joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cad00
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
call fcn.1400cac60
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rdx, [0x1400c94d0]
lea rcx, [0x1401d0cd8]
call fcn.1400a1490
mov ecx, dword [0x1401c3790]
cmp ecx, 0xffffffff
je 0x1400cad44
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x30
pop rbx
ret

Function at 0x1400caf90
Capabilities:
Get thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rbx, r8
mov rbp, rdx
mov ecx, dword [0x1401c3790]
cmp ecx, 0xffffffff
je 0x1400cafd6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x1400caff4
call fcn.1400cad00
mov ecx, dword [0x1401c3790]
cmp ecx, 0xffffffff
jne 0x1400cafeb
xor r12d, r12d
jmp 0x1400caff4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbp + 8]
mov qword [rsp + 0x30], rdi
test rdi, rdi
je 0x1400cb019
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x1400cb031
lock inc dword [rdi + 8]
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x58], rbx
test rdi, rdi
je 0x1400cb06a
lock dec dword [rdi + 8]
jne 0x1400cb065
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1400cb065
mov rdi, qword [rsp + 0x30]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
jmp 0x1400cb06a
mov rdi, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x60]
call fcn.1400c98c0
nop
mov rdx, rax
lea rcx, [r12 + 0x20]
call fcn.1400c99b0
mov r8, rax
xor r9d, r9d
lea rdx, [rsp + 0x38]
lea rcx, [r12 + 0x20]
call fcn.1400c9cf0
nop
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x1400cb0d2
lock dec dword [rbx + 8]
jne 0x1400cb0cd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1400cb0cd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x1400cb0fd
lock dec dword [rdi + 8]
jne 0x1400cb0fd
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1400cb0fd
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
nop
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x1400cb124
lock dec dword [rbx + 8]
jne 0x1400cb124
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lock dec dword [rbx + 0xc]
jne 0x1400cb124
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400cb140
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, dword [0x1401c3790]
cmp ecx, 0xffffffff
je 0x1400cb15f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400cb18a
call fcn.1400cad00
mov ecx, dword [0x1401c3790]
cmp ecx, 0xffffffff
jne 0x1400cb184
xor eax, eax
lea rdx, [rsp + 0x30]
lea rcx, [rax + 0x20]
call fcn.1400ca120
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rcx, [rax + 0x20]
lea rdx, [rsp + 0x30]
call fcn.1400ca120
add rsp, 0x28
ret

Function at 0x1400d6728
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1401d0fd0]
test rcx, rcx
jne 0x1400d667f
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x1400d6678
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400d66aa
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x1400d6674
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x1401d0fd0], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x1400d671d
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400d66cd
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x1401d0fd0]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x1400d66fa
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x1400d671d
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x1401d0fd0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x1400d6701
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x1400d6604
Function at 0x1400d774f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401c7ef8]
jne 0x1400d6f9a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400d6f96
repz ret
ror rcx, 0x10
jmp 0x1400d76a8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1401d1130]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1401d1228]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400d772d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1401d1130]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400d774f
mov rax, qword [rsp + 0x88]
mov qword [0x1401d1228], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1401d11c8], rax
mov rax, qword [0x1401d1228]
mov qword [0x1401d10a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1401d11b0], rax
mov dword [0x1401d1090], 0xc0000409
mov dword [0x1401d1094], 1
mov rax, qword [0x1401c7ef8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401c7f00]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1401d1128], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140131a20]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1401d1128], 0
jne 0x1400d77d6
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400d8550
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e8]
sub rsp, 0x2e8
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1401c7ef8]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r15, r9
mov rax, r8
mov r14, rdx
mov rsi, rcx
mov r12, qword [rbp + 0x250]
mov r13, qword [rbp + 0x258]
mov qword [rsp + 0x40], 7
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400065e0
nop
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1400d8626
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + rdi*2 - 2], 0x5c
je 0x1400d861d
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + rdi*2 - 2], 0x2f
je 0x1400d861d
lea rax, [rsp + 0x28]
cmp rdx, 8
cmovae rax, rcx
cmp word [rax + rdi*2 - 2], 0x3a
jne 0x1400d8626
lea rdx, [0x140131c20]
jmp 0x1400d862d
lea rdx, [0x140131c18]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x28]
call fcn.140039f20
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x1400d869f
mov qword [r14], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400d868f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1400d868f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1400cb6b0
mov dword [rsi], ebx
mov qword [rsi + 8], rax
jmp 0x1400d876a
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x54]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x54]
mov rcx, r15
call fcn.1400067c0
mov edx, dword [rbp - 0x80]
bt edx, 0xa
jae 0x1400d86d5
mov dword [r12], ebx
mov dword [r13], ebx
jmp 0x1400d875f
test dl, 0x10
je 0x1400d86ec
mov dword [r12], 3
mov dword [r13], 3
jmp 0x1400d86fc
mov dword [r12], 2
mov dword [r13], 2
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x54]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x50]
call fcn.1400067c0
nop
mov edx, dword [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.1400d8260
mov dword [r12 + 4], eax
cmp qword [rsp + 0x68], 8
jb 0x1400d8756
mov rcx, qword [rsp + 0x50]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, dword [r12 + 4]
mov dword [r13 + 4], eax
mov dword [rsi], ebx
call fcn.1400cb6b0
mov qword [rsi + 8], rax
cmp qword [rsp + 0x40], 8
jb 0x1400d877c
mov rcx, qword [rsp + 0x28]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, rsi
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400d6f80
add rsp, 0x2e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400d8e90
Capabilities:
Delete directory
Delete file

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rax, qword [0x1401c7ef8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r8
mov rbx, rcx
cmp edx, 1
jne 0x1400d8eda
test r8, r8
je 0x1400d8ed3
mov dword [r8], 0
call fcn.1400cb6b0
mov qword [rdi + 8], rax
xor al, al
jmp 0x1400d8fe0
cmp edx, 3
je 0x1400d8f63
cmp edx, 0xb
je 0x1400d8f63
mov qword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
mov r8d, 0x19
lea rdx, str.boost::filesystem::remove
lea rcx, [rsp + 0x28]
call fcn.1400082f0
nop
cmp qword [rbx + 0x18], 8
jb 0x1400d8f23
mov rcx, qword [rbx]
jmp 0x1400d8f26
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
sete cl
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbx
call fcn.1400d8dc0
movzx ebx, al
cmp qword [rsp + 0x40], 0x10
jb 0x1400d8f5b
mov rcx, qword [rsp + 0x28]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
test bl, bl
je 0x1400d8fde
xor al, al
jmp 0x1400d8fe0
mov qword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x28], 0
mov r8d, 0x19
lea rdx, str.boost::filesystem::remove
lea rcx, [rsp + 0x28]
call fcn.1400082f0
nop
cmp qword [rbx + 0x18], 8
jb 0x1400d8f9e
mov rcx, qword [rbx]
jmp 0x1400d8fa1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
test al, al
sete cl
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbx
call fcn.1400d8dc0
movzx ebx, al
cmp qword [rsp + 0x40], 0x10
jb 0x1400d8fd6
mov rcx, qword [rsp + 0x28]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
test bl, bl
jne 0x1400d8ed3
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400d6f80
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x1400d9160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 8
mov rsi, rdx
mov rdi, rcx
jb 0x1400d917f
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400d91ae
lea rcx, [rsp + 0x30]
mov r8, rsi
mov rdx, rdi
call fcn.1400d9000
mov eax, dword [rax]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x1400d91c2
mov dword [rsi], 0
call fcn.1400cb6b0
mov qword [rsi + 8], rax
bt ebx, 0xa
jae 0x1400d9209
mov rcx, rdi
call fcn.1400d7b30
test al, al
je 0x1400d91f4
test bl, 0x10
mov eax, 4
mov ecx, reloc.WS2_32.dll_inet_addr
cmovne eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 9
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x40]
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d9370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1401c7ef8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r12, r8
mov rbx, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x1400d93b4
mov rcx, qword [rdx]
jmp 0x1400d93b7
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x1400d93d7
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.1400d9000
jmp 0x1400d9514
xor r13d, r13d
bt eax, 0xa
jae 0x1400d94d2
cmp qword [rbx + 0x18], 8
jb 0x1400d93f0
mov rdx, qword [rbx]
jmp 0x1400d93f3
mov rdx, rbx
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r13
mov word [rsp + 0x50], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.1400067c0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x68], 8
jb 0x1400d9474
mov rcx, qword [rsp + 0x50]
call sub.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r13
mov word [rsp + 0x50], r13w
cmp rdi, 0xffffffffffffffff
jne 0x1400d949f
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.1400d9000
nop
jmp 0x1400d9514
mov rcx, rbx
call fcn.1400d7b30
test al, al
jne 0x1400d94c9
mov edx, ebp
mov rcx, rbx
call fcn.1400d8260
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400d9514
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x1400d94e5
mov dword [r12], r13d
call fcn.1400cb6b0
mov qword [r12 + 8], rax
mov edx, ebp
mov rcx, rbx
test bpl, 0x10
mov dword [rsp + 0x40], 3
jne 0x1400d9500
mov dword [rsp + 0x40], 2
call fcn.1400d8260
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsi], rax
mov rax, rsi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400d6f80
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d9540
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
jb 0x1400d9569
mov rcx, qword [rdx]
jmp 0x1400d956c
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400d9589
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.1400d9000
jmp 0x1400d95f3
test rbp, rbp
je 0x1400d959e
mov dword [rbp], 0
call fcn.1400cb6b0
mov qword [rbp + 8], rax
mov rcx, rdi
bt esi, 0xa
jae 0x1400d95c7
call fcn.1400d7b30
mov edx, esi
mov rcx, rdi
mov dword [rsp + 0x38], 4
test al, al
jne 0x1400d95df
mov dword [rsp + 0x38], 9
jmp 0x1400d95df
mov edx, esi
mov dword [rsp + 0x38], 3
test sil, 0x10
jne 0x1400d95df
mov dword [rsp + 0x38], 2
call fcn.1400d8260
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
mov rax, qword [rax]
mov qword [rbx], rax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400d9a20
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0xe0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1401c7ef8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, rdx
mov rsi, rcx
cmp qword [rcx + 0x18], 8
jb 0x1400d9a5e
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400d9a85
test rbx, rbx
je 0x1400d9a7e
mov dword [rbx], 0
call fcn.1400cb6b0
mov qword [rbx + 8], rax
mov al, 1
jmp 0x1400d9b50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov dword [rsp + 0x20], 0
call fcn.1400cb6b0
mov qword [rsp + 0x28], rax
cmp ebp, 0xb7
jne 0x1400d9ad4
lea r8, [rsp + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400d9370
cmp dword [rax], 3
jne 0x1400d9ad4
test rbx, rbx
je 0x1400d9b4e
mov dword [rbx], 0
call fcn.1400cb6b0
jmp 0x1400d9b4a
test rbx, rbx
jne 0x1400d9b43
mov qword [rsp + 0x58], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x40], bl
lea r8d, [rbx + 0x23]
lea rdx, str.boost::filesystem::create_directory
lea rcx, [rsp + 0x40]
call fcn.1400082f0
nop
mov dword [rsp + 0x20], ebp
call fcn.1400cb6b0
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r9, [rsp + 0x20]
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.1400d8c70
lea rdx, [0x1401878a0]
lea rcx, [rsp + 0x70]
call sub.MSVCR100.dll__CxxThrowException
nop
call fcn.1400cb6b0
mov dword [rbx], ebp
mov qword [rbx + 8], rax
xor al, al
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400d6f80
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x1400f0690
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r14, r8
mov r12, rcx
lea r8, [rax - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400f0829
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rsi, [rsp + 0x30]
mov rax, qword [rsp + 0xa0]
test rax, rax
cmovne rsi, rax
mov rbp, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
test rdi, rdi
je 0x1400f0706
test rbp, rbp
je 0x1400f0706
mov r15d, dword [rdi]
jmp 0x1400f0709
mov r15d, ebx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbp
mov r9, rsi
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13d, eax
mov qword [rsp + 0x48], rbx
test rbp, rbp
jne 0x1400f0777
test rdi, rdi
je 0x1400f0777
mov ecx, dword [rdi]
add rcx, 4
call fcn.1400d6a4c
mov rbp, rax
test rax, rax
je 0x1400f0756
xor ecx, ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov rbx, rbp
mov rbp, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rbx
mov r9, rsi
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
cmp rcx, r12
je 0x1400f0787
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
jne 0x1400f0791
jmp 0x1400f081e
mov eax, dword [rsi]
cmp eax, 1
je 0x1400f07a4
cmp eax, 7
je 0x1400f07a4
cmp eax, 2
je 0x1400f07a4
jmp 0x1400f081e
mov r9d, dword [rdi]
shr r9, 1
xor r10d, r10d
mov ecx, r10d
cmp eax, 7
sete cl
inc rcx
lea r8, [r9 - 1]
test r8, r8
js 0x1400f07eb
lea rdx, [rbp + r8*2]
sub r8, rcx
nop word [rax + rax]
test rcx, rcx
je 0x1400f07eb
cmp word [rdx], r10w
jne 0x1400f07eb
dec rcx
sub rdx, 2
lea rax, [r8 + rcx]
test rax, rax
jns 0x1400f07d0
lea eax, [rcx + rcx]
add dword [rdi], eax
cmp r15d, dword [rdi]
jae 0x1400f080d
mov edi, 0xea
test rbx, rbx
cmovne edi, r10d
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, edi
jmp 0x1400f0829
test rcx, rcx
je 0x1400f081e
lea rdi, [rbp + r9*2]
movzx eax, r10w
rep stosw word [rdi], ax
mov rcx, rbx
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, r13d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400f2680
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rsi
push r13
push r14
push r15
sub rsp, 0x70
mov rcx, qword [rdx]
xor ebx, ebx
mov r13, r8
mov r15, r9
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x8000080
xor r14b, r14b
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400f2836
mov qword [rsp + 0xa0], rbp
xor edx, edx
mov rcx, rax
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebp, eax
mov dword [rsp + 0xa8], ebx
call fcn.1400d6a4c
lea r9, [rsp + 0xa8]
mov r8d, 0x400
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbx
mov r12, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f276b
nop dword [rax + rax]
mov ecx, dword [rsp + 0xa8]
test ecx, ecx
je 0x1400f276b
cmp ebx, ebp
ja 0x1400f276b
add rdi, rcx
add ebx, ecx
lea r9, [rsp + 0xa8]
mov r8d, 0x400
mov rcx, rsi
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400f2730
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa0]
test eax, eax
jne 0x1400f2826
cmp byte [rsp + 0xc0], al
je 0x1400f27fa
lea rcx, [rsp + 0x40]
call fcn.1400f3990
lea rcx, [rsp + 0x40]
mov r8d, ebx
mov rdx, r12
call fcn.1400f3ba0
mov eax, dword [rsp + 0x64]
lea ecx, [rax + 1]
mov dword [r15], eax
call fcn.1400d6a4c
xor edx, edx
mov qword [r13], rax
mov r8d, dword [r15]
mov rcx, rax
inc r8d
call sub.MSVCR100.dll_memset
mov ebx, dword [r15]
lea rcx, [rsp + 0x40]
call fcn.1400f3a10
mov rcx, qword [r13]
mov r8d, ebx
mov rdx, rax
call sub.MSVCR100.dll_memcpy
lea rcx, [rsp + 0x40]
mov r14b, 1
call fcn.1400f39c0
jmp 0x1400f2826
lea ecx, [rbx + 1]
call fcn.1400d6a4c
mov rdx, r12
mov qword [r13], rax
mov dword [r15], ebx
mov rcx, qword [r13]
mov ebx, ebx
mov r8d, ebx
call sub.MSVCR100.dll_memcpy
mov r11, qword [r13]
mov r14b, 1
mov byte [rbx + r11], 0
mov rcx, r12
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
mov r12, qword [rsp + 0xb8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r14b
add rsp, 0x70
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret