joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bcb40
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800bcb69
lea ecx, [rbx + 0x57]
mov dword [0x1801b0670], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800bcba6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800bcba6
test al, 0x10
jne 0x1800bcba6
test al, 1
je 0x1800bcb61
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1800bcbc0
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800bcce8
test rdx, rdx
jne 0x1800bcbfd
test r8, r8
je 0x1800bcce8
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x140], 0
call fcn.18007ead0
lea r8, str._s_s
lea rcx, [rsp + 0x140]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], rbx
call fcn.1801134c4
lea rcx, [rsp + 0x140]
xor edx, edx
call fcn.1800bc5a0
test eax, eax
jne 0x1800bcc60
mov dword [0x1801b0670], 2
lea ecx, [rax + 2]
jmp 0x1800bccf7
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x30], 0
call fcn.18007ead0
lea r8, str._s_s
lea rcx, [rsp + 0x30]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], rdi
call fcn.1801134c4
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1800bc5a0
test eax, eax
je 0x1800bccb6
mov dword [0x1801b0670], 0xb7
mov ecx, VariantTimeToSystemTime
jmp 0x1800bccf7
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1800bcce1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800bccfd
mov ecx, eax
jmp 0x1800bccf7
mov eax, 1
jmp 0x1800bccff
mov dword [0x1801b0670], 0x57
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800bcd20
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x460
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800bce85
test rdx, rdx
jne 0x1800bcd5d
test r8, r8
je 0x1800bce85
mov qword [rsp + 0x498], rbp
lea rcx, [rsp + 0x242]
xor ebp, ebp
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x240], bp
call fcn.18007ead0
lea r8, [0x18012b288]
lea rcx, [rsp + 0x240]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], rbx
call fcn.18007e030
lea rcx, [rsp + 0x240]
xor edx, edx
call fcn.1800bc610
test eax, eax
jne 0x1800bcdf0
mov dword [0x1801b0670], 2
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbp, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x460
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], bp
call fcn.18007ead0
lea r8, [0x18012b288]
lea rcx, [rsp + 0x30]
mov r9, rsi
mov edx, 0x103
mov qword [rsp + 0x20], rdi
call fcn.18007e030
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1800bc610
test eax, eax
je 0x1800bce49
mov dword [0x1801b0670], 0xb7
mov ecx, VariantTimeToSystemTime
jmp 0x1800bcdc5
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x1800bce7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800bcdcb
mov ecx, eax
jmp 0x1800bcdc5
mov eax, 1
jmp 0x1800bcdcd
mov ecx, 0x57
mov dword [0x1801b0670], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800bcdd5
Function at 0x1800bd850
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x150
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r12, rcx
test rcx, rcx
jne 0x1800bd87a
xor eax, eax
jmp 0x1800bda03
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x170], rbp
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x148], rsi
mov ebx, 1
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x140], rdi
call fcn.18007ead0
lea rcx, [rsp + 0x20]
mov r8d, 0x103
mov rdx, r12
call fcn.18007fb60
lea edx, [rbx + 0x5b]
lea rcx, [rsp + 0x20]
call fcn.18007fcec
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rsi, rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x1800bd925
cmp byte [rsp + 0x20], 0x5c
jne 0x1800bd925
cmp byte [rsp + 0x21], 0x5c
jne 0x1800bd925
lea edx, [rbx + 0x5b]
lea rcx, [rsp + 0x22]
call fcn.18007fcec
test rax, rax
je 0x1800bd9a1
lea rcx, [rax + 1]
lea edx, [rbx + 0x5b]
call fcn.18007fcec
mov rsi, rax
test rsi, rsi
je 0x1800bd9a1
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov byte [rsi], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, eax
mov edi, eax
and ebp, 0x10
jne 0x1800bd96c
test al, 1
je 0x1800bd95b
mov edx, eax
lea rcx, [rsp + 0x20]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test eax, eax
je 0x1800bd9e1
cmp edi, 0xffffffff
je 0x1800bd975
test ebp, ebp
jne 0x1800bd984
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
test ebx, ebx
je 0x1800bd9e1
lea rcx, [rsi + 1]
mov edx, VarDateFromDisp
mov byte [rsi], VarDateFromDisp
call fcn.18007fcec
mov rsi, rax
test rax, rax
jne 0x1800bd930
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800bd9d4
test al, 0x10
jne 0x1800bd9e1
test al, 1
je 0x1800bd9c5
and eax, 0xfffffffe
mov rcx, r12
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test eax, eax
je 0x1800bd9e1
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
mov rdi, qword [rsp + 0x140]
mov rsi, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x170]
mov eax, ebx
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x150
pop r12
ret
Function at 0x1800bda20
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x260
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r12, rcx
test rcx, rcx
jne 0x1800bda4a
xor eax, eax
jmp 0x1800bdc03
mov qword [rsp + 0x278], rbx
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x248], r13
lea rcx, [rsp + 0x22]
mov qword [rsp + 0x240], r14
xor r14d, r14d
xor edx, edx
mov r8d, 0x206
mov ebx, 1
mov word [rsp + 0x20], r14w
call fcn.18007ead0
lea rcx, [rsp + 0x20]
mov r8d, 0x103
mov rdx, r12
call fcn.18007ea70
mov r13d, VarDateFromDisp
lea rcx, [rsp + 0x20]
mov edx, r13d
call fcn.18007fd08
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rsi, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x1800bdb12
cmp word [rsp + 0x20], r13w
jne 0x1800bdb12
cmp word [rsp + 0x22], r13w
jne 0x1800bdb12
lea rcx, [rsp + 0x24]
mov edx, r13d
call fcn.18007fd08
test rax, rax
je 0x1800bdb91
lea rcx, [rax + 2]
mov edx, r13d
call fcn.18007fd08
mov rsi, rax
test rsi, rsi
je 0x1800bdb91
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov word [rsi], r14w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
mov edi, eax
and ebp, 0x10
jne 0x1800bdb5d
test al, 1
je 0x1800bdb4c
mov edx, eax
lea rcx, [rsp + 0x20]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x1800bdbd1
cmp edi, 0xffffffff
je 0x1800bdb66
test ebp, ebp
jne 0x1800bdb75
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x1800bdbd1
lea rcx, [rsi + 2]
mov edx, r13d
mov word [rsi], r13w
call fcn.18007fd08
mov rsi, rax
test rax, rax
jne 0x1800bdb20
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800bdbc4
test al, 0x10
jne 0x1800bdbd1
test al, 1
je 0x1800bdbb5
and eax, 0xfffffffe
mov rcx, r12
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x1800bdbd1
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
mov r14, qword [rsp + 0x240]
mov r13, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rbp, qword [rsp + 0x280]
mov eax, ebx
mov rbx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x260
pop r12
ret
Function at 0x1800bdc20
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1800bdc54
lea ecx, [rbx + 0x57]
mov dword [0x1801b0670], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1800bdc7a
test al, 0x10
jne 0x1800bdcba
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1800bdcba
mov rcx, rbx
call fcn.1800bd850
test eax, eax
jne 0x1800bdcba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800bdcad
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1800bdcc9
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800bdce0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x1800bdd14
lea ecx, [rbx + 0x57]
mov dword [0x1801b0670], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800bdd3a
test al, 0x10
jne 0x1800bdd7a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1800bdd7a
mov rcx, rbx
call fcn.1800bda20
test eax, eax
jne 0x1800bdd7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800bdd6d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x1800bdd89
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800bf1f0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800bf219
lea ecx, [rbx + 0x57]
mov dword [0x1801b0670], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800bf070]
lea edx, [r9 + 0x20]
call fcn.1800be2a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test eax, eax
jne 0x1800bf26a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800bf26a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800bf280
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800bf2a9
lea ecx, [rbx + 0x57]
mov dword [0x1801b0670], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x1800bf130]
lea edx, [r9 + 0x20]
call fcn.1800be410
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x1800bf2fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800bf2fa
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800c05b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.18007ead0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1800bae7a
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bab40
jmp 0x1800bae80
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800bae96
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18007e1e0
mov rbx, qword [rsp + 0x278]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret
jmp 0x1800bae10
Function at 0x1800c05f0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x240
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbp, r8
mov esi, edx
mov rbx, rcx
call fcn.1800d0860
test eax, eax
je 0x1800bb370
mov r8, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bb1b0
jmp 0x1800bb3fa
mov qword [rsp + 0x278], rdi
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.18007ead0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800bb3d0
lea rdx, [0x18012b270]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.180113594
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bab40
jmp 0x1800bb3d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800bb3ec
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete dil
mov eax, edi
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x240
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800bb330

Function at 0x1800c0770
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.18007ead0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1800c0884
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800c07f1
lea eax, [rcx - 1]
cmp word [rsp + rax*2 + 0x20], 0x5c
jne 0x1800c07f1
mov word [rsp + rax*2 + 0x20], bx
lea rcx, [rsp + 0x20]
call fcn.1800ba970
test eax, eax
je 0x1800c0870
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], bx
call fcn.18007ead0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c03d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c0870
movsxd rdi, ecx
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18007ea70
mov word [rsp + rdi*2 + 0x20], bx
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.1800bab40
jmp 0x1800c088a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800c08a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x450
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c0770
Function at 0x1800c0f10
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x458
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
call fcn.18007ead0
lea rdx, [rsp + 0x20]
lea rcx, str.ALLUSERSPROFILE
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x1800c1025
lea rcx, [rsp + 0x20]
call fcn.1800ba970
test eax, eax
je 0x1800c100c
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x450], rdi
mov word [rsp + 0x230], r12w
call fcn.18007ead0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c03d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c1004
movsxd rdi, ecx
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18007ea70
mov word [rsp + rdi*2 + 0x20], r12w
mov rdi, qword [rsp + 0x450]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bab40
mov eax, 1
jmp 0x1800c1027
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x458
pop r12
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c0f10

Function at 0x1800c1180
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x458
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
call fcn.18007ead0
lea rdx, [rsp + 0x20]
lea rcx, [0x18012ef88]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x1800c1295
lea rcx, [rsp + 0x20]
call fcn.1800ba970
test eax, eax
je 0x1800c127c
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x450], rdi
mov word [rsp + 0x230], r12w
call fcn.18007ead0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c03d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c1274
movsxd rdi, ecx
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18007ea70
mov word [rsp + rdi*2 + 0x20], r12w
mov rdi, qword [rsp + 0x450]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bab40
mov eax, 1
jmp 0x1800c1297
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x458
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800c2cb0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x450
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bx
call fcn.18007ead0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1800c0884
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x1800c07f1
lea eax, [rcx - 1]
cmp word [rsp + rax*2 + 0x20], 0x5c
jne 0x1800c07f1
mov word [rsp + rax*2 + 0x20], bx
lea rcx, [rsp + 0x20]
call fcn.1800ba970
test eax, eax
je 0x1800c0870
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x230], bx
call fcn.18007ead0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c03d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c0870
movsxd rdi, ecx
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18007ea70
mov word [rsp + rdi*2 + 0x20], bx
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.1800bab40
jmp 0x1800c088a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x1801b0670], eax
test eax, eax
je 0x1800c08a0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x450
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c0770

Function at 0x1800c2cf0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x458
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x22]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
call fcn.18007ead0
lea rdx, [rsp + 0x20]
lea rcx, str.ALLUSERSPROFILE
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x1800c1025
lea rcx, [rsp + 0x20]
call fcn.1800ba970
test eax, eax
je 0x1800c100c
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x450], rdi
mov word [rsp + 0x230], r12w
call fcn.18007ead0
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.1800c03d0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800c1004
movsxd rdi, ecx
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.18007ea70
mov word [rsp + rdi*2 + 0x20], r12w
mov rdi, qword [rsp + 0x450]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.1800bab40
mov eax, 1
jmp 0x1800c1027
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18007e1e0
add rsp, 0x458
pop r12
pop rsi
pop rbp
pop rbx
ret
jmp 0x1800c0f10