joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fded0
Capabilities:
Get memory capacity

Disassembly:
push rsi
sub rsp, 0x70
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [0x14026fe30]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x20], 0x40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1400f606d
mov rsi, qword [rsp + 0x28]
jmp 0x1400f6074
call fcn.140127d70
xor esi, esi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140203460
mov rax, rsi
add rsp, 0x70
pop rsi
ret
sub rsp, 0x28
call fcn.140124a30
lea rdx, str.enable_low_end_device_mode
mov rcx, rax
call fcn.1401252b0
test al, al
je 0x1400fdf02
call 0x1400f6020
cmp rax, 0x20000000
mov ecx, 0x20000000
cmovae rax, rcx
jmp 0x1400fdf16
cmp byte [0x1403e2730], 0
je 0x1400fdf1b
mov rax, qword [0x1403e2738]
shl rax, 0x14
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x1400f6020
Function at 0x140103ca0
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rcx], 0
mov eax, dword [0x1403bcfc0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
lea rcx, [rax + 0x198]
mov qword [rsi + 8], rcx
mov rcx, qword [rax + 0x198]
mov qword [rax + 0x198], rsi
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x38], 0
mov dword [rsi + 0x40], 0
mov byte [rsi + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x58], r8
mov qword [rsi + 0x60], r9
test byte [0x1403af420], 9
jne 0x140103d33
mov byte [rsi + 0x30], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140203460
mov rax, rsi
add rsp, 0x30
pop rsi
ret
mov byte [rsi + 0x30], 1
lea rax, [rsp + 0x20]
mov rcx, rdx
mov rdx, rax
call fcn.140101960
mov rax, qword [rsp + 0x20]
mov qword [rsi + 0x20], rax
jmp 0x140103d1d

Function at 0x140106cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x140106e27
mov rcx, qword [rcx]
xor esi, esi
lea r8, str._000000000000
lea r9, [0x140287b91]
jmp 0x140106cfc
mov rsi, r10
cmp r10, rdx
jae 0x140106e27
lea r10, [rsi + 1]
movzx eax, byte [rcx + rsi]
test al, al
jns 0x140106cf0
mov r11d, 0xffffffff
cmp r10, rdx
jne 0x140106d25
mov r10, rdx
cmp r11d, 0xd800
jae 0x140106ddd
jmp 0x140106cf0
cmp al, 0xe0
jb 0x140106d5f
cmp al, 0xef
ja 0x140106d83
and eax, 0xf
movzx esi, byte [rax + r8]
movzx edi, byte [rcx + r10]
mov ebx, edi
shr ebx, 5
bt esi, ebx
jae 0x140106dd0
and dil, 0x3f
inc r10
cmp r10, rdx
je 0x140106d13
shl eax, 6
movzx esi, dil
or esi, eax
jmp 0x140106d68
cmp al, 0xc2
jb 0x140106dd0
and eax, 0x1f
mov esi, eax
movzx eax, byte [rcx + r10]
xor eax, 0x80
cmp al, 0x3f
ja 0x140106dd0
shl esi, 6
or esi, eax
inc r10
mov r11d, esi
jmp 0x140106dd0
cmp al, 0xf4
ja 0x140106dd0
lea ebx, [rax - 0xf0]
movzx eax, byte [rcx + r10]
mov rdi, rax
shr rdi, 4
movsx edi, byte [rdi + r9]
bt edi, ebx
jae 0x140106dd0
add rsi, 2
cmp rsi, rdx
je 0x140106d13
movzx edi, byte [rcx + rsi]
add dil, 0x80
cmp dil, 0x3f
ja 0x140106e16
shl ebx, 6
and eax, 0x3f
or eax, ebx
mov r10, rsi
jmp 0x140106d4c
cmp r11d, 0xd800
jb 0x140106cf0
lea eax, [r11 - 0xe000]
cmp eax, 0x1dd0
jb 0x140106cf0
lea esi, [r11 - 0xfdf0]
xor eax, eax
cmp esi, 0x10020f
ja 0x140106e29
and r11d, 0xfffe
cmp r11d, 0xfffe
jne 0x140106cf0
jmp 0x140106e29
mov r10, rsi
cmp r11d, 0xd800
jae 0x140106ddd
jmp 0x140106cf0
mov al, 1
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401213f0
Capabilities:
Check if file exists

Disassembly:
xor r8d, r8d
jmp 0x140121400
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14012145f
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x140121445
call fcn.14011dc90
mov rcx, qword [rsi]
call fcn.1400f41d0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140121457
mov qword [rsi], rdi
call fcn.14011dc90
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.1400f3d70
lea rcx, [rsi + 0x20]
call fcn.140169cd0
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140121400
Capabilities:
Check if file exists

Disassembly:
xor r8d, r8d
jmp 0x140121400
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebx, r8d
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14012145f
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jb 0x140121445
call fcn.14011dc90
mov rcx, qword [rsi]
call fcn.1400f41d0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140121457
mov qword [rsi], rdi
call fcn.14011dc90
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsi + 8]
call fcn.1400f3d70
lea rcx, [rsi + 0x20]
call fcn.140169cd0
mov dword [rsi + 0x24], 0
mov byte [rsi + 0x28], 0
mov byte [rsi + 0x29], bl
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x140124710
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1403e2a48]
test rdi, rdi
jne 0x1401247c4
mov ecx, 0x50
call fcn.14020216c
mov rsi, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov byte [rax + 0x10], 0
mov ecx, 0x18
call fcn.14020216c
mov qword [rsi + 0x18], rax
lea rcx, [rax + 0x18]
mov qword [rsi + 0x28], rcx
test rax, rax
je 0x1401247e6
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsi + 0x20], rcx
mov rax, rsi
add rax, 0x38
movups xmmword [rsi + 0x38], xmm6
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x48], 1
mov qword [0x1403e2a48], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x140124812
mov rcx, rax
call fcn.14022f908
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140124820
test rdi, rdi
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140203460
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.14004460c
int3
Function at 0x140124820
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov r8d, 3
call fcn.1400f6be0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
cmp qword [rbx + 8], 0
je 0x1401249a7
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov dword [rsp + 0x4c], 0
lea rcx, [0x140288e98]
xor edx, edx
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x1401248cc
lea rdx, [0x140288ee8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401248df
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [case.0x1400f45b0.0]
jmp 0x1401248da
mov rcx, qword [rbx]
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
jmp 0x1401248e2
xor r14d, r14d
movsxd r12, dword [rsp + 0x4c]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0x40], 0
test r12, r12
je 0x140124969
shl r12, 3
movabs rax, 0x5555555555555551
cmp r12, rax
jae 0x140124a1a
lea r15, [r12 + r12*2]
mov rcx, r15
call fcn.14020216c
mov rbx, rax
mov qword [rsp + 0x30], rax
add rax, r15
mov qword [rsp + 0x40], rax
xor r13d, r13d
mov r15, rbx
nop word cs:[rax + rax]
test r15, r15
je 0x1401249ee
mov rdx, qword [r14 + r13]
mov rcx, r15
call fcn.14003f01a
add r15, 0x18
add r13, 8
cmp r12, r13
jne 0x140124940
mov qword [rsp + 0x38], r15
jmp 0x14012496e
xor r15d, r15d
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140124310
movups xmmword [rsi], xmm6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rdi, rdi
je 0x140124995
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test rbx, rbx
je 0x1401249a7
cmp r15, rbx
jne 0x1401249d8
mov rcx, rbx
call fcn.1402021a8
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140203460
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15, rsi
cmp rsi, rbx
je 0x14012499f
lea rsi, [r15 - 0x18]
cmp byte [r15 - 1], 0
jns 0x1401249d0
mov rcx, qword [r15 - 0x18]
call fcn.1402021a8
jmp 0x1401249d0
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x25
call fcn.14004460c
lea rcx, [rsp + 0x30]
call fcn.14003dd50
int3
Function at 0x140125b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx eax, byte [0x1403e2a58]
and eax, 1
neg rax
cmp rax, 0xfffffffffffffffd
je 0x140125c43
mov rsi, rcx
lea r14, [0x140288e60]
movabs r15, 0xaaaaaaaaaaaaaaaa
movaps xmm6, xmmword [0x14026fe30]
lea rdi, [rsp + 0x20]
xor r12d, r12d
jmp 0x140125baf
test al, al
js 0x140125c30
inc r12
movzx eax, byte [0x1403e2a58]
xor rax, 3
cmp r12, rax
jae 0x140125c43
mov rdx, r12
shl rdx, 4
add rdx, r14
mov qword [rsp + 0x30], r15
movaps xmmword [rsp + 0x20], xmm6
mov rcx, rdi
call fcn.1400f7b60
movzx eax, byte [rsp + 0x37]
test al, al
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdx, rdi
cmovs rdx, rcx
mov r8, rax
cmovs r8, rbx
mov r9, qword [rsi + 8]
cmp r9, r8
mov r10, r8
cmovb r10, r9
test r10, r10
js 0x140125c6f
cmp r8, r9
ja 0x140125b90
test r8, r8
je 0x140125c3a
mov r9, qword [rsi]
xor r10d, r10d
nop dword [rax]
movzx r11d, word [r9 + r10*2]
cmp r11w, word [rdx + r10*2]
jne 0x140125b90
inc r10
cmp r8, r10
jne 0x140125c10
jmp 0x140125c3a
call fcn.1402021a8
jmp 0x140125b98
test al, al
js 0x140125c47
mov rbx, rax
jmp 0x140125c4c
xor ebx, ebx
jmp 0x140125c4c
call fcn.1402021a8
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140203460
mov rax, rbx
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
int3
Function at 0x140128e49
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdx, qword [0x1403e2a80]
test rdx, rdx
jne 0x140128f5c
mov ecx, 0x18
call fcn.14020216c
mov rbx, rax
xorps xmm6, xmm6
movups xmmword [rax], xmm6
xor r15d, r15d
mov qword [rax + 0x10], r15
mov qword [0x1403e2a80], rax
mov ecx, 0x18
call fcn.14020216c
mov r14, rax
movups xmmword [rax], xmm6
mov qword [rax + 0x10], r15
mov qword [0x1403e2a88], rax
call fcn.1401803ae
mov rax, qword [rax + 8]
mov r15, qword [rax + 0x10]
lea rdx, str.user_data_dir
lea r12, [rsp + 0x38]
mov rcx, r12
call fcn.14003f01a
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea r13, [rsp + 0x20]
mov rcx, r13
mov rdx, rax
call fcn.14003f01a
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, r13
mov r8, r12
call fcn.1401299a5
mov rcx, rbp
mov rdx, r15
mov r8, rbx
mov r9, r14
call fcn.14012891c
mov ebx, eax
cmp byte [rbp + 0x17], 0
jns 0x140128f2f
mov rcx, qword [rsp + 0x50]
call fcn.1402021a8
cmp byte [rsp + 0x37], 0
jns 0x140128f40
mov rcx, qword [rsp + 0x20]
call fcn.1402021a8
cmp byte [rsp + 0x4f], 0
jns 0x140128f51
mov rcx, qword [rsp + 0x38]
call fcn.1402021a8
test bl, bl
je 0x140128f7d
mov rdx, qword [0x1403e2a80]
mov rcx, rdi
call fcn.14003de3c
mov dil, 1
test rsi, rsi
je 0x140128f7f
mov rdx, qword [0x1403e2a88]
mov rcx, rsi
call fcn.14003de3c
jmp 0x140128f7f
xor edi, edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140203460
mov eax, edi
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1401293d8
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x230
mov rsi, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x228], rax
lea rdi, [rsp + 0x20]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.1402055c0
xor ebx, ebx
lea r14, str.PROGRAMFILES
mov r15, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, qword [rbx + r14]
mov word [rsp + 0x20], 0
mov rdx, rdi
mov r8d, 0x104
call r15
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140129453
mov edx, eax
mov rcx, rdi
mov r8, rsi
call fcn.140129369
test al, al
jne 0x140129461
add rbx, 8
cmp rbx, 0x18
jne 0x140129420
xor esi, esi
jmp 0x140129464
mov sil, 1
mov rcx, qword [rsp + 0x228]
xor rcx, rsp
call fcn.140203460
mov eax, esi
add rsp, 0x230
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140129c78
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140129d30
mov ebx, eax
mov edx, eax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x20]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x14026fe30]
movaps xmmword [r14], xmm0
mov rcx, r14
xor r8d, r8d
call fcn.1400dba4e
cmp byte [r14 + 0x17], 0
jns 0x140129ce5
mov r14, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140129d40
mov edx, eax
movzx eax, byte [rsp + 0x37]
mov rcx, rax
test al, al
jns 0x140129d0b
mov rcx, qword [rsp + 0x28]
cmp rcx, rdx
jbe 0x140129d44
lea rdi, [rsp + 0x20]
mov rcx, rdi
xor r8d, r8d
call fcn.1400e9f82
mov rax, qword [rdi + 0x10]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
jmp 0x140129d60
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
jmp 0x140129d60
mov al, byte [rsp + 0x37]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
test al, al
jns 0x140129d60
mov rcx, qword [rsp + 0x20]
call fcn.1402021a8
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140203460
mov rax, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140129d7a
Capabilities:
Set environment variable

Disassembly:
sub rsp, 0x28
cmp byte [rdx + 0x17], 0
jns 0x140129d87
mov rdx, qword [rdx]
cmp byte [rcx + 0x17], 0
jns 0x140129d90
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x140129da0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x17], 0
jns 0x140129dad
mov rcx, qword [rcx]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x140129dc2
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov r15, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rdx + 0x17], 0
js 0x140129dfc
mov byte [rdi + 0x17], 6
mov rax, rdi
jmp 0x140129e07
mov qword [rdi + 8], 6
mov rax, qword [rdi]
movabs rcx, 0x6f007200680043
mov qword [rax], rcx
mov dword [rax + 8], 0x65006d
mov word [rax + 0xc], 0
lea rdx, str.0.0.0.0_devel
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.1400e93c0
cmp byte [rsi + 0x17], 0
js 0x140129e47
mov word [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x140129e57
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
mov dword [rsp + 0x5c], 0
cmp byte [r15 + 0x17], 0
mov rcx, r15
jns 0x140129e6c
mov rcx, qword [r15]
mov r13, qword [rsp + 0xd0]
lea rdx, [rsp + 0x5c]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x14012a000
mov ebp, eax
mov ecx, eax
call fcn.1402021dc
mov r14, rax
mov edx, dword [rsp + 0x5c]
cmp byte [r15 + 0x17], 0
jns 0x140129ea0
mov r15, qword [r15]
mov rcx, r15
mov r8d, ebp
mov r9, r14
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140129ff3
lea rdx, [0x140289280]
lea r15, [rsp + 0x40]
mov rcx, r15
call fcn.14003f01a
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.14012a04e
cmp byte [r15 + 0x17], 0
jns 0x140129ee9
mov rcx, qword [rsp + 0x40]
call fcn.1402021a8
xorps xmm0, xmm0
lea r15, [rsp + 0x40]
movaps xmmword [r15], xmm0
mov qword [r15 + 0x10], 0
lea rdx, [0x14028929e]
lea r12, [rsp + 0x28]
mov rcx, r12
call fcn.14003f01a
mov rcx, r14
mov rdx, r12
mov r8, r15
call fcn.14012a04e
cmp byte [r12 + 0x17], 0
jns 0x140129f31
mov rcx, qword [rsp + 0x28]
call fcn.1402021a8
movzx r8d, byte [rsp + 0x57]
test r8b, r8b
cmovs r8, qword [rsp + 0x48]
cmovs r15, qword [rsp + 0x40]
lea r12, [rsp + 0x28]
mov rcx, r12
mov rdx, r15
call fcn.14003db1a
cmp qword [r12 + 8], 1
jne 0x140129f69
mov rax, qword [rsp + 0x28]
cmp word [rax], 0x31
je 0x140129f7e
lea rdx, str._devel
mov r8d, 6
mov rcx, rbx
call fcn.1400e9650
lea rdx, [0x1402892ca]
lea rbx, [rsp + 0x28]
mov rcx, rbx
call fcn.14003f01a
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.14012a04e
cmp byte [rbx + 0x17], 0
jns 0x140129fb0
mov rcx, qword [rsp + 0x28]
call fcn.1402021a8
lea rdx, str.SpecialBuild
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.14003f01a
mov rcx, r14
mov rdx, rdi
mov r8, rsi
call fcn.14012a04e
cmp byte [rdi + 0x17], 0
jns 0x140129fe2
mov rcx, qword [rsp + 0x28]
call fcn.1402021a8
cmp byte [rsp + 0x57], 0
jns 0x140129ff3
mov rcx, qword [rsp + 0x40]
call fcn.1402021a8
test r14, r14
je 0x14012a000
mov rcx, r14
call fcn.1402021e4
lea rcx, [rsp + 0x40]
mov dl, 1
call fcn.14012a219
cmp byte [r13 + 0x17], 0
jns 0x14012a01c
mov rcx, qword [r13]
call fcn.1402021a8
mov rax, qword [rsp + 0x50]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r13], xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140203460
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14012a04e
Capabilities:
Identify system language via api

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x278
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp byte [r8 + 0x17], 0
js 0x14012a08e
mov word [rsi], 0
mov byte [rsi + 0x17], 0
jmp 0x14012a09e
mov rax, qword [rsi]
mov word [rax], 0
mov qword [rsi + 8], 0
test rbx, rbx
je 0x14012a1f4
lea r8, [rsp + 0x50]
mov qword [r8], 0
lea r9, [rsp + 0x260]
mov dword [r9], 0
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14012a1f4
lea r14, [rsp + 0x50]
mov rax, qword [r14]
movzx ebp, word [rax]
movzx r15d, word [rax + 2]
mov word [rsp + 0x260], bp
mov word [rsp + 0x262], r15w
mov r12, qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call r12
mov word [rsp + 0x264], ax
mov word [rsp + 0x266], r15w
mov word [rsp + 0x268], bp
mov bp, 0x4e4
mov word [rsp + 0x26a], bp
call r12
mov word [rsp + 0x26c], ax
mov word [rsp + 0x26e], bp
mov rbp, 0xfffffffffffffffe
lea r15, str.StringFileInfo_04hx_04hx_ls
lea r12, [rsp + 0x48]
lea r13, [rsp + 0x44]
mov r8d, 0x208
mov rcx, r14
mov dl, 0xaa
call fcn.1402055c0
cmp byte [rdi + 0x17], 0
mov rax, rdi
jns 0x14012a170
mov rax, qword [rdi]
movzx ecx, word [rsp + rbp*2 + 0x264]
movzx edx, word [rsp + rbp*2 + 0x266]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
mov edx, 0x104
mov r8d, 0x104
mov rcx, r14
mov r9, r15
call fcn.14012abfc
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x44], 0
mov rcx, rbx
mov rdx, r14
mov r8, r12
mov r9, r13
call sub.VERSION.dll_VerQueryValueW
test eax, eax
setne al
mov rdx, qword [rsp + 0x48]
test rdx, rdx
setne cl
and cl, al
cmp cl, 1
je 0x14012a1ec
add rbp, 2
cmp rbp, 5
jbe 0x14012a154
jmp 0x14012a1f4
mov rcx, rsi
call fcn.14012aba0
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140203460
nop
add rsp, 0x278
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14012a95e
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov rdi, rcx
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [rcx + 0x17], 0
mov rsi, rcx
jns 0x14012a986
mov rsi, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14012a9b9
test al, 0x10
jne 0x14012aac5
lea rcx, str._hs___ls_directory_conflicts_with_an_existing_file.___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.14012ab19
xor edi, edi
jmp 0x14012aaff
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
movzx r9d, byte [rdi + 0x17]
mov rax, rdi
test r9b, r9b
jns 0x14012a9de
mov rax, qword [rdi]
mov r9, qword [rdi + 8]
add r9, r9
test r9, r9
je 0x14012aa40
movzx ecx, word [rax + r9 - 2]
add r9, 0xfffffffffffffffe
cmp ecx, 0x5c
je 0x14012a9fa
cmp ecx, 0x2f
jne 0x14012a9e1
cmp r9, 0xfffffffffffffffe
je 0x14012aa40
sar r9, 1
lea rax, [rsp + 0x67]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
call fcn.1400e9882
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x40]
movaps xmmword [rcx], xmm0
mov rax, qword [rbx + 0x10]
mov qword [rcx + 0x10], rax
call fcn.14012a95e
test al, al
je 0x14012aae0
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x14012aaee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xb7
jne 0x14012aab1
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, rsi
call fcn.14003f01a
cmp byte [r14 + 0x17], 0
jns 0x14012aa81
mov r14, qword [rsp + 0x28]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
setne al
and ebp, 0x10
shr ebp, 4
and bpl, al
cmp byte [rsp + 0x3f], 0
jns 0x14012aaac
mov rcx, qword [rsp + 0x28]
call fcn.1402021a8
test bpl, bpl
jne 0x14012aaee
lea rcx, str.Failed_to_create_directory__ls__last_error_is__d_n
mov rdx, rsi
mov r8d, ebx
call fcn.14012ab19
jmp 0x14012aaec
lea rcx, str._hs___ls_directory_exists___n
lea rdx, str.RecursiveDirectoryCreate
mov r8, rsi
call fcn.14012ab19
mov dil, 1
jmp 0x14012aaff
lea rcx, str.Failed_to_create_one_of_the_parent_directories
call fcn.14012ab19
xor edi, edi
cmp byte [rsp + 0x57], 0
jns 0x14012aaff
mov rcx, qword [rsp + 0x40]
call fcn.1402021a8
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140203460
mov eax, edi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14012ab19
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
lea rdi, [rsp + 0x68]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
mov rax, qword [0x1403ac028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
call fcn.1400400d3
mov rcx, qword [rax]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
lea rdi, [0x1403e2a90]
mov r8d, 0x400
mov rdx, rdi
mov r9, rsi
call fcn.140206ffc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140203460
nop
add rsp, 0x48
pop rdi
pop rsi
ret