joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003b040
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x150
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r12, rcx
test rcx, rcx
jne 0x18003b06a
xor eax, eax
jmp 0x18003b1f3
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x170], rbp
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x148], rsi
mov ebx, 1
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x140], rdi
call fcn.180043ef0
lea rcx, [rsp + 0x20]
mov r8d, 0x103
mov rdx, r12
call fcn.180046480
lea edx, [rbx + 0x5b]
lea rcx, [rsp + 0x20]
call fcn.18004660c
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rsi, rax
xor eax, eax
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x18003b115
cmp byte [rsp + 0x20], 0x5c
jne 0x18003b115
cmp byte [rsp + 0x21], 0x5c
jne 0x18003b115
lea edx, [rbx + 0x5b]
lea rcx, [rsp + 0x22]
call fcn.18004660c
test rax, rax
je 0x18003b191
lea rcx, [rax + 1]
lea edx, [rbx + 0x5b]
call fcn.18004660c
mov rsi, rax
test rsi, rsi
je 0x18003b191
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov byte [rsi], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, eax
mov edi, eax
and ebp, 0x10
jne 0x18003b15c
test al, 1
je 0x18003b14b
mov edx, eax
lea rcx, [rsp + 0x20]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test eax, eax
je 0x18003b1d1
cmp edi, 0xffffffff
je 0x18003b165
test ebp, ebp
jne 0x18003b174
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
test ebx, ebx
je 0x18003b1d1
lea rcx, [rsi + 1]
mov edx, 0x5c
mov byte [rsi], 0x5c
call fcn.18004660c
mov rsi, rax
test rax, rax
jne 0x18003b120
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18003b1c4
test al, 0x10
jne 0x18003b1d1
test al, 1
je 0x18003b1b5
and eax, 0xfffffffe
mov rcx, r12
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebx, eax
test eax, eax
je 0x18003b1d1
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
mov rdi, qword [rsp + 0x140]
mov rsi, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x170]
mov eax, ebx
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x150
pop r12
ret
Function at 0x18003b210
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push r12
sub rsp, 0x260
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r12, rcx
test rcx, rcx
jne 0x18003b23a
xor eax, eax
jmp 0x18003b3f3
mov qword [rsp + 0x278], rbx
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x250], rdi
mov qword [rsp + 0x248], r13
lea rcx, [rsp + 0x22]
mov qword [rsp + 0x240], r14
xor r14d, r14d
xor edx, edx
mov r8d, 0x206
mov ebx, 1
mov word [rsp + 0x20], r14w
call fcn.180043ef0
lea rcx, [rsp + 0x20]
mov r8d, 0x103
mov rdx, r12
call fcn.180043e60
mov r13d, 0x5c
lea rcx, [rsp + 0x20]
mov edx, r13d
call fcn.180045ec0
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
mov rsi, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 2
jbe 0x18003b302
cmp word [rsp + 0x20], r13w
jne 0x18003b302
cmp word [rsp + 0x22], r13w
jne 0x18003b302
lea rcx, [rsp + 0x24]
mov edx, r13d
call fcn.180045ec0
test rax, rax
je 0x18003b381
lea rcx, [rax + 2]
mov edx, r13d
call fcn.180045ec0
mov rsi, rax
test rsi, rsi
je 0x18003b381
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov word [rsi], r14w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
mov edi, eax
and ebp, 0x10
jne 0x18003b34d
test al, 1
je 0x18003b33c
mov edx, eax
lea rcx, [rsp + 0x20]
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x18003b3c1
cmp edi, 0xffffffff
je 0x18003b356
test ebp, ebp
jne 0x18003b365
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x18003b3c1
lea rcx, [rsi + 2]
mov edx, r13d
mov word [rsi], r13w
call fcn.180045ec0
mov rsi, rax
test rax, rax
jne 0x18003b310
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003b3b4
test al, 0x10
jne 0x18003b3c1
test al, 1
je 0x18003b3a5
and eax, 0xfffffffe
mov rcx, r12
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
je 0x18003b3c1
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
mov r14, qword [rsp + 0x240]
mov r13, qword [rsp + 0x248]
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rbp, qword [rsp + 0x280]
mov eax, ebx
mov rbx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x260
pop r12
ret
Function at 0x18003b410
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x18003b444
lea ecx, [rbx + 0x57]
mov dword [0x18013f60c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18003b46a
test al, 0x10
jne 0x18003b4aa
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x18003b4aa
mov rcx, rbx
call fcn.18003b040
test eax, eax
jne 0x18003b4aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18013f60c], eax
test eax, eax
je 0x18003b49d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x18003b4b9
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18003b4d0
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test rcx, rcx
jne 0x18003b504
lea ecx, [rbx + 0x57]
mov dword [0x18013f60c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003b52a
test al, 0x10
jne 0x18003b56a
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x18003b56a
mov rcx, rbx
call fcn.18003b210
test eax, eax
jne 0x18003b56a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18013f60c], eax
test eax, eax
je 0x18003b55d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test edi, edi
je 0x18003b579
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18003d920
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x18003d949
lea ecx, [rbx + 0x57]
mov dword [0x18013f60c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x18003d7a0]
lea edx, [r9 + 0x20]
call fcn.18003ba90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ebx, eax
test eax, eax
jne 0x18003d99a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18013f60c], eax
test eax, eax
je 0x18003d99a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18003d9b0
Capabilities:
Delete directory
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x18003d9d9
lea ecx, [rbx + 0x57]
mov dword [0x18013f60c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop rbx
ret
xor r9d, r9d
lea r8, [0x18003d860]
lea edx, [r9 + 0x20]
call fcn.18003bc00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
test eax, eax
jne 0x18003da2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18013f60c], eax
test eax, eax
je 0x18003da2a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18003f140
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov rsi, r8
mov edi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x1800385a4
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.180038270
jmp 0x1800385aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x18013f60c], eax
test eax, eax
je 0x1800385be
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x180038540
Function at 0x18003f490
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x140
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
call fcn.180036cb0
test eax, eax
je 0x180038a6d
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800388e0
jmp 0x180038ae4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x180038ac3
lea rdx, [0x1800d1c40]
lea rcx, [rsp + 0x20]
mov r8d, 0x103
call fcn.18004bcd0
lea r8, [rsp + 0x20]
mov r9, rsi
mov edx, edi
mov rcx, rbx
call fcn.180038270
jmp 0x180038ac9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x18013f60c], eax
test eax, eax
je 0x180038add
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x140
pop rdi
pop rsi
pop rbx
ret
jmp 0x180038a30

Function at 0x18003f710
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x18003f826
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x18003f796
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.180038030
test eax, eax
je 0x18003f812
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.180043ef0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.18003ec90
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18003f812
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180046480
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.180038270
jmp 0x18003f82c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x18013f60c], eax
test eax, eax
je 0x18003f842
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x18003f710
Function at 0x180040600
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800e2b68]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18004070c
lea rcx, [rsp + 0x20]
call fcn.180038030
test eax, eax
je 0x1800406f3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.180043ef0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.18003ec90
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800406eb
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180046480
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.180038270
mov eax, 1
jmp 0x18004070e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180040600

Function at 0x180040870
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800e2b98]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18004097c
lea rcx, [rsp + 0x20]
call fcn.180038030
test eax, eax
je 0x180040963
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.180043ef0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.18003ec90
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18004095b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180046480
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.180038270
mov eax, 1
jmp 0x18004097e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180040870
Function at 0x180041620
Capabilities:
Check if file exists
Move file

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x150
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x1800417f1
test rdx, rdx
je 0x1800417f1
xor edx, edx
call fcn.180039d90
test eax, eax
jne 0x18004167f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18013f60c], eax
test eax, eax
je 0x18004167b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800416eb
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x148], r12
mov rcx, rbx
mov qword [rsp + 0x140], r13
xor r12d, r12d
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea r13d, [r12 + 1]
cmp eax, 0xffffffff
je 0x1800416bd
test al, 0x10
jne 0x1800416bd
mov r12d, r13d
test r12b, al
cmovne edi, r13d
test r13b, bpl
je 0x180041706
test r12d, r12d
je 0x180041706
mov dword [0x18013f60c], 0x50
xor eax, eax
mov r12, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x180]
mov r13, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x150
pop rsi
pop rbp
pop rbx
ret
test bpl, 2
je 0x18004171c
test edi, edi
je 0x18004171c
mov dword [0x18013f60c], 5
jmp 0x1800416d1
cmp eax, 0xffffffff
je 0x180041734
mov rcx, rbx
test al, 0x10
je 0x18004172f
call fcn.18003d920
jmp 0x180041734
call fcn.18003a2b0
mov rdx, rbx
mov rcx, rsi
mov dword [0x18013f60c], 0
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
test eax, eax
jne 0x1800417cd
test bpl, 4
jne 0x1800417d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1800417d4
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], dil
call fcn.180043ef0
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
call fcn.180037d70
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18003a980
test eax, eax
jne 0x1800417b5
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.18003b410
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x18013f60c], eax
test eax, eax
je 0x1800417cd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
jmp 0x1800416d3
test bpl, 8
je 0x1800417b5
mov rdx, rbx
mov rcx, rsi
call fcn.18003a820
test eax, eax
je 0x1800417b5
mov eax, r13d
jmp 0x1800416d3
mov ecx, 0x57
mov dword [0x18013f60c], 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800416eb
jmp 0x180041620
Function at 0x180042480
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x250
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
mov r12, r8
mov ebp, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
test eax, eax
je 0x18003f826
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
test ecx, ecx
je 0x18003f796
lea eax, [rcx - 1]
mov ecx, eax
movzx eax, byte [rsp + rax + 0x20]
cmp byte [rsp + rcx + 0x20], 0x5c
cmove eax, ebx
mov byte [rsp + rcx + 0x20], al
lea rcx, [rsp + 0x20]
call fcn.180038030
test eax, eax
je 0x18003f812
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x130], bl
call fcn.180043ef0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.18003ec90
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18003f812
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180046480
mov byte [rsp + rdi + 0x20], bl
lea r8, [rsp + 0x20]
mov r9, r12
mov edx, ebp
mov rcx, rsi
call fcn.180038270
jmp 0x18003f82c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [0x18013f60c], eax
test eax, eax
je 0x18003f842
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x250
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
jmp 0x18003f710

Function at 0x180042900
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800e2b68]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18004070c
lea rcx, [rsp + 0x20]
call fcn.180038030
test eax, eax
je 0x1800406f3
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.180043ef0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.18003ec90
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x1800406eb
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180046480
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.180038270
mov eax, 1
jmp 0x18004070e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180040600
Function at 0x1800429c0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x250
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov rbp, r8
mov esi, edx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x20], 0
call fcn.180043ef0
lea rdx, [rsp + 0x20]
lea rcx, [0x1800e2b98]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x102
ja 0x18004097c
lea rcx, [rsp + 0x20]
call fcn.180038030
test eax, eax
je 0x180040963
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x288], rdi
mov byte [rsp + 0x130], 0
call fcn.180043ef0
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.18003ec90
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp ecx, 0x104
jge 0x18004095b
movsxd rdi, ecx
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.180046480
mov byte [rsp + rdi + 0x20], 0
mov rdi, qword [rsp + 0x288]
lea r8, [rsp + 0x20]
mov r9, rbp
mov edx, esi
mov rcx, rbx
call fcn.180038270
mov eax, 1
jmp 0x18004097e
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x250
pop rsi
pop rbp
pop rbx
ret
jmp 0x180040870