480
lea r8, [0x140076ba0]
mov rdx, r12
mov ecx, 5
call fcn.140009480
mov rax, rsi
jmp 0x140001590
add rbx, 8
mov qword [rsp + 0x28], rbx
jmp 0x140001435
xor eax, eax
jmp 0x140001590
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x140002494
Capabilities:
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rcx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.14005bb90
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], bx
call fcn.14005bb90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x140002544
lea rdx, [rsp + 0x230]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, ebx
je 0x140002544
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rsp + 0x230]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14005bad0
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
Function at 0x14001f6bc
Capabilities:
Create thread
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [0x140099070]
mov edx, 0x774e
call fcn.14000b18c
mov rcx, qword [0x140099070]
mov edx, 0x774e
mov ebx, eax
call fcn.14000b0f0
mov r9d, ebx
mov edx, 0x774e
mov rcx, rdi
mov r8d, eax
mov dword [rsp + 0x20], 2
call fcn.140014310
cmp eax, 7
je 0x14001f8ba
mov rcx, qword [rdi + 0x120]
test rcx, rcx
je 0x14001f725
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi + 0x118]
test rcx, rcx
je 0x14001f739
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi + 0x110]
test rcx, rcx
je 0x14001f74d
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov rbx, rax
test rax, rax
je 0x14001f78e
mov rcx, rax
call qword [sym.imp.USER32.dll_IsMenu]
test eax, eax
je 0x14001f78e
mov edx, 0xf060
mov r8d, 3
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov rcx, qword [rdi + 8]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 8]
mov edx, 0x205
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0xf0
xor r9d, r9d
mov rcx, rax
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov edx, 0x206
test eax, eax
setne cl
mov dword [rdi + 0x134], ecx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov edx, 0x207
test eax, eax
setne cl
mov dword [rdi + 0x138], ecx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov edx, 0x208
test eax, eax
setne cl
mov dword [rdi + 0x13c], ecx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
mov edx, 0x200
test eax, eax
setne cl
mov dword [rdi + 0x140], ecx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
lea r8, [0x14001a484]
test eax, eax
lea rax, [rsp + 0x48]
mov r9, rdi
setne cl
and dword [rsp + 0x48], 0
and qword [rdi + 0x150], 0
mov dword [rdi + 0x130], ecx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x150], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001ff1c
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14001ff46
xor eax, eax
jmp 0x14001ffed
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
and dword [rsp + 0x3c], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14001ffe8
lea r8, str.ExitWindowsEx_failed._n
lea rdx, str.RestartWindows
lea ecx, [rbx + 2]
call fcn.140009480
jmp 0x14001ff3f
mov eax, 1
add rsp, 0x40
pop rbx
ret

Function at 0x14001fff4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push r12
sub rsp, 0x40
mov rbx, rcx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002001d
lea r8, str._1_s__is_not_found._n
jmp 0x14002003f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140020058
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x140020058
lea r8, str._1_s__is_directory._n
lea rdx, str.IsFileUsingByExclusive
mov r9, rbx
mov ecx, 4
call fcn.140009480
jmp 0x14002013b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r12d, eax
test al, 1
je 0x1400200d2
lea r8, str.___1_s___has_FILE_ATTRIBUTE_READONLY._n
lea rdx, str.IsFileUsingByExclusive
mov r9, rbx
mov ecx, 4
call fcn.140009480
lea r8, str.File_attribute_is__1_d_._n
lea rdx, str.IsFileUsingByExclusive
mov r9d, r12d
mov ecx, 4
call fcn.140009480
xor r12d, 1
mov rcx, rbx
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea r8, str.This_file_is_changed_to__1_d_._n
lea rdx, str.IsFileUsingByExclusive
mov r9d, eax
mov ecx, 4
call fcn.140009480
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r9, rbx
lea rdx, str.IsFileUsingByExclusive
mov ecx, 4
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14002012a
lea r8, str._1_s__can_be_accessed_exclusively._n
call fcn.140009480
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002013b
lea r8, str._1_s__cannot_be_accessed_exclusively._n
call fcn.140009480
mov ebp, 1
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop r12
ret
Function at 0x140021184
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
push rdi
push r13
push r14
sub rsp, 0x6b0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor ebp, ebp
xor esi, esi
lea rcx, str.setupapi.dll
call fcn.140002494
mov rdi, rax
test rax, rax
je 0x1400211ed
lea rdx, str.SetupUninstallOEMInfW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x70]
call fcn.14005bb90
and qword [rsp + 0x40], rsi
and qword [rsp + 0x38], rsi
mov r14d, 0x105
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x280]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x101
lea r9, [rsp + 0x490]
mov r13d, 4
mov r8, r13
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx]
call fcn.14005cbe4
lea r8, [rsp + 0x60]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.14005ceb0
lea r8, [rsp + 0x490]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.14005c0a4
lea r8, [rsp + 0x280]
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.14005c0a4
lea r8, str..PNF
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.14005c0a4
mov rdx, r13
lea rcx, [0x14007bbf8]
call fcn.14005ca00
mov r8, rax
lea rdx, [rsp + 0x280]
lea rcx, [0x14007bbf8]
call fcn.14005c5e0
test eax, eax
je 0x1400212e0
mov r9, qword [rbx]
lea r8, str.___1_s__isnot_oeminf._n
lea rdx, str.DeleteInf
mov ecx, r13d
call fcn.140009480
jmp 0x14002138f
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r13d, 0xfffffffe
and eax, r13d
mov edx, eax
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test rbp, rbp
je 0x14002134f
lea r8, str..INF
mov rdx, r14
lea rcx, [rsp + 0x280]
call fcn.14005c0a4
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x280]
call rbp
mov esi, eax
test eax, eax
jne 0x14002138f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.SetupUninstallOEMInf_failed.__0x_1_x___n
lea rdx, str.DeleteInf
lea ecx, [rsi + 2]
call fcn.140009480
jmp 0x14002138f
cmp dword [0x14009b9ec], esi
jne 0x14002138f
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14002138f
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, r13d
mov edx, eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 1
test rdi, rdi
je 0x14002139e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400213bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, esi
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.14005bad0
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x140023e30
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x280
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r12, rdx
mov rsi, rcx
xor ebx, ebx
cmp rdx, rbx
je 0x140024073
mov rdx, r8
mov rcx, r12
call fcn.14005ca00
cmp rax, rbx
je 0x140024073
lea r8d, [rbx + 0x40]
lea rdx, [0x14007c214]
mov rcx, rsi
call fcn.14005e3a4
mov rdi, rax
cmp rax, rbx
jne 0x140023ea4
xor eax, eax
jmp 0x140024075
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rsp + 0x20]
call fcn.14005bb90
mov r9, rdi
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x20]
call fcn.14005e384
cmp rax, rbx
jne 0x140023ede
mov rcx, rdi
call fcn.14005dff0
xor eax, eax
jmp 0x140024075
cmp byte [rsp + 0x20], 0xff
jne 0x140023fd3
cmp byte [rsp + 0x21], 0xfe
jne 0x140023fd3
mov esi, 0x20a
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14005bb90
mov r8, rdi
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14005de30
cmp rax, rbx
je 0x140024067
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
lea rcx, [rsp + 0x60]
call fcn.14005b1c0
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140002280
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov rdx, r12
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rbx
jne 0x140023fb3
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14005bb90
nop
cmp qword [rsp + 0x50], 8
jb 0x140023f93
mov rcx, qword [rsp + 0x38]
call fcn.14005ab0c
mov r8, rdi
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14005de30
cmp rax, rbx
jne 0x140023f23
jmp 0x140024067
mov ebx, 1
cmp qword [rsp + 0x50], 8
jb 0x140024067
mov rcx, qword [rsp + 0x38]
call fcn.14005ab0c
jmp 0x140024067
mov rcx, rdi
call fcn.14005dff0
mov r8d, 0x40
lea rdx, [0x14007c210]
mov rcx, rsi
call fcn.14005e3a4
mov rdi, rax
cmp rax, rbx
jne 0x140023ffc
xor eax, eax
jmp 0x140024075
mov esi, 0x20a
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14005bb90
mov r8, rdi
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14005de30
cmp rax, rbx
je 0x140024067
mov rdx, r12
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp rax, rbx
jne 0x140024062
mov r8, rsi
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.14005bb90
mov r8, rdi
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14005de30
cmp rax, rbx
jne 0x140024027
jmp 0x140024067
mov ebx, 1
mov rcx, rdi
call fcn.14005dff0
mov eax, ebx
jmp 0x140024075
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14005bad0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x280
pop r12
pop rdi
pop rsi
ret
Function at 0x14003bc28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
lea r12, str.CDeviceInfSection::Init
mov r13d, 5
lea r8, [0x14007f570]
mov rdx, r12
mov ecx, r13d
mov rsi, r9
call fcn.140009480
cmp dword [rbx + 0xe8], 0
je 0x14003bc86
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14003bdbd
test rdi, rdi
jne 0x14003bca0
lea ecx, [rdi + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.pInfFile_is_NULL._n
jmp 0x14003bd56
mov rdx, rbp
mov rcx, rdi
call fcn.14005ca00
test rax, rax
jne 0x14003bcc5
lea ecx, [rax + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.pInfFile_is_Zero_length._n
jmp 0x14003bd56
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14003bce7
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.pInfFile_is_not_found._n
jmp 0x14003bd56
mov rcx, rdi
call fcn.14005b1c0
lea rcx, [rbx + 0x68]
mov rdx, rdi
mov r8, rax
call fcn.140002280
mov rcx, rdi
call fcn.14005b1c0
lea rcx, [rbx + 0x90]
mov rdx, rdi
mov r8, rax
call fcn.140002280
mov rdi, qword [rsp + 0x60]
test rdi, rdi
jne 0x14003bd34
lea ecx, [rdi + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.pSectionName_is_NULL._n
jmp 0x14003bd56
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.14005ca00
test rax, rax
jne 0x14003bd78
lea ecx, [rax + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.pSectionName_is_Zero_length._n
mov rdx, r12
mov ecx, r13d
call fcn.140009480
lea r8, [0x14007f590]
mov rdx, r12
mov ecx, r13d
call fcn.140009480
jmp 0x14003bc7f
mov rcx, rdi
call fcn.14005b1c0
lea rcx, [rbx + 0xb8]
mov rdx, rdi
mov r8, rax
call fcn.140002280
test rsi, rsi
je 0x14003bd9e
mov qword [rbx + 0xe0], rsi
lea r8, [0x14007f590]
mov edi, 1
mov rdx, r12
mov ecx, r13d
mov dword [rbx + 0xe8], edi
call fcn.140009480
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14003c048
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea rbp, str.CIniSections::Init
mov r12d, 5
lea r8, [0x14007f570]
mov rdx, rbp
mov ecx, r12d
call fcn.140009480
cmp dword [rsi + 0x60], 0
je 0x14003c0a1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14003c14c
test rbx, rbx
jne 0x14003c0b8
lea ecx, [rbx + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.pInfFile_is_NULL._n
jmp 0x14003c0fa
mov rdx, rdi
mov rcx, rbx
call fcn.14005ca00
test rax, rax
jne 0x14003c0da
lea ecx, [rax + 0x57]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.pInfFile_is_Zero_length._n
jmp 0x14003c0fa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14003c119
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r8, str.pInfFile_is_not_found._n
mov rdx, rbp
mov ecx, r12d
call fcn.140009480
lea r8, [0x14007f590]
mov rdx, rbp
mov ecx, r12d
call fcn.140009480
jmp 0x14003c09a
mov rcx, rbx
call fcn.14005b1c0
lea rcx, [rsi + 0x38]
mov rdx, rbx
mov r8, rax
call fcn.140002280
lea r8, [0x14007f590]
mov ebx, 1
mov rdx, rbp
mov ecx, r12d
mov dword [rsi + 0x60], ebx
call fcn.140009480
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140041dd0
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x20], 0
jne 0x140041ddf
xor eax, eax
jmp 0x140041df6
cmp qword [rcx + 0x28], 8
jb 0x140041dec
mov rcx, qword [rcx + 0x10]
jmp 0x140041df0
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
add rsp, 0x28
ret

Function at 0x140041dfc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [r11 - 0x20], 0xf
xor esi, esi
mov qword [r11 - 0x28], rsi
mov byte [rsp + 0x30], sil
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov r9, rbx
lea r8, str.pFileName___1_lS__n
lea rdx, str.FILEEXISTW
lea ebx, [rsi + 5]
mov ecx, ebx
call fcn.140009480
mov r9d, edi
lea r8, str.dwRet__0x_1_lx_._n
lea rdx, str.FILEEXISTW
mov ecx, ebx
call fcn.140009480
cmp edi, 0xffffffff
setne sil
cmp qword [rsp + 0x48], 0x10
jb 0x140041e8e
mov rcx, qword [rsp + 0x30]
call fcn.14005ab0c
mov eax, esi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005bad0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140041eb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], bl
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140041eed
test al, 0x10
je 0x140041eed
mov ebx, 1
cmp qword [rsp + 0x40], 0x10
jb 0x140041eff
mov rcx, qword [rsp + 0x28]
call fcn.14005ab0c
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005bad0
add rsp, 0x50
pop rbx
ret

Function at 0x140041f6c
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.140041dd0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
Function at 0x140041fbc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rdi, rcx
lea rax, vtable.CChangeDir.0
mov qword [rcx], rax
mov qword [rcx + 0x28], 7
xor r12d, r12d
mov qword [rcx + 0x20], r12
mov word [rcx + 0x10], r12w
add rcx, 0x30
call fcn.140055364
nop
lea rcx, [0x140077480]
call fcn.14005b1c0
mov r8, rax
lea rdx, [0x140077480]
lea rcx, [rdi + 8]
call fcn.140002280
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebp, eax
mov ecx, eax
add rcx, rcx
lea r8d, [r12 + 0x31]
lea rdx, str...CommonFileUtil.cpp
call fcn.140048afc
mov rbx, rax
cmp rax, r12
je 0x14004207b
mov rdx, rax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, rbx
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rdi + 8]
call fcn.140002280
mov rcx, rbx
call fcn.140048b24
nop
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1400440cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
lea r8, [0x140081000]
lea rdx, str.CLanguageSelector::GetMUIFallbackLangID
mov ecx, 5
call fcn.140009480
xor ebx, ebx
xor eax, eax
mov word [rsp + 0x28], bx
mov qword [rsp + 0x2a], rax
mov qword [rsp + 0x20], rbx
cmp rdi, rbx
je 0x140044176
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140044176
mov rcx, rdi
call fcn.140002494
mov rdi, rax
cmp rax, rbx
je 0x140044176
lea r9d, [rbx + 5]
lea r8, [rsp + 0x28]
lea edx, [rbx + 2]
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
je 0x140044164
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14005da0c
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [0x140081020]
jmp 0x14004417d
lea r8, [0x140081040]
lea rdx, str.CLanguageSelector::GetMUIFallbackLangID
mov ecx, 5
call fcn.140009480
mov ax, bx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005bad0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret