joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140111280
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor esi, esi
lea rax, [0x1403a7b48]
cmp qword [rcx + 0x18], 8
mov r14, rdx
mov rdi, rcx
mov dword [rsp + 0x20], esi
mov ebp, esi
mov byte [rsp + 0x24], sil
mov qword [rsp + 0x28], rax
jb 0x1401112bb
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1401112e2
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140110fa0
mov ebp, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x140111316
bt ebx, 0xa
jae 0x14011130d
mov rcx, rdi
call fcn.140110bc0
test al, al
je 0x140111306
test bl, 0x10
mov eax, reloc.WS2_32.dll_inet_addr
mov ebx, 4
cmovne ebx, eax
jmp 0x140111316
mov ebx, 9
jmp 0x14011131a
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
je 0x14011131c
mov ebp, esi
lea r9, str.boostWaves1_70_0::filesystem::remove_all
mov r8, r14
mov rdx, rdi
mov ecx, ebp
call fcn.140110a40
test al, al
je 0x140111338
xor eax, eax
jmp 0x140111350
cmp ebx, 1
jbe 0x14011134d
mov r8, r14
mov edx, ebx
mov rcx, rdi
call fcn.140111370
mov rsi, rax
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x1401114d0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
cmp edx, 1
jne 0x14011150f
test r8, r8
je 0x1401115c3
xor eax, eax
mov dword [r8], eax
mov byte [r8 + 4], al
lea rax, [0x1403a7b48]
mov qword [r8 + 8], rax
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x140111561
cmp qword [rcx + 0x18], 8
jb 0x140111523
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401115a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140111548
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x1401115a9
cmp eax, 0x7b
je 0x1401115a9
cmp eax, 0x57
je 0x1401115a9
cmp eax, 0xa1
je 0x1401115a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401115ab
cmp qword [rcx + 0x18], 8
jb 0x14011156b
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1401115a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140111590
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x1401115a9
cmp eax, 0x7b
je 0x1401115a9
cmp eax, 0x57
je 0x1401115a9
cmp eax, 0xa1
je 0x1401115a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1401115ab
xor eax, eax
lea r9, str.boostWaves1_70_0::filesystem::remove
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call fcn.140110a40
test al, al
je 0x1401115d0
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1401115e0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jb 0x140111602
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14011160c
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140111624
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140111626
xor eax, eax
lea rcx, str.boostWaves1_70_0::filesystem::rename
mov r9, rsi
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov ecx, eax
mov rdx, rbx
call fcn.140110960
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140111800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140111840
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x140111860
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140110fa0
jmp 0x140111979
xor r12d, r12d
lea r14d, [r12 + 3]
bt ebp, 0xa
jae 0x140111946
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14011187f
mov rdx, qword [rbx]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1402b1880]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x50], r12w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r12w
jne 0x1401118a3
lea rcx, [rsp + 0x50]
call fcn.1400bc420
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r15, rax
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
call fcn.1400b6a50
cmp r15, 0xffffffffffffffff
jne 0x140111913
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140110fa0
nop
jmp 0x140111979
mov rcx, rbx
call fcn.140110bc0
test al, al
jne 0x14011193d
mov edx, ebp
mov rcx, rbx
call fcn.140110e40
mov dword [rdi], 9
mov dword [rdi + 4], eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140111979
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14011195d
mov dword [rsi], r12d
mov byte [rsi + 4], 0
lea rax, [0x1403a7b48]
mov qword [rsi + 8], rax
mov edx, ebp
mov rcx, rbx
call fcn.140110e40
test bpl, 0x10
jne 0x140111973
mov r14d, 2
mov dword [rdi], r14d
mov dword [rdi + 4], eax
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14010a310
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140112d30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, str.EXPAT_ENTROPY_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140112d99
movzx r8d, byte [rax]
cmp r8b, byte [0x14038eb18]
jne 0x140112d99
movzx eax, byte [rax + 1]
cmp al, byte [0x14038eb19]
jne 0x140112d99
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x28], 4
lea rdx, str.Entropy:__s_____0x_0lx___lu_bytes__n
mov rcx, rax
mov dword [rsp + 0x20], ebx
mov r9d, 8
mov r8, rdi
call fcn.140023bc0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14011bfc0
Capabilities:
Generate random numbers via rtlgenrandom
Query environment variable

Disassembly:
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x388], 0
mov rdi, rcx
jne 0x14011c0d5
mov qword [rsp + 0x50], rbx
lea rcx, str.ADVAPI32.DLL
mov qword [rsp + 0x58], rsi
xor esi, esi
call fcn.14012c750
mov rbx, rax
test rax, rax
je 0x14011c092
lea rdx, str.SystemFunction036
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14011c023
lea edx, [rsi + 4]
lea rcx, [rsp + 0x40]
call rax
mov ecx, 1
cmp al, cl
cmove esi, ecx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x14011c092
mov ebx, dword [rsp + 0x40]
lea rcx, str.EXPAT_ENTROPY_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14011c0c5
movzx ecx, byte [rax]
cmp cl, byte [0x14038eb18]
jne 0x14011c0c5
movzx eax, byte [rax + 1]
cmp al, byte [0x14038eb19]
jne 0x14011c0c5
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x28], 4
lea r8, str.RtlGenRandom
mov rcx, rax
mov dword [rsp + 0x20], ebx
mov r9d, 8
lea rdx, str.Entropy:__s_____0x_0lx___lu_bytes__n
call fcn.140023bc0
jmp 0x14011c0c5
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rsp + 0x48]
xor ebx, dword [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor eax, ebx
lea rcx, str.fallback_4_
imul edx, eax, 0x7fffffff
mov dword [rsp + 0x40], eax
call fcn.140112d30
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov dword [rdi + 0x388], ebx
mov rbx, qword [rsp + 0x50]
cmp byte [rdi + 0x1c8], 0
je 0x14011c0f2
lea rdx, str.xmlhttp:__www.w3.org_XML_1998_namespace
mov rcx, rdi
add rsp, 0x30
pop rdi
jmp fcn.14011b860
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x14012c750
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14012c77a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x1402bc3f0]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1402bc400]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x14012c7de
mov rcx, rbx
test r14, r14
je 0x14012c7c8
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x14012c816
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14012c816
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x14012c8d8
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x14012c840
lea ecx, [rax + 1]
add rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14012c8ca
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14012c8ca
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x14012c870
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x14012c884
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x14012c8a0
mov rcx, rdi
test r14, r14
je 0x14012c8c1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x14012c8c7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x140130cb0
Capabilities:
Read data from internet
Receive data

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbp
mov rdi, rdx
mov rsi, qword [rcx + 8]
mov rcx, qword [rsi + 0x60]
test rcx, rcx
jne 0x140130ce3
xor al, al
jmp 0x140130dac
cmp rdi, qword [rsi + 0x80]
je 0x140130daa
mov byte [rsi + 0x88], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetSetFilePointer]
mov eax, eax
mov qword [rsi + 0x80], rax
cmp rax, rdi
je 0x140130daa
jg 0x140130cdc
sub rdi, rax
mov eax, edi
mov ecx, 0x4000
cmp rdi, rcx
cmovg eax, ecx
mov r14d, eax
movsxd rbp, eax
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rdi, rdi
jle 0x140130da1
nop dword [rax]
cmp byte [rsi + 0x88], 0
jne 0x140130da1
xor edx, edx
mov dword [rsp + 0x60], edx
mov rcx, qword [rsi + 0x60]
test rcx, rcx
je 0x140130d96
mov r8d, edi
cmp rbp, rdi
cmovl r8d, r14d
lea r9, [rsp + 0x60]
mov rdx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
mov edx, dword [rsp + 0x60]
add qword [rsi + 0x80], rdx
test edx, edx
jne 0x140130d96
mov byte [rsi + 0x88], 1
movsxd rax, edx
sub rdi, rax
test rdi, rdi
jg 0x140130d50
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, 1
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140130dd0
Capabilities:
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x10], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x140130dfd
mov byte [rcx + 0x10], 1
xor edx, edx
mov rcx, qword [rcx + 8]
call fcn.140017130
mov rbx, qword [rbx + 8]
mov dword [rsp + 0x30], 0
cmp byte [rbx + 0x88], 0
jne 0x140130e54
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x140130e54
lea r9, [rsp + 0x30]
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [rsp + 0x30]
add qword [rbx + 0x80], rcx
mov eax, ecx
test ecx, ecx
jne 0x140130e56
mov byte [rbx + 0x88], 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140130e70
Capabilities:
Get http content length

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 0x10], 0
mov rbx, rcx
jne 0x140130e8e
mov byte [rcx + 0x10], 1
xor edx, edx
mov rcx, qword [rcx + 8]
call fcn.140017130
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x60]
test rcx, rcx
je 0x140130ed4
xor eax, eax
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x40], eax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov edx, 0x20000005
mov qword [rsp + 0x20], rax
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
mov eax, dword [rsp + 0x40]
jne 0x140130edb
mov rax, 0xffffffffffffffff
add rsp, 0x30
pop rbx
ret
Function at 0x1401314b0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov dword [rbp - 0x40], 0
mov r8b, 1
lea rdx, [rbp + 0x38]
call fcn.140132ff0
nop
mov rbx, qword [rbp + 0x38]
mov qword [rbp - 0x38], rbx
mov edx, 0x40
lea rcx, [rbp - 0x38]
call fcn.14001ad10
lea r14, [0x1402be068]
mov edi, 0xffffffff
test eax, eax
js 0x1401315a4
mov qword [rbp - 0x30], rbx
lea edx, [rdi + 0x3b]
lea rcx, [rbp - 0x30]
call fcn.14001ad10
test eax, eax
jns 0x1401315a4
lea rax, str.mailto:
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x40]
call fcn.14001b960
nop
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x40]
call fcn.14014ff80
mov rsi, qword [rax]
mov qword [rbp - 0x20], rsi
lea rcx, [rsi - 0x10]
lea ebx, [rdi + 2]
cmp rcx, r14
je 0x14013155b
mov eax, ebx
lock xadd dword [rcx], eax
mov dword [rbp - 0x40], ebx
mov rcx, qword [rbp + 0x40]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x14013157a
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x14013157a
call fcn.14010a370
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x38], rsi
mov qword [rbp - 0x20], rax
and ebx, 0xfffffffe
mov dword [rbp - 0x40], ebx
lea rcx, [rax - 0x10]
cmp rcx, r14
je 0x1401315a4
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x1401315a4
call fcn.14010a370
lea rax, [r14 + 0x10]
mov qword [rbp + 0x48], rax
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.140018b20
mov rbx, qword [rax]
lea rdx, [rbp + 0x38]
lea rcx, [rbp - 8]
call fcn.140018b20
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
mov r9, rbx
mov r8, qword [rax]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta bl
mov rax, qword [rbp + 0x48]
lea rcx, [rax - 0x10]
cmp rcx, r14
je 0x14013160e
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x14013160e
call fcn.14010a370
nop
mov rcx, qword [rbp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x140131628
lock xadd dword [rcx], edi
test edi, edi
jne 0x140131628
call fcn.14010a370
movzx eax, bl
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140134e00
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor esi, esi
mov dword [rsp + 0x50], esi
lea rdx, [rsp + 0x50]
lea rcx, [0x1402bdb48]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x140134eae
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov qword [rsp + 0x68], rax
mov r9, rax
mov r8d, edi
mov edx, dword [rsp + 0x50]
lea rcx, [0x1402bdb48]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140134ea5
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x58], esi
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
lea rdx, [0x1402bd8ec]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140134ea5
test edi, edi
je 0x140134ea5
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140134ea5
cmp dword [rax], 0xfeef04bd
jne 0x140134ea5
mov edi, dword [rax + 8]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140134eb0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edi, esi
mov eax, edi
shr eax, 0x10
cmp eax, 0xa
jne 0x140134ec7
mov eax, 0x207
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edi, 0x60003
jne 0x140134edc
mov eax, 0x206
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edi, 0x60002
jne 0x140134ef1
mov eax, 0x205
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edi, 0x60001
jne 0x140134f06
mov eax, 0x204
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edi, 0x60000
jne 0x140134f1b
mov eax, 0x203
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edi, 0x50000
jne 0x140134f30
mov eax, 0x201
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x202
cmp eax, 5
cmove esi, ecx
mov eax, esi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x140135030
Capabilities:
Print debug messages

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov dword [rsp + 0x20], 0
mov rax, qword [rcx]
mov qword [rsp + 0x60], rax
lea rcx, [rax - 0x10]
lea rsi, [0x1402be068]
mov ebx, 1
cmp rcx, rsi
je 0x14013506c
mov eax, ebx
lock xadd dword [rcx], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rax, [0x1402bd8cd]
mov qword [rsp + 0x70], rax
lea rax, [0x1402bd8cc]
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call fcn.140150100
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rcx, [rax - 0x10]
cmp rcx, rsi
je 0x1401350bb
mov eax, ebx
lock xadd dword [rcx], eax
mov dword [rsp + 0x20], ebx
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff0
mov edi, 0xffffffff
cmp rcx, rsi
je 0x1401350e1
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x1401350e1
call fcn.14010a370
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
and ebx, 0xfffffffe
mov dword [rsp + 0x20], ebx
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x14013511b
lock xadd dword [rcx], edi
test edi, edi
jne 0x14013511b
call fcn.14010a370
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140136110
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x470
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov word [rsp + 0x50], ax
lea rdx, [rsp + 0x50]
mov ecx, 0x204
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.14001ba80
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14015ee70
nop
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402be068]
cmp rcx, rax
je 0x1401361ae
mov edx, 0xffffffff
lock xadd dword [rcx], edx
test edx, edx
jne 0x1401361ae
call fcn.14010a370
mov rax, rbx
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14010a310
add rsp, 0x470
pop rbx
ret
Function at 0x1401361e0
Capabilities:
Get common file path

Disassembly:
push rbp
lea rbp, [rsp - 0x1f70]
mov eax, 0x2070
call fcn.14010b140
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x2088], rbx
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rbp + 0x1f60], rax
movsxd rax, edx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor edx, edx
mov dword [rsp + 0x20], edx
cmp eax, 0x10
ja case.default.0x140136245
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0x136430]
add rcx, r8
jmp rcx
mov edx, 0x28
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, 5
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, 0x1a
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, 0x23
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, 0x2e
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, 0x26
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, 0x2a
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, SafeArrayGetDim
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, SafeArrayGetDim
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov edx, 0x27
mov rcx, rbx
call fcn.140137450
jmp 0x140136404
mov word [rsp + 0x60], dx
lea rdx, [rsp + 0x60]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x28]
call fcn.14001ba80
nop
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14015ee70
nop
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402be068]
cmp rcx, rax
je 0x14013640c
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x14013640c
call fcn.14010a370
jmp 0x14013640c
mov word [rbp + 0xf60], dx
mov edx, 0x800
lea rcx, [rbp + 0xf60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rax, [rbp + 0xf60]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14001ba80
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14015ee70
nop
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402be068]
cmp rcx, rax
je 0x14013640c
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x14013640c
call fcn.14010a370
jmp 0x14013640c
call fcn.1401348d0
mov rdx, rax
mov rcx, rbx
call fcn.140137380
jmp 0x140136404
lea rax, [0x1402be078]
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rbp + 0x1f60]
xor rcx, rsp
call fcn.14010a310
mov rbx, qword [rsp + 0x2088]
add rsp, 0x2070
pop rbp
ret