joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400015d4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov r8, rdx
mov ecx, 0x100000
xor edx, edx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenEventW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140001694
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x14000167a
mov eax, 0x800
test qword [0x14000a010], rax
je 0x14000167a
mov rcx, qword [0x14000a018]
and rcx, rax
cmp rcx, qword [0x14000a018]
jne 0x14000167a
lea rax, str.onecorexboxgameinput2published_svcgameinputservermanager.cpp
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x68], rax
lea rdx, [0x140007db6]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 0x17
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x140001685
mov eax, 0x8000ffff
jmp 0x1400016b7
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400016b7
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x140002280
Capabilities:
Check if file exists
Delete file

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x1400023b7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
je 0x1400023b7
cmp eax, 5
jne 0x14000233d
mov rdx, rdi
xor ecx, ecx
call fcn.140004c10
mov ebx, eax
test eax, eax
jns 0x1400023b7
cmp dword [section..data], 2
jbe 0x140002339
mov r8d, 0x800
test qword [0x14000a010], r8
je 0x140002339
mov rcx, qword [0x14000a018]
and rcx, r8
cmp rcx, qword [0x14000a018]
jne 0x140002339
mov dword [rbp + 0x28], eax
lea rdx, [0x140007d29]
lea rax, [0x1400075b8]
mov dword [rbp + 0x30], 0x78
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x1400023b9
test ebx, ebx
je 0x1400023a8
cmp dword [section..data], 2
jbe 0x1400023a8
mov r8d, 0x800
test qword [0x14000a010], r8
je 0x1400023a8
mov rax, qword [0x14000a018]
and rax, r8
cmp rax, qword [0x14000a018]
jne 0x1400023a8
lea rax, [0x1400075b8]
mov dword [rbp + 0x28], ebx
mov qword [rbp + 0x38], rax
lea rdx, [0x140007db6]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x30], 0x7c
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140001008
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400023b9
xor eax, eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x1400023c8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rdi, r8
mov ebx, 0x28
mov ecx, ebx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, qword gs:[0x60]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x1400024e9
mov r8d, ebx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x140002459
cmp eax, ebx
jne 0x14000244f
mov rcx, rsi
call fcn.140005f94
add ebx, ebx
jmp 0x1400023e8
mov qword [rdi], rsi
xor ebx, ebx
jmp 0x140002562
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov edi, eax
jbe 0x1400024ce
mov r8d, 0x800
test qword [0x14000a010], r8
je 0x1400024ce
mov rcx, qword [0x14000a018]
and rcx, r8
cmp rcx, qword [0x14000a018]
jne 0x1400024ce
mov dword [rbp + 0x28], eax
lea rdx, [0x140007db6]
lea rax, [0x1400075b8]
mov dword [rbp + 0x20], 0x95
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140001008
test edi, edi
jne 0x1400024d9
mov ebx, 0x8000ffff
jmp 0x140002555
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x140002555
cmp dword [section..data], 2
mov ebx, 0x8007000e
jbe 0x140002555
mov r8d, 0x800
test qword [0x14000a010], r8
je 0x140002555
mov rax, qword [0x14000a018]
and rax, r8
cmp rax, qword [0x14000a018]
jne 0x140002555
lea rax, [0x1400075b8]
mov dword [rbp + 0x28], ebx
mov qword [rbp + 0x38], rax
lea rdx, [0x140007d66]
lea rax, [rbp + 0x28]
mov dword [rbp + 0x20], 0x92
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call fcn.140001008
test rsi, rsi
je 0x140002562
mov rcx, rsi
call fcn.140005f94
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003150
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
lea rax, [0x14000a680]
mov rdi, rcx
lea rcx, [0x14000a658]
mov qword [0x14000a688], rax
mov qword [0x14000a680], rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
call fcn.1400045f0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
jne 0x1400031cb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14000331f
mov cl, 1
call fcn.1400025f4
test eax, eax
jns 0x1400031dd
xor ecx, ecx
call fcn.1400025f4
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_WTSGetActiveConsoleSessionId]
nop dword [rax + rax]
mov ecx, eax
call fcn.1400043f0
mov ebx, eax
test eax, eax
jns 0x140003264
cmp dword [section..data], 2
jbe 0x14000325d
mov r8d, 0x800
test qword [0x14000a010], r8
je 0x14000325d
mov rcx, qword [0x14000a018]
and rcx, r8
cmp rcx, qword [0x14000a018]
jne 0x14000325d
mov dword [rbp + 0x20], eax
lea rdx, [0x140007d29]
lea rax, str.onecorexboxgameinput2published_svc_service.cpp
mov dword [rbp + 0x28], 0x23b
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x14000331f
mov r8, rdi
lea rdx, [0x140002580]
lea rcx, str.GameInputSvc
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_RegisterServiceCtrlHandlerExW]
nop dword [rax + rax]
mov qword [rdi + 8], rax
test rax, rax
jne 0x14000331d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140003303
mov r8d, 0x800
test qword [0x14000a010], r8
je 0x140003303
mov rcx, qword [0x14000a018]
and rcx, r8
cmp rcx, qword [0x14000a018]
jne 0x140003303
mov dword [rbp + 0x20], eax
lea rdx, [0x140007db6]
lea rax, str.onecorexboxgameinput2published_svc_service.cpp
mov dword [rbp + 0x28], 0x23e
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x14000330e
mov eax, 0x8000ffff
jmp 0x14000331f
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x14000331f
xor eax, eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x14000363c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x14000375d
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14000371d
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14000370d
mov rcx, qword [rbx + 0x78]
mov edx, 0x5b4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
cmp dword [section..data], 2
jbe 0x14000370d
mov edx, 0x800
test qword [0x14000a010], rdx
je 0x14000370d
mov rax, qword [0x14000a018]
and rax, rdx
cmp rax, qword [0x14000a018]
jne 0x14000370d
lea rax, str.GameInput_Instance_timeout_during_Session_deletion
mov dword [rsp + 0x50], 0x45
mov qword [rsp + 0x58], rax
lea rdx, [0x140007e75]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140001168
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14000374d
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.140005f94
Function at 0x1400049a4
Capabilities:
Check if file exists
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x140004a62
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140004a45
mov r8d, 0x800
test qword [0x14000a010], r8
je 0x140004a45
mov rcx, qword [0x14000a018]
and rcx, r8
cmp rcx, qword [0x14000a018]
jne 0x140004a45
mov dword [rbp + 0x28], eax
lea rdx, [0x140007db6]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rbp - 0x10], 0x5d
mov qword [rbp - 8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x140004a53
mov eax, 0x8000ffff
jmp 0x140004ae0
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x140004ae0
mov r8, rdi
mov rcx, rbx
call fcn.140004814
mov ebx, eax
test eax, eax
jns 0x140004ade
cmp dword [section..data], 2
jbe 0x140004ada
mov r8d, 0x800
test qword [0x14000a010], r8
je 0x140004ada
mov rcx, qword [0x14000a018]
and rcx, r8
cmp rcx, qword [0x14000a018]
jne 0x140004ada
mov dword [rbp + 0x28], eax
lea rdx, [0x140007d29]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rbp - 0x10], 0x62
mov qword [rbp - 8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x140004ae0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1400056c0
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x40], 0
mov rbx, rcx
je 0x140005753
mov rax, qword [rcx]
cmp dword [rax], 0
jne 0x140005723
mov rax, qword [rcx + 8]
cmp dword [rax], 0
je 0x140005701
mov rdx, qword [rcx + 0x18]
mov r8d, 1
mov rcx, qword [rcx + 0x10]
mov rdx, qword [rdx]
call qword [sym.imp.api_ms_win_core_file_l2_1_0.dll_MoveFileExW]
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
cmp dword [rax], 0
je 0x140005723
mov r8, qword [rbx + 0x30]
mov rax, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x18]
mov r8, qword [r8]
mov edx, dword [rax]
mov rcx, qword [rcx]
call fcn.1400049a4
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000573b
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax]
test rcx, rcx
je 0x140005753
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
add rsp, 0x20
pop rbx
ret
Function at 0x140005984
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r15, rcx
mov rcx, qword [rdx]
mov r12, rdx
mov qword [rdx], rbx
test rcx, rcx
je 0x1400059b9
call fcn.140005f94
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x140005ae5
or rcx, 0xffffffffffffffff
test r15, r15
je 0x1400059ec
mov rbp, rcx
inc rbp
cmp word [r15 + rbp*2], bx
jne 0x1400059e0
jmp 0x1400059ef
mov rbp, rbx
lea rax, [r14 + 1]
mov rdi, r14
add rax, rbp
test r15, r15
cmovne rdi, rax
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, qword gs:[0x60]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140005a3c
mov ebx, 0x8007000e
jmp 0x140005adc
mov edx, edi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov edi, eax
lea rax, [r14 - 1]
cmp rdi, rax
jne 0x140005aca
mov r14, rbx
test rdi, rdi
je 0x140005a7e
movzx ecx, word [rsi + r14*2]
call qword [sym.imp.ntdll.dll_towlower]
nop dword [rax + rax]
mov word [rsi + r14*2], ax
inc r14
cmp r14, rdi
jb 0x140005a60
test r15, r15
je 0x140005ab7
mov eax, 0x5c
mov r14, rbx
mov word [rsi + rdi*2], ax
inc rdi
test rbp, rbp
je 0x140005ab7
movzx ecx, word [r15 + r14*2]
call qword [sym.imp.ntdll.dll_towlower]
nop dword [rax + rax]
mov word [rsi + rdi*2], ax
inc r14
inc rdi
cmp r14, rbp
jb 0x140005a97
mov word [rsi + rdi*2], bx
mov rcx, qword [r12]
mov qword [r12], rsi
test rcx, rcx
je 0x140005adc
jmp 0x140005ad7
mov rcx, rsi
test rdi, rdi
je 0x140005ae0
mov ebx, 0x8000ffff
call fcn.140005f94
mov eax, ebx
jmp 0x140005b0b
call fcn.140005f94
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jne 0x140005afe
mov eax, 0x8000ffff
jmp 0x140005b0b
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140005da8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rcx]
xor esi, esi
mov r15d, edx
mov r14, rcx
nop
test ebp, ebp
jne 0x140005f58
lea rdi, [rcx + 0x28]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov ebp, dword [r14]
test ebp, ebp
jne 0x140005f49
lea eax, [r15 - 1]
cmp eax, 1
ja 0x140005f49
lea rax, str.GameInputInbox.dll
mov qword [rsp + 0x60], rsi
cmp r15d, 1
lea rcx, str.GameInputRedist.dll
lea rdx, [rsp + 0x60]
cmove rcx, rax
call fcn.140005984
mov ebx, eax
test eax, eax
jns 0x140005e56
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140005e40
call fcn.140005f94
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140005f6e
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140005f35
test eax, 0x550
jne 0x140005f35
mov rcx, rbx
call fcn.140005b34
test eax, eax
js 0x140005f35
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x140005f35
mov rcx, rax
call fcn.140005ce8
test al, al
je 0x140005f26
lea rdx, str.GameInputCreate
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x140005f26
lea rdx, str.DllCanUnloadNow
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x140005f26
lea rdx, str.DllGetClassObject
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x140005f26
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x20], rbp
jmp 0x140005f35
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
nop
mov dword [r14], r15d
mov ebp, r15d
test rbx, rbx
je 0x140005f49
mov rcx, rbx
call fcn.140005f94
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp ebp, r15d
jne 0x140005f69
cmp qword [r14 + 0x20], rsi
sete sil
mov eax, esi
jmp 0x140005f6e
mov eax, 0x8000ffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140006478
Capabilities:
Check for peb beingdebugged flag
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov rax, qword gs:[0x60]
movzx eax, byte [rax + 2]
test eax, eax
jne 0x1400064ab
mov eax, 0x2d4
add rax, 0x7ffe0000
movzx eax, byte [rax]
and eax, 3
cmp eax, 3
jne 0x1400064ac
int3
lea rcx, [0x14000a690]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
nop dword [rax + rax]
mov rax, qword [rsp + 0x28]
mov qword [0x14000a788], rax
lea rax, [rsp + 0x28]
add rax, 8
mov qword [0x14000a728], rax
mov dword [0x14000ab60], 0x40000015
mov dword [0x14000ab64], 1
mov qword [0x14000ab68], 0
mov rax, qword [0x14000a788]
mov qword [0x14000ab70], rax
mov dword [0x14000ab78], 2
movsxd rax, dword [rsp + 0x30]
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x14000ab80]
mov qword [rdx + rcx], rax
mov eax, dword [rsp + 0x38]
mov ecx, 8
imul rcx, rcx, 1
lea rdx, [0x14000ab80]
mov qword [rdx + rcx], rax
mov r8d, 2
lea rdx, [0x14000a690]
lea rcx, [0x14000ab60]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_2.dll_RaiseFailFastException]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
nop dword [rax + rax]
add rsp, 0x28
ret

Function at 0x14000659c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov byte [0x14000a656], dil
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140006674
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x14000665a
test byte [0x14000a010], 2
je 0x14000665a
mov rcx, qword [0x14000a018]
and ecx, 2
cmp rcx, qword [0x14000a018]
jne 0x14000665a
mov dword [rsp + 0x40], eax
lea rdx, [0x140007fc7]
lea rax, str.onecorexboxgameinput2commonPlatformInfo.cpp
mov dword [rsp + 0x44], 0x17
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x140006665
mov eax, 0x8000ffff
jmp 0x1400066d9
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400066d9
lea r8, [rsp + 0x50]
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
inc rax
cmp word [rcx + rax*2], di
jne 0x140006682
movsxd rcx, eax
mov ebx, 1
test eax, eax
js 0x1400066b6
cmp word [rsp + rcx*2 + 0x50], 0x5c
je 0x1400066a8
sub eax, ebx
sub rcx, rbx
jns 0x140006697
jmp 0x1400066b6
inc eax
lea r8, [rsp + 0x50]
movsxd rcx, eax
lea r8, [r8 + rcx*2]
lea rdx, str.dwm.exe
mov rcx, r8
call sub.ntdll.dll__wcsicmp
movzx ecx, byte [0x14000a656]
test eax, eax
cmove ecx, ebx
xor eax, eax
mov byte [0x14000a656], cl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140006c70
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x140006a64
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.140006704
xor edi, edi
test eax, eax
js 0x140006c10
call fcn.1400060f8
call fcn.140005fc8
test eax, eax
js 0x140006c10
cmp qword [0x14000a020], rdi
mov rax, qword [0x14000a008]
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [rsp + 0xa0], xmm0
je 0x140006ac6
lea ecx, [rdi + 5]
int 0x29
xorps xmm0, xmm0
lea r9, [0x14000a020]
lea r8, [section..data]
lea rdx, [0x140001350]
lea rcx, [rsp + 0xa0]
movdqu xmmword [0x14000a028], xmm0
call qword [sym.imp.ntdll.dll_EtwEventRegister]
nop dword [rax + rax]
test eax, eax
jne 0x140006b31
mov rax, qword [0x14000a5f8]
test rax, rax
je 0x140006b31
mov r8, qword [0x14000a008]
movzx r9d, word [r8]
movabs r10, 0xd1313e1f72571970
mov rcx, qword [0x14000a020]
mov edx, 2
call qword [0x140007500]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
mov rbx, rax
mov dl, dil
movzx eax, word [rax]
test ax, ax
je 0x140006b89
movzx ecx, ax
cmp cx, 0x20
ja 0x140006b5b
movzx eax, cx
test dl, dl
je 0x140006b84
cmp cx, 0x22
jne 0x140006b66
test dl, dl
sete dl
add rbx, 2
movzx eax, word [rbx]
movzx ecx, ax
test ax, ax
jne 0x140006b4e
jmp 0x140006b84
cmp ax, 0x20
ja 0x140006b89
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140006b77
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop dword [rax + rax]
lea rdx, str._install
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140006bce
lea rdx, str._uninstall
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006bd5
mov ebx, 0x80004001
jmp 0x140006c06
mov r8d, 0x17
lea rdx, str.GlobalGameInputSession
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006bff
mov rcx, rbx
call fcn.140005760
jmp 0x140006c04
call fcn.140003424
mov ebx, eax
call fcn.140006970
shr ebx, 0x1f
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140006c70
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
sub rsp, 0x28
call 0x140006df0
add rsp, 0x28
jmp 0x140006a64
Function at 0x1400027c0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp qword [rsi], rdi
je 0x140002817
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.140002820
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140002807
mov qword [rsi], rdi
call fcn.14001f620
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.14001f720
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret