joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800963d0
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x180120040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov ecx, dword [0x180148094]
cmp dword [0x18014a588], ecx
cmovg ecx, dword [0x18014a588]
test ecx, ecx
js 0x18009641b
lea r9, str.GetProcessWindow_calledK...
mov r8d, 0x49
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICImGuiutilsutils.cpp
xor ecx, ecx
call fcn.1800aae50
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
lea rcx, [0x180096350]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x180096585
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], rbp
movabs rbp, 0x7fffffffffffffff
mov qword [rsp + 0x100], rsi
movabs rsi, 0x431bde82d7b634db
mov qword [rsp + 0x108], rdi
movabs rdi, 0x4e94914effff
mov qword [rsp + 0xe0], r14
movabs r14, 0x7ffffffff4143dfe
lea rdx, [rsp + 0x30]
lea rcx, [0x180096350]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [0x180148094]
cmp dword [0x18014a588], ecx
cmovg ecx, dword [0x18014a588]
test ecx, ecx
js 0x1800964d8
lea r9, str.____Waiting_for_window_to_appear._n
mov r8d, 0x4f
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICImGuiutilsutils.cpp
xor ecx, ecx
call fcn.1800aae50
lea rcx, [rsp + 0x38]
call fcn.180009f30
mov rax, qword [rsp + 0x38]
lea rbx, [rax + 0xbebc200]
cmp rax, r14
jle 0x1800964f6
mov rbx, rbp
lea rcx, [rsp + 0x40]
call fcn.180009f30
mov rax, qword [rsp + 0x40]
cmp rbx, rax
je 0x18009654f
jl 0x18009654f
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jg 0x180096543
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x18009653a
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1800964f6
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1800964f6
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180096494
mov r14, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
mov r8d, 0x80
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [0x180148094]
cmp dword [0x18014a588], ecx
cmovg ecx, dword [0x18014a588]
test ecx, ecx
js 0x1800965d2
lea rax, [rsp + 0x50]
mov r8d, 0x55
lea r9, str.Got_window_with_name:__s_n
mov qword [rsp + 0x20], rax
lea rdx, str.C:UsersTOTOMAN2_source_reposWOLF2_QOLS_PUBLICImGuiutilsutils.cpp
xor ecx, ecx
call fcn.1800aae50
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1800ad580
add rsp, 0xe8
ret
Function at 0x1800a62f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800a6341
mov qword [0x18014a878], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov r9, qword [0x18014a878]
lea r8, [0x1800a5020]
xor eax, eax
mov dword [0x18014aea8], 6
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800a6341
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1800ac840
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x180120040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbp, rdx
mov rsi, rcx
mov ecx, 0x104
call fcn.1800add64
mov rdi, rax
mov qword [rsp + 0x40], rax
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x1800ac8b0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180002e20
nop
mov ecx, 0x104
call fcn.1800add64
mov r14, rax
mov qword [rsp + 0x48], rax
cmp qword [rsi + 0x18], 0xf
jbe 0x1800ac8e4
mov rsi, qword [rsi]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, rsi
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_PathCombineA]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800ac901
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180005450
nop
mov rcx, r14
call fcn.1800ad954
test rbp, rbp
je 0x1800ac950
lea rax, [rsp + 0x20]
cmp rbp, rax
je 0x1800ac950
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rbp
call fcn.180005450
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1800ac9aa
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800ac9a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800ac9a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ad954
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rcx, rdi
call fcn.1800ad954
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800ad580
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1800acdb4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800acdee
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800acdf3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800ace3c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800b50f0]
cmp byte [rcx + rax], 0
je 0x1800ace3c
dec r8
sub rdx, 1
jne 0x1800ace22
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140002930
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140002a90
cmp dword [rsp + 0x20], 2
jl 0x140002a90
lea rcx, [rsp + 0x38]
call fcn.140003220
mov dword [rsp + 0x40], 1
jmp 0x140002992
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x40], eax
jge 0x140002a4a
movsxd rax, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x48]
call fcn.140003240
lea rdx, [0x140058aac]
lea rcx, [rsp + 0x48]
call fcn.140003520
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0xffffffff
je 0x140002a0e
lea rdx, [0x140058ab0]
lea rcx, [rsp + 0x48]
call fcn.140003460
movsxd r11, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + r11*8]
lea rcx, [rsp + 0x48]
call fcn.1400034e0
lea rdx, [0x140058ab4]
lea rcx, [rsp + 0x48]
call fcn.1400034e0
mov eax, dword [rsp + 0x40]
add eax, 1
cmp eax, dword [rsp + 0x20]
jge 0x140002a2c
lea rdx, [0x140058ab8]
lea rcx, [rsp + 0x48]
call fcn.1400034e0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.1400034a0
lea rcx, [rsp + 0x48]
call fcn.1400038b0
jmp 0x140002987
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x38]
call fcn.1400326d0
mov r8, rax
mov edx, 0x410
lea rcx, [0x140067130]
call fcn.140003f30
lea rax, [0x140067130]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.1400038b0
mov rax, qword [rsp + 0x50]
jmp 0x140002aa5
cmp qword [rsp + 0x28], 0
je 0x140002aa3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x68
ret
Function at 0x140004990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x40], rax
movzx edx, word [rsp + 0x68]
lea r8, [0x140058dc0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400049df
xor eax, eax
jmp 0x140004a9d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140004a01
xor eax, eax
jmp 0x140004a9d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140004a22
xor eax, eax
jmp 0x140004a9d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
cmp qword [rsp + 0x20], 0
je 0x140004a55
cmp dword [rsp + 0x28], 0
jne 0x140004a59
xor eax, eax
jmp 0x140004a9d
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.1400040f0
test eax, eax
jne 0x140004a75
xor eax, eax
jmp 0x140004a9d
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
call fcn.140043120
mov r11, qword [rsp + 0x78]
mov eax, dword [rsp + 0x28]
mov dword [r11], eax
mov eax, 1
add rsp, 0x58
ret
Function at 0x1400053d0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2c0
mov rax, qword [0x140065840]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x2d0]
call fcn.14000d250
test rax, rax
jne 0x14000541a
xor eax, eax
jmp 0x14000563c
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x2d8]
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.140003f30
lea r8, str.Baymax64.Ini
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.140003fa0
cmp dword [rsp + 0x2e0], 0
jne 0x140005484
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140005484
mov eax, 1
jmp 0x14000563c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 7
mov edx, 0xc0000000
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x1400054cd
xor eax, eax
jmp 0x14000563c
mov byte [rsp + 0x60], 0xff
mov byte [rsp + 0x61], 0xfe
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, 2
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str._BAYMAX64__r_n
lea rcx, [rsp + 0x50]
call fcn.140003240
lea rcx, [rsp + 0x50]
call fcn.140006550
movsxd rdi, eax
shl rdi, 1
lea rcx, [rsp + 0x50]
call fcn.1400326d0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, edi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.1400286a0
lea rdx, [rsp + 0x298]
mov rcx, qword [rsp + 0x2d0]
call fcn.14000c0c0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000fa30
movzx eax, al
test eax, eax
je 0x140005615
lea rcx, [rsp + 0x290]
call fcn.140003220
lea rcx, [rsp + 0x40]
call fcn.140021180
mov r8, qword [rax]
lea rdx, str._s_r_n
lea rcx, [rsp + 0x290]
call fcn.1400057e0
lea rcx, [rsp + 0x290]
call fcn.140006550
movsxd rdi, eax
shl rdi, 1
lea rcx, [rsp + 0x290]
call fcn.1400326d0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, edi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x40]
call fcn.140006790
lea rcx, [rsp + 0x290]
call fcn.1400038b0
jmp 0x14000555f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x2a8], eax
lea rcx, [rsp + 0x50]
call fcn.1400038b0
mov eax, dword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400434f0
add rsp, 0x2c0
pop rdi
ret
Function at 0x14000ab40
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rcx, qword [rsp + 0x90]
call fcn.14000ad20
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000abac
xor eax, eax
jmp 0x14000ad12
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x54], eax
cmp qword [rsp + 0xa0], 0
je 0x14000ac07
mov rcx, qword [rsp + 0xa0]
mov eax, dword [rsp + 0x54]
mov dword [rcx], eax
cmp dword [rsp + 0x40], 0
jne 0x14000ace5
cmp dword [rsp + 0x54], 0xa00000
jge 0x14000ace5
cmp dword [rsp + 0x54], 6
jle 0x14000ace5
mov eax, dword [rsp + 0x54]
add eax, 4
mov dword [rsp + 0x60], eax
movsxd rcx, dword [rsp + 0x60]
call fcn.1400435b8
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14000ace5
movsxd r8, dword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.140044740
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000acc8
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x64], eax
jne 0x14000acc8
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.14000ae10
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x50], 1
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.140043510
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
add rsp, 0x88
ret
Function at 0x140010520
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x690
mov rax, qword [0x140065840]
xor rax, rsp
mov qword [rsp + 0x680], rax
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rsp + 0x480]
call fcn.140001000
mov rcx, qword [rsp + 0x6a8]
call fcn.1400326d0
mov rdx, rax
lea rcx, [rsp + 0x4e0]
call fcn.140010b80
mov rcx, rax
call fcn.1400326d0
lea rdx, [0x140059614]
mov rcx, rax
call fcn.140044dc4
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x4e0]
call fcn.140010bd0
cmp qword [rsp + 0x58], 0
jne 0x1400105d6
mov dword [rsp + 0x568], 0
mov rcx, qword [rsp + 0x6a8]
call fcn.1400038b0
mov eax, dword [rsp + 0x568]
jmp 0x1400106c4
mov r9, qword [rsp + 0x58]
mov r8d, 0x400
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.140044c6c
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x14001061a
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x480]
call fcn.140001060
jmp 0x1400105d6
mov rcx, qword [rsp + 0x58]
call fcn.1400448d8
mov qword [rsp + 0x58], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x480]
call fcn.1400027f0
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x21
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0x20
mov r9d, dword [rsp + 0x50]
lea r8, [rsp + 0x28]
mov edx, 0x10
lea rcx, [rsp + 0x60]
call fcn.140010380
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x570]
call fcn.140010c00
mov rcx, rax
call fcn.1400326d0
mov rdx, rax
mov rcx, qword [rsp + 0x6b0]
call fcn.140003460
lea rcx, [rsp + 0x570]
call fcn.140010bd0
mov dword [rsp + 0x678], 1
mov rcx, qword [rsp + 0x6a8]
call fcn.1400038b0
mov eax, dword [rsp + 0x678]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1400434f0
add rsp, 0x690
pop rdi
ret
Function at 0x1400106f0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xa0
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x140010755
mov eax, dword [rsp + 0x5c]
jmp 0x140010893
mov dword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0x19000
jae 0x140010782
cmp dword [rsp + 0x58], 0
je 0x14001078b
mov eax, dword [rsp + 0x5c]
jmp 0x140010893
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140003220
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
call fcn.140003240
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0xb0]
call fcn.140010520
test eax, eax
jne 0x1400107f6
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x80], eax
lea rcx, [rsp + 0x50]
call fcn.1400038b0
mov eax, dword [rsp + 0x80]
jmp 0x140010893
lea rcx, [rsp + 0x50]
call fcn.1400326d0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb0]
call fcn.14001ad30
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0xb0]
call fcn.140028070
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140028870
movzx eax, al
test eax, eax
je 0x140010877
lea rcx, [rsp + 0x50]
call fcn.1400326d0
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140021160
mov rdx, rbx
mov rcx, rax
call fcn.1400109f0
test eax, eax
jne 0x14001086b
mov dword [rsp + 0x5c], 1
jmp 0x140010877
lea rcx, [rsp + 0x40]
call fcn.140028850
jmp 0x140010812
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x98], eax
lea rcx, [rsp + 0x50]
call fcn.1400038b0
mov eax, dword [rsp + 0x98]
add rsp, 0xa0
pop rbx
ret
Function at 0x1400108b0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
call fcn.140011940
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400108fa
mov dword [rsp + 0x48], 1
lea rcx, [rsp + 0x28]
call fcn.140011970
mov eax, dword [rsp + 0x48]
jmp 0x1400109e7
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.1400119e0
test eax, eax
jne 0x140010912
jmp 0x1400109b7
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.140010a50
lea rdx, [0x140059668]
lea rcx, [rsp + 0x38]
call fcn.140006850
test eax, eax
je 0x140010957
lea rdx, str.Baymax_Patcher_Tools
lea rcx, [rsp + 0x38]
call fcn.140006850
test eax, eax
je 0x140010957
lea rcx, [rsp + 0x38]
call fcn.1400038b0
jmp 0x1400109b7
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.140010a90
lea rdx, [0x1400596c0]
lea rcx, [rsp + 0x40]
call fcn.140006850
test eax, eax
je 0x140010991
lea rcx, [rsp + 0x40]
call fcn.1400038b0
lea rcx, [rsp + 0x38]
call fcn.1400038b0
jmp 0x1400109b7
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x40]
call fcn.1400038b0
lea rcx, [rsp + 0x38]
call fcn.1400038b0
xor eax, eax
test eax, eax
jne 0x1400108fa
cmp dword [rsp + 0x20], 0
jne 0x1400109d1
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.1400106f0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x28]
call fcn.140011970
mov eax, dword [rsp + 0x4c]
add rsp, 0x58
ret

Function at 0x1400119e0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x58]
call fcn.140043628
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x140011a19
xor eax, eax
jmp 0x140011ad9
mov ecx, dword [rsp + 0x34]
call fcn.1400435b8
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov qword [rcx], rax
mov r9, qword [rsp + 0x50]
mov r9, qword [r9]
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x140011a61
mov rcx, qword [rsp + 0x50]
call fcn.140011990
xor eax, eax
jmp 0x140011ad9
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
lea rdx, str.VarFileInfoTranslation
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x140011a91
mov rcx, qword [rsp + 0x50]
call fcn.140011990
xor eax, eax
jmp 0x140011ad9
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
and rax, 0xffff
movzx ecx, ax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax]
and rax, 0xffff
movzx eax, ax
and rax, 0xffff
movzx eax, ax
shl eax, 0x10
or ecx, eax
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], ecx
mov eax, 1
add rsp, 0x48
ret
Function at 0x140012240
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xa8]
mov dword [rax], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x68], 0x200
movsxd rcx, dword [rsp + 0x68]
call fcn.1400435b8
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400122d3
jmp 0x1400123b7
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x200
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140012307
jmp 0x1400123b7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x60]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x140012343
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x140012345
jmp 0x1400123b7
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x18]
cmp eax, 0x10b
jne 0x140012371
mov dword [rsp + 0x3c], 0
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x28]
mov dword [rcx], eax
jmp 0x1400123a5
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x1400123a5
mov dword [rsp + 0x3c], 1
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x28]
mov dword [rcx], eax
mov dword [rsp + 0x48], 1
xor eax, eax
test eax, eax
jne 0x1400122a5
cmp qword [rsp + 0x30], 0
je 0x1400123dc
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x78]
call fcn.140043518
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x48]
add rsp, 0x88
ret