joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015da4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [rcx]
mov rsi, rdx
mov rax, qword [rax + 0xd0]
call qword [0x14002f5e0]
xor ebp, ebp
mov ebx, eax
test eax, eax
je 0x140015e09
mov ecx, eax
call fcn.14001ab20
mov qword [rsp + 0x30], rax
lea r8, str.base_stor_vss_tests_betestutils.cpp
lea rax, str.pvbc__SaveAsXML_bstrXML_
mov dword [rsp + 0x28], ebx
mov r9d, 0x1db
mov qword [rsp + 0x20], rax
lea rdx, str._nError_in__S__d_:__n_t__Call__S_not_succeeded.__n_t__Error_code__0x_08lx._Error_description___s_n
lea ecx, [rbp + 1]
call fcn.14001a9f8
lea r14, [0x14004a4b0]
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], bp
jne 0x140015e14
test rax, rax
je 0x140015ec5
mov rcx, qword [rsi]
test rcx, rcx
jne 0x140015e33
mov edi, ebp
jmp 0x140015e3b
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov edi, eax
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140015e98
mov rdx, qword [rsi]
lea r8d, [rdi*2 + 2]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x140015eb0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_save_backup_document:_SaveBackupDocument_returned_error__d_n
call sub.msvcrt.dll_wprintf
xor eax, eax
jmp 0x140015eca
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, r14
lea rcx, str.Backup_document_saved_successfully_in__s_n
call sub.msvcrt.dll_wprintf
mov eax, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140016548
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rdi
push r12
push r15
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov sil, r8b
mov rbp, rcx
xor r15d, r15d
mov qword [rax + 0x10], r15
or rdi, 0xffffffffffffffff
test rdx, rdx
jne 0x140016583
mov eax, r15d
jmp 0x140016590
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140016586
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.14000a054
lea r12, [0x140039b84]
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r15w
jne 0x1400165a7
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14000a054
xor edx, edx
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [rsp + 0x20], sil
mov r9d, 0x3e8
lea r8, [0x140039b90]
mov rdx, rbx
mov rcx, rbp
call fcn.140016c08
mov byte [rsp + 0x20], sil
mov r9d, 0x3e8
lea r8, [0x140039b98]
mov rdx, rbx
mov rcx, rbp
call fcn.140016c08
lea rdx, [0x140039ba0]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140016615
mov r8d, eax
lea rcx, [rsp + 0x68]
call fcn.14000a054
xor edx, edx
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [rsp + 0x20], sil
mov r9d, 0x2710
lea r8, [0x140039b90]
mov rdx, rbx
mov rcx, rbp
call fcn.140016c08
mov byte [rsp + 0x20], sil
mov r9d, 0x2710
lea r8, [0x140039b98]
mov rdx, rbx
mov rcx, rbp
call fcn.140016c08
mov rax, rdi
inc rax
cmp word [r12 + rax*2], r15w
jne 0x140016679
mov r8d, eax
mov rdx, r12
lea rcx, [rsp + 0x68]
call fcn.14000a054
xor edx, edx
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [rsp + 0x20], sil
mov r9d, 0x186a0
lea r8, [0x140039b90]
mov rdx, rbx
mov rcx, rbp
call fcn.140016c08
mov byte [rsp + 0x20], sil
mov r9d, 0x186a0
lea r8, [0x140039b98]
mov rdx, rbx
mov rcx, rbp
call fcn.140016c08
inc rdi
cmp word [rbx + rdi*2], r15w
jne case.default.0x140016751
mov eax, 0x63
mov word [rbx + rdi*2 - 2], ax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [rsp + 0x20], sil
mov edi, 0xa
mov r9d, edi
lea r8, [0x140039b90]
mov rdx, rbx
mov rcx, rbp
call fcn.140016c08
mov byte [rsp + 0x20], sil
mov r9d, edi
lea r8, [0x140039b98]
mov rdx, rbx
mov rcx, rbp
call fcn.140016c08
nop
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rdi
jmp qword [sym.imp.OLEAUT32.dll_SysStringLen]
Function at 0x1400167dc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, 0x400
lea rcx, str._SystemDrive_
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edi, edi
test eax, eax
jne 0x140016825
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
lea rdx, str.ExpandEnvironmentStrings_failed_with_error__d._n
or ecx, 0x80070000
mov r8d, eax
test eax, eax
cmovle ecx, eax
call fcn.14001aa8c
sub rbx, 2
lea rbx, [rbx + 2]
cmp word [rbx], di
jne 0x140016829
movups xmm0, xmmword [str.BETESTWRITERFILES]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140039060]
movups xmmword [rbx + 0x10], xmm1
mov eax, dword [0x140039070]
mov dword [rbx + 0x20], eax
movzx eax, word [0x140039074]
mov word [rbx + 0x24], ax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140016c08
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov r14d, r9d
mov rbp, r8
mov rdi, rcx
xor r12d, r12d
mov qword [rax + 0x10], r12
or r13, 0xffffffffffffffff
test rdx, rdx
jne 0x140016c45
mov eax, r12d
jmp 0x140016c52
mov rax, r13
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140016c48
mov r8d, eax
lea rcx, [rsp + 0x88]
call fcn.14000a054
lea rdx, [0x14003f0d0]
mov rax, r13
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140016c6c
mov r8d, eax
lea rcx, [rsp + 0x88]
call fcn.14000a054
test rbp, rbp
jne 0x140016c90
mov eax, r12d
jmp 0x140016c9e
mov rax, r13
inc rax
cmp word [rbp + rax*2], r12w
jne 0x140016c93
mov r8d, eax
mov rdx, rbp
lea rcx, [rsp + 0x88]
call fcn.14000a054
cmp byte [rsp + 0xa0], r12b
je 0x140016d0e
mov eax, dword [rdi + 0x28]
cmp eax, dword [rdi + 0x2c]
jne 0x140016d0e
lea ecx, [rax + 4]
mov eax, 8
mul rcx
cmovo rax, r13
lea rdx, [0x14003ef00]
mov rcx, rax
call fcn.14002c89c
mov rbx, rax
mov r8d, dword [rdi + 0x28]
shl r8, 3
mov rdx, qword [rdi + 0x20]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rdi + 0x20]
call fcn.14002bfcc
mov qword [rdi + 0x20], rbx
mov eax, dword [rdi + 0x28]
add eax, 4
mov dword [rdi + 0x2c], eax
mov rbx, r14
lea rdx, [0x14003ef00]
mov rcx, r14
call fcn.14002c89c
mov rsi, rax
test rax, rax
jne 0x140016d39
lea rdx, str.Out_of_memory._n
mov ecx, 0x8007000e
call fcn.14001aa8c
movzx ecx, word [rbp]
add ecx, r14d
test r14d, r14d
je 0x140016d55
mov rax, rsi
mov byte [rax], cl
inc ecx
inc rax
sub rbx, 1
jne 0x140016d48
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, r13
jne 0x140016db6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.14002bfcc
movzx ecx, bx
or ecx, 0x80070000
test ebx, ebx
cmovle ecx, ebx
mov r8d, ebx
lea rdx, str.CreateFile_failed_due_to_error__d._n
call fcn.14001aa8c
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x98]
mov r8d, r14d
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140016de0
cmp dword [rsp + 0x98], r14d
je 0x140016e16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call fcn.14002bfcc
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, bx
or ecx, 0x80070000
test ebx, ebx
cmovle ecx, ebx
mov r8d, ebx
lea rdx, str.Write_file_failed_due_to_error__d._n
call fcn.14001aa8c
mov rcx, rsi
call fcn.14002bfcc
cmp byte [rsp + 0xa0], r12b
je 0x140016e38
mov ecx, dword [rdi + 0x28]
mov rax, qword [rdi + 0x20]
mov qword [rax + rcx*8], rbp
inc dword [rdi + 0x28]
jmp 0x140016e42
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140017a90
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x860
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [rsp + 0x50]
call fcn.1400167dc
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, dword [rdi + 0x14]
xor r9d, r9d
mov rax, qword [rsi]
not edx
and edx, 1
mov byte [rsp + 0x28], 0
inc edx
mov dword [rsp + 0x20], 3
xor r8d, r8d
mov rcx, rsi
mov rax, qword [rax + 0x30]
call qword [0x14002f5e0]
mov ebx, eax
test eax, eax
je 0x140017b3e
mov ecx, eax
call fcn.14001ab20
mov qword [rsp + 0x30], rax
lea r8, str.base_stor_vss_tests_betestcwriter.cpp
lea rax, str.pMetadata__SetRestoreMethod___m_lRestoreTestOptions__x_RestoreTestOptions_RestoreIfNotThere____VSS_RME_RESTORE_IF_NOT_THERE_:_VSS_RME_RESTORE_IF_CAN_REPLACE__NULL__NULL__VSS_WRE_ALWAYS__false_
mov dword [rsp + 0x28], ebx
mov r9d, 0x26f
mov qword [rsp + 0x20], rax
lea rdx, str._nError_in__S__d_:__n_t__Call__S_not_succeeded.__n_t__Error_code__0x_08lx._Error_description___s_n
mov ecx, 1
call fcn.14001a9f8
and dword [rsp + 0x48], 0
lea rax, [0x140039148]
mov byte [rsp + 0x40], 1
lea r9, [rsp + 0x50]
mov byte [rsp + 0x38], 1
lea r8, [0x140039160]
mov qword [rsp + 0x30], rax
mov rdx, rsi
lea rax, [0x140039158]
mov rcx, rdi
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call fcn.14001686c
and dword [rsp + 0x48], 0
lea rax, [0x140039168]
mov byte [rsp + 0x40], 1
lea r8, [0x140039174]
mov byte [rsp + 0x38], 0
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov rdx, rsi
lea rax, [0x140036530]
mov rcx, rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
call fcn.14001686c
and dword [rsp + 0x48], 0
lea rcx, [0x140039178]
mov byte [rsp + 0x40], 1
lea r9, [rsp + 0x50]
mov byte [rsp + 0x38], 1
lea r8, [0x140039190]
mov qword [rsp + 0x30], rcx
mov rdx, rsi
lea rcx, [0x140039188]
mov qword [rsp + 0x28], rcx
mov rcx, rdi
and qword [rsp + 0x20], 0
call fcn.14001686c
mov al, 1
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.14002c700
lea r11, [rsp + 0x860]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14001a6bc
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rcx
xor r14d, r14d
mov qword [rax + 0x10], r14
or rdi, 0xffffffffffffffff
test rdx, rdx
jne 0x14001a6f1
mov eax, r14d
jmp 0x14001a6fe
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14001a6f4
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.14000a054
lea rdx, str.ALTB
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14001a715
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.14000a054
mov ebx, 0x3e8
mov r9d, ebx
lea r8, [0x140039b90]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140018654
mov r9d, ebx
lea r8, [0x140039b98]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140018654
lea rdx, [0x140039ba0]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14001a769
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.14000a054
mov ebx, 0x2710
mov r9d, ebx
lea r8, [0x140039b90]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140018654
mov r9d, ebx
lea r8, [0x140039b98]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140018654
lea rdx, [0x140039b84]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14001a7bd
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.14000a054
xor edx, edx
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r9d, 0x186a0
lea r8, [0x140039b90]
mov rdx, rbx
mov rcx, rsi
call fcn.140018654
mov r9d, 0x186a0
lea r8, [0x140039b98]
mov rdx, rbx
mov rcx, rsi
call fcn.140018654
inc rdi
cmp word [rbx + rdi*2], r14w
jne case.default.0x14001a87a
mov eax, 0x63
mov word [rbx + rdi*2 - 2], ax
lea edi, [rax - 0x59]
mov r9d, edi
lea r8, [0x140039b90]
mov rdx, rbx
mov rcx, rsi
call fcn.140018654
mov r9d, edi
lea r8, [0x140039b98]
mov rdx, rbx
mov rcx, rsi
call fcn.140018654
lea rcx, str.Component_b_is_verified._n
call sub.msvcrt.dll_wprintf
nop
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
jmp qword [sym.imp.OLEAUT32.dll_SysStringLen]

Function at 0x14001a9f8
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x258
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x280]
mov r8, rbx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140006c64
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x30]
lea rcx, [0x14004041c]
call sub.msvcrt.dll_wprintf
lea rdx, [0x140047b58]
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x14001aa8c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x258
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x280]
mov r8, rbx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140006c64
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x30]
lea rcx, [0x14004041c]
call sub.msvcrt.dll_wprintf
lea rdx, [0x140047d38]
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x14001b970
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x258
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov edi, ecx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x280]
mov r8, rbx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140006c64
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea r8, [rsp + 0x30]
mov edx, edi
lea rcx, str._0x_08x___s
call sub.msvcrt.dll_wprintf
cmp byte [0x14004b35b], 0
jne 0x14001ba0c
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14002c700
add rsp, 0x258
pop rdi
pop rbx
ret
lea rdx, [0x140047d38]
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x140021634
Capabilities:
Clear file content
Get file size
Read file on windows
Write file on windows

Disassembly:
test rdx, rdx
je 0x14002187c
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbx, rdx
mov r14, rcx
or r12, 0xffffffffffffffff
mov r13d, 0x80070000
cmp qword [rbx + 0x20], r12
je 0x14002182c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14002182c
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
lea rax, [0x14003f0a8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rsi
cmp rsi, r12
jne 0x1400216d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
mov r8d, eax
lea rdx, str.CreateFile_failed_with_error__d._n
call fcn.14001aa8c
xor eax, eax
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0xb8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140021718
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
mov r8d, eax
lea rdx, str.GetFileSizeEx_failed_with_error__d._n
call fcn.14001aa8c
mov rdi, qword [rsp + 0xb8]
test rdi, rdi
jle 0x1400217de
mov r12d, 0x100000
mov ebp, edi
cmp rdi, r12
cmovg ebp, r12d
and qword [rsp + 0x20], 0
lea r9, [rsp + 0xb0]
mov r8d, ebp
mov rdx, qword [r14 + 0x90]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002177d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
mov r8d, eax
lea rdx, str.ReadFile_failed_dued_to_error__d._n
call fcn.14001aa8c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0xa8]
mov r8d, ebp
mov rdx, qword [r14 + 0x90]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400217ac
cmp dword [rsp + 0xa8], ebp
jae 0x1400217cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
mov r8d, eax
lea rdx, str.Write_file_failed_due_to_error__d._n
call fcn.14001aa8c
mov eax, ebp
sub rdi, rax
test rdi, rdi
jg 0x14002172f
or r12, 0xffffffffffffffff
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14002180d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, r13d
test eax, eax
cmovle ecx, eax
mov r8d, eax
lea rdx, str.SetEndOfFile_failed_due_to_error__d._n
call fcn.14001aa8c
nop
cmp rsi, r12
je 0x14002181b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x50], r12
lea rax, [0x14003efd0]
mov qword [rsp + 0x48], rax
cmp byte [0x14004b35e], 0
je 0x140021845
mov rdx, qword [rbx + 0x18]
lea rcx, str.completed_file__s_n
call sub.msvcrt.dll_wprintf
mov rax, qword [rbx + 8]
mov qword [r14 + 0x60], rax
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax]
call qword [0x14002f5e0]
mov rbx, qword [r14 + 0x60]
test rbx, rbx
jne 0x140021664
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140021b30
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
call fcn.140021ccc
test rdi, rdi
je 0x140021b83
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140021b83
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
lea rdx, str.CopyFile_failed_with_error__d._n
or ecx, 0x80070000
mov r8d, eax
test eax, eax
cmovle ecx, eax
call fcn.14001b970
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140021b94
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140021ca2
mov edx, 0x25
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x140021ca2
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140021c16
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
lea rdx, str.ExpandEnvironmentStrings_failed_due_to_error__d._n
or ecx, 0x80070000
mov r8d, eax
test eax, eax
cmovle ecx, eax
call fcn.14001aa8c
jmp 0x140021ca2
cmp eax, 0x104
ja 0x140021c2d
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [rsp + 0x20]
jmp 0x140021c99
mov ecx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
lea rdx, [0x14003ef00]
cmovo rax, rcx
mov rcx, rax
call fcn.14002c89c
mov rcx, qword [rbx]
mov r8d, 0x104
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140021c8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
lea rdx, str.ExpandEnvironmentStrings_failed_due_to_error__d._n
or ecx, 0x80070000
mov r8d, eax
test eax, eax
cmovle ecx, eax
call fcn.14001aa8c
mov rcx, qword [rbx]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14002c700
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x140021ccc
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rsi, rcx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x88], rax
or r15, 0xffffffffffffffff
mov rdi, r15
xor ebp, ebp
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x140021d08
lea ecx, [rdi + 1]
mov eax, 2
mul rcx
cmovo rax, r15
lea rdx, [0x14003ef00]
mov rcx, rax
call fcn.14002c89c
mov rsi, rax
test rax, rax
jne 0x140021d48
lea rdx, str.Out_of_Memory
mov ecx, 0x8007000e
call fcn.14001aa8c
mov r13d, 0x5c
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x140021ddc
mov r14, rsi
sub r14, rbx
mov word [rax], bp
mov rcx, rbx
movzx eax, word [rcx]
mov word [r14 + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140021d6b
lea rcx, [rsi - 2]
lea rcx, [rcx + 2]
cmp word [rcx], bp
jne 0x140021d80
mov eax, dword [0x14003f0d0]
mov dword [rcx], eax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, r15
jne 0x140021dd3
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
jne 0x140021d65
jmp 0x140021ddc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14002bfcc
mov rax, r15
inc rax
cmp word [rbx + rax*2], bp
jne 0x140021de7
mov word [rbx + rax*2], r13w
mov edi, edi
mov rax, r15
inc rax
cmp word [rbx + rax*2], bp
jne 0x140021dfa
jmp 0x140021e54
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140021e37
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r8d, eax
lea rdx, str.CreateDirectory_failed_with_error__d._n
call fcn.14001aa8c
mov rax, r15
inc rax
cmp word [rbx + rax*2], bp
jne 0x140021e3a
mov word [rbx + rax*2], r13w
mov rax, r15
inc rax
cmp word [rbx + rax*2], bp
jne 0x140021e4b
cmp rax, rdi
jb case.default.0x140021e74
mov rcx, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
jmp qword [sym.imp.OLEAUT32.dll_SysStringLen]
add byte [rax], al
add byte [rax], al
add byte [rax + 9], al
or byte [rcx], 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdi], 0
invalid
add byte [rax], al
invalid
add byte [rax], al
add byte [rax + 7], al
invalid
add byte [rax], al
invalid
add byte [rax], al
add byte [rax + 0xc8], al
enter 0, 0
add byte [rax], al
add byte [rax + 2], al
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al