joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007860
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2050
call fcn.14000bc90
sub rsp, rax
mov rax, qword [0x140039018]
xor rax, rsp
mov qword [rsp + 0x2040], rax
xor edi, edi
mov rbp, rdx
mov r15, rcx
mov esi, edi
test rdx, rdx
je 0x1400078ed
lea rcx, [0x140028b64]
call fcn.140007a70
mov rcx, rbp
mov rsi, rax
call fcn.140007330
mov r14, rax
test rax, rax
je 0x1400079bf
mov rdx, rax
lea rcx, [0x140028b68]
call fcn.140013b04
mov rcx, r14
mov ebx, eax
call fcn.14001104c
test ebx, ebx
je 0x1400078ed
lea rcx, str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
call fcn.140002b30
xor eax, eax
jmp 0x140007a48
lea rdx, [rsp + 0x40]
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
mov r9d, eax
lea r8, str._MEI_d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002830
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140014784
mov rcx, rax
mov rbx, rax
call fcn.140008a80
test eax, eax
je 0x1400079c6
mov rcx, rbx
call fcn.14001104c
inc edi
cmp edi, 5
jl 0x140007920
test rbp, rbp
je 0x1400079bf
xor r8d, r8d
lea rdx, [0x140028b64]
xor ecx, ecx
call fcn.140008ae0
test rsi, rsi
je 0x1400079a9
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140008ae0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140013b04
mov rcx, rdi
call fcn.14001104c
mov rcx, rbx
call fcn.14001104c
mov rcx, rsi
call fcn.14001104c
xor eax, eax
jmp 0x140007a48
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14001104c
xor eax, eax
jmp 0x140007a48
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call fcn.140008bf0
mov rcx, rbx
call fcn.14001104c
test rbp, rbp
je 0x140007a43
xor r8d, r8d
lea rdx, [0x140028b64]
xor ecx, ecx
call fcn.140008ae0
test rsi, rsi
je 0x140007a2d
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
mov rdi, rax
call fcn.140008ae0
mov rdx, rax
mov rcx, rdi
mov rbx, rax
call fcn.140013b04
mov rcx, rdi
call fcn.14001104c
mov rcx, rbx
call fcn.14001104c
mov rcx, rsi
jmp 0x140007a3e
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call fcn.14001104c
mov eax, 1
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.14000bcf0
mov rbx, qword [rsp + 0x2090]
add rsp, 0x2050
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007a70
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4038
call fcn.14000bc90
sub rsp, rax
mov rax, qword [0x140039018]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140008ae0
mov r8d, 0x2000
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140007b06
mov r8d, 0x2000
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.140008bf0
test rax, rax
je 0x140007b06
cmp byte [rax], 0
je 0x140007b06
mov rcx, rax
call fcn.140016530
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000bcf0
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000bcf0
add rsp, 0x4038
ret

Function at 0x140007f50
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140008ae0
xor edx, edx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rdi
mov ebx, eax
call fcn.14001104c
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007f90
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x2110
call fcn.14000bc90
sub rsp, rax
mov rax, qword [0x140039018]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rdx, rcx
xor edi, edi
lea rcx, [rsp + 0x100]
mov dword [rsp + 0x50], edi
mov r8d, 0x1000
call fcn.140008ae0
mov ebx, 1
lea rcx, [0x140007310]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x58], 0x18
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], ebx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xorps xmm0, xmm0
mov qword [rsp + 0x98], rdi
xor ecx, ecx
movdqa xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0xcc], 0x101
mov word [rsp + 0xd0], bx
call fcn.140011330
mov rcx, rax
call fcn.1400165a8
mov ecx, eax
call fcn.140014348
cmp rax, 0xffffffffffffffff
mov ecx, ebx
cmove rax, rdi
mov qword [rsp + 0xe0], rax
call fcn.140011330
mov rcx, rax
call fcn.1400165a8
mov ecx, eax
call fcn.140014348
cmp rax, 0xffffffffffffffff
lea ecx, [rdi + 2]
cmove rax, rdi
mov qword [rsp + 0xe8], rax
call fcn.140011330
mov rcx, rax
call fcn.1400165a8
mov ecx, eax
call fcn.140014348
cmp rax, 0xffffffffffffffff
cmove rax, rdi
mov qword [rsp + 0xf0], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rsp + 0x100]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140008110
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [rsp + 0x50]
jmp 0x140008128
lea rdx, str.Error_creating_child_process__n
lea rcx, [0x140028c70]
call fcn.1400029e0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.14000bcf0
mov rbx, qword [rsp + 0x2128]
add rsp, 0x2110
pop rdi
ret
Function at 0x1400081c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rbp, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.140011060
mov r15, rax
test rax, rax
je 0x1400082d3
xor edx, edx
lea r8d, [r13 + 2]
mov rcx, r12
call fcn.14000e598
test eax, eax
js 0x1400082d3
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.140014d20
mov rbx, rax
cmp rax, rbp
jb 0x1400082ce
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
nop dword [rax]
cmp rbx, 0x2000
lea rsi, [rbx - 0x2000]
cmovb rsi, r13
sub rbx, rsi
cmp rbx, rbp
jb 0x1400082c4
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.14000e598
test eax, eax
js 0x1400082c4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000e2c8
cmp rax, rbx
jne 0x1400082c4
sub rbx, rbp
add rbx, 1
je 0x1400082ab
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.14000d4e0
test eax, eax
je 0x1400082bd
dec rdi
sub rbx, 1
jne 0x140008290
lea rbx, [rbp - 1]
add rbx, rsi
test rsi, rsi
jne 0x140008230
jmp 0x1400082c4
lea r13, [rbx - 1]
add r13, rsi
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.14001104c
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x140008a80
Capabilities:
Create directory

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14003aed0]
test rax, rax
jne 0x140008aa6
lea rcx, str.Security_descriptor_is_not_initialized__n
call fcn.140002c40
mov eax, 0xffffffff
add rsp, 0x48
ret
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x18
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x48
ret
Function at 0x140013b3c
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140013b5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001140c
or eax, 0xffffffff
jmp 0x140013b5e
xor eax, eax
add rsp, 0x28
ret

Function at 0x140013e8c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140039018]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor esi, esi
mov rbx, rdx
test rdx, rdx
jne 0x140013bcb
call fcn.14001147c
mov dword [rax], 0x16
call fcn.1400168c8
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000bcf0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
test rcx, rcx
je 0x140013b92
mov dword [rsp + 0x28], esi
lea r8, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140013c39
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140013c0c
cmp eax, 3
jbe 0x140013c29
cmp eax, 8
je 0x140013c19
cmp eax, 0x12
je 0x140013c29
call fcn.14001147c
mov dword [rax], 0x16
jmp 0x140013ba2
call fcn.14001147c
mov dword [rax], 0xc
jmp 0x140013ba2
call fcn.14001147c
mov dword [rax], 2
jmp 0x140013ba2
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, esi
mov dword [rbx], eax
call fcn.140013dd4
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.140013dd4
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.140013dd4
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14001c464
test eax, eax
jne 0x140013c97
mov rax, rdi
jmp 0x140013ba6
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400168e8
int3
jmp 0x140013b64
Function at 0x140013e94
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x140039018]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rbx, rdx
test rcx, rcx
jne 0x140013d09
call fcn.14001147c
mov dword [rax], 0x16
call fcn.1400168c8
or eax, 0xffffffff
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000bcf0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
cmp rcx, 0xffffffffffffffff
je 0x140013cd5
test rbx, rbx
je 0x140013cd5
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140013d64
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x140013d3d
cmp eax, 3
jbe 0x140013d57
cmp eax, 8
je 0x140013d4a
cmp eax, 0x12
je 0x140013d57
call fcn.14001147c
mov dword [rax], 0x16
jmp 0x140013ce5
call fcn.14001147c
mov dword [rax], 0xc
jmp 0x140013ce5
call fcn.14001147c
mov dword [rax], 2
jmp 0x140013ce5
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x34]
cmp eax, 0x80
cmove eax, edi
mov dword [rbx], eax
call fcn.140013dd4
lea rcx, [rsp + 0x3c]
mov qword [rbx + 8], rax
call fcn.140013dd4
lea rcx, [rsp + 0x44]
mov qword [rbx + 0x10], rax
call fcn.140013dd4
mov qword [rbx + 0x18], rax
lea rcx, [rbx + 0x24]
mov eax, dword [rsp + 0x50]
lea r8, [rsp + 0x5c]
mov edx, 0x104
mov dword [rbx + 0x20], eax
call fcn.14001c464
test eax, eax
je 0x140013ce8
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1400168e8
int3
jmp 0x140013cac

Function at 0x1400143c0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400143e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001140c
or eax, 0xffffffff
jmp 0x1400143e2
xor eax, eax
add rsp, 0x28
ret

Function at 0x140015cb4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140015ae0
Function at 0x140007040
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x60
mov rdi, r8
mov esi, edx
mov rbx, qword [0x1400ce080]
mov qword [rsp + 0x48], rbx
lea rdx, str.Service_trying_to_start.
mov rcx, qword [rbx + 8]
call qword [sym.imp.Logging.dll_public:_void___cdecl_Hp::Bridge::Logging::TraceLogger::LogInfo_wchar_t_const____ptr64____ptr64]
mov dword [rsp + 0x80], 0x428
mov dword [rbx + 0x1c], 2
xor r15d, r15d
mov dword [rbx + 0x24], r15d
mov dword [rbx + 0x30], r15d
mov ecx, dword [0x1400c9038]
lea eax, [rcx + 1]
mov dword [0x1400c9038], eax
mov dword [rbx + 0x2c], ecx
lea rdx, [rbx + 0x18]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rax, qword [rbx]
mov r8, rdi
mov edx, esi
mov rcx, rbx
call qword [rax + 8]
mov dword [rbx + 0x1c], 4
mov dword [rbx + 0x24], r15d
mov qword [rbx + 0x2c], r15
lea rdx, [rbx + 0x18]
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, rbx
call fcn.1400075a0
mov qword [rsp + 0x40], r15
lea r8, [rsp + 0x40]
lea rdx, str.SYSTEMCurrentControlSetControlPowerModernSleep
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140007164
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x98], 4
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.EnabledActions
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete byte [0x1400ce070]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx r8d, byte [0x1400ce070]
lea rdx, str.System_Supports_Modern_Standby:__d
mov rcx, qword [rbx + 8]
call qword [sym.imp.Logging.dll_public:_void___cdecl_Hp::Bridge::Logging::TraceLogger::LogInfo_wchar_t_const____ptr64____ptr64]
cmp byte [0x1400ce070], r15b
je 0x14000720d
lea rax, [0x140007860]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x98], r15
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x50]
mov edx, 2
lea rcx, [0x1400790f8]
call qword [sym.imp.api_ms_win_power_setting_l1_1_0.dll_PowerSettingRegisterNotification]
test eax, eax
je 0x1400071da
mov r8d, eax
lea rdx, str.PowerSettingRegisterNotification_failed:__u
mov rcx, qword [rbx + 8]
call qword [sym.imp.Logging.dll_public:_void___cdecl_Hp::Bridge::Logging::TraceLogger::LogError_wchar_t_const____ptr64____ptr64]
lea r9, str.CE7DC567_F47B_4A07_8489_C9DEB372B88F
xor r8d, r8d
lea edx, [r8 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400ce078], rax
test rax, rax
jne 0x14000720d
lea rdx, str.Failed_to_create_notification_event_for_modern_Standby
mov rcx, qword [rbx + 8]
call qword [sym.imp.Logging.dll_public:_void___cdecl_Hp::Bridge::Logging::TraceLogger::LogError_wchar_t_const____ptr64____ptr64]
mov dword [rsp + 0x80], r15d
mov eax, r15d
jmp 0x140007221
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000d720
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400c9008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov r8, rdx
lea rdx, str.test.exe
lea rcx, [rsp + 0x38]
call fcn.14000ffe0
nop
cmp qword [rax + 0x18], 8
jb 0x14000d776
mov rax, qword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rbp, rax
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14000d7cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d7c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d7c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061ab0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r14w
test rbp, rbp
je 0x14000d8b5
mov sil, 1
mov eax, 1
mov edx, dword [rsp + 0x20]
cmp edx, eax
jle 0x14000d853
lea rcx, [rbp + 8]
nop dword [rax]
mov rdi, qword [rcx]
cmp word [rdi], 0x2f
jne 0x14000d815
inc eax
add rcx, 8
cmp eax, edx
jl 0x14000d800
jmp 0x14000d853
lea rax, vtable.Hp::Bridge::Security::HPAuthenticodeFacadeBase.0
mov qword [rsp + 0x28], rax
lea r15, vtable.Hp::Bridge::Security::HPAuthenticodeFacade.0
mov qword [rsp + 0x28], r15
lea r8, [0x1400ce270]
mov rdx, rdi
call fcn.140014380
movzx esi, al
test al, al
je 0x14000d84e
mov rdx, rdi
call fcn.140016700
movzx esi, al
mov qword [rsp + 0x28], r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000d898
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000d893
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000d8ae
mov rcx, r8
call fcn.140061ab0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
movzx eax, sil
jmp 0x14000d902
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000d8f0
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000d8eb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000d929
mov rcx, r8
call fcn.140061ab0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140061a90
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
Function at 0x14003de90
Capabilities:
Create directory
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400c9008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov edx, 0x105
lea rcx, [rsp + 0x40]
call fcn.14000ca80
nop
xor edx, edx
mov r8d, 0x20a
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
cmp qword [rsi + 0x18], 8
jb 0x14003def2
mov rsi, qword [rsi]
mov r8d, 0x105
mov rdx, qword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14003dfec
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14003df30
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003dfc9
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rdx, qword [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x14003df50
mov rcx, rbx
call fcn.140005930
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14003dfa9
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003dfa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003dfa4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140061ab0
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140061a90
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.CapDataStore::expandPathAndCreateDirectory___failed_to_create_storage_directory
lea rcx, [rsp + 0x20]
call fcn.140006570
lea rdx, [0x1400bfd30]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
lea rdx, str.CapDataStore::expandPathAndCreateDirectory___failed_to_expanded_environment_variable_pointing_to_output_directory
lea rcx, [rsp + 0x20]
call fcn.140006570
lea rdx, [0x1400bfd30]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14003e300
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14003e330
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14003e358
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003e35a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003e3bb
test ecx, ecx
jle 0x14003e393
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003e3bb
cmp qword [rdi + 0x80], 0
je 0x14003e3bb
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14003e3e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14003e402
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14003e414
lfence
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov qword [rsp + 0x20], rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x14003e43c
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003e43e
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x14003e473
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, rbx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14003e514
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14003e4ae
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x14003e4f1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14003e514
cmp rbx, rax
ja 0x14003e4c0
test rdi, rdi
je 0x14003e514
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, rdi
sub rbx, rax
sub rbp, rbx
mov rax, rbp
lfence
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub dl, byte [rdi]
in al, dx