joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d0232
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140193310
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140192ce0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140193351
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402f6020]
jmp 0x140193357
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret

Function at 0x1400d0313
Capabilities:
Get geographical location

Disassembly:
jmp 0x140225b70
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.140224aa0
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140225bd7
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1402f6030]
jmp 0x140225bf9
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400cf46d
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1400d032c
Capabilities:
Terminate process

Disassembly:
jmp 0x14016fcc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400d0728
Capabilities:
Print debug messages

Disassembly:
jmp 0x14025b080
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1402d7140]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x14025b0a6
jmp 0x14025b123
mov rcx, qword [rbp + 0x30]
call fcn.1400cf9a4
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14025b0bf
jmp 0x14025b123
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14025b0dc
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ce0e5
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400ce7c0
test eax, eax
jne 0x14025b123
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400cfcb5
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1400d0bc9
Capabilities:
Set environment variable

Disassembly:
jmp 0x14024b5e0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400d0f48
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401716d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401716f0
xor al, al
jmp 0x140171771
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140171703
xor al, al
jmp 0x140171771
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14017172d
xor al, al
jmp 0x140171771
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140171741
xor al, al
jmp 0x140171771
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140171753
xor al, al
jmp 0x140171771
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14017176f
xor al, al
jmp 0x140171771
mov al, 1
add rsp, 0x38
ret
Function at 0x1400d186c
Capabilities:
Terminate process

Disassembly:
jmp 0x1401946d0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1401946fe
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400d2541
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400d25d7
Capabilities:
Print debug messages

Disassembly:
jmp 0x140239130
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400d2767
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140193450
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140192da0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140193499
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402f6020]
jmp 0x1401934a8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400d2884
Capabilities:
Set environment variable

Disassembly:
jmp 0x1402649d0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400cf256
lea rcx, [rsp + 0x48]
call fcn.1400cf256
call fcn.1400d0188
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400ceed2
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140264a3f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400cf82d
lea rcx, [rsp + 0x78]
call fcn.1400cf82d
mov eax, dword [rsp + 0x24]
jmp 0x140264ad0
call fcn.1400d0188
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400ceed2
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140264a86
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400cf82d
lea rcx, [rsp + 0x78]
call fcn.1400cf82d
mov eax, dword [rsp + 0x2c]
jmp 0x140264ad0
lea rcx, [rsp + 0x48]
call fcn.1400cf152
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400cf152
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400cf82d
lea rcx, [rsp + 0x78]
call fcn.1400cf82d
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x140229bc0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400ce0e5
sub rsp, rax
mov rax, qword [0x1402d7140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402dc130]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140229db2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140229d06
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140229d06
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x140229ceb
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140229c88
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140229d72
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140229dd1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x140229dad
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140229dd1
jmp 0x140229c5e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400cfcb5
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140229e80
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400ce0e5
sub rsp, rax
mov rax, qword [0x1402d7140]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402dc130]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14022a08d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x140229fd9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x140229fd9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x140229fb9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140229f48
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14022a04d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14022a0ac
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14022a088
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14022a0ac
jmp 0x140229f1e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400cfcb5
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400019b0
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x220
mov qword [rax - 0x188], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140059088]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x14003d6e0]
movdqu xmmword [rsp + 0x1e0], xmm1
xor esi, esi
mov word [rsp + 0x1d0], si
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x140001a17
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.140012de0
nop
lea r8, str._s__s__s_S_
mov rdx, rdi
lea rcx, [rsp + 0x1f0]
call fcn.140001534
nop
mov edi, 1
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140001180
nop
lea rcx, [rsp + 0x1f0]
call fcn.140012474
lea r10, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
cmovae r10, qword [rsp + 0x1d0]
lea rcx, [rsp + 0x1d0]
cmovae rcx, qword [rsp + 0x1d0]
mov rax, qword [rsp + 0x1e0]
lea rdx, [rcx + rax*2]
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x38], sil
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x68], sil
movdqa xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x80], sil
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rsi
mov byte [rsp + 0x98], sil
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x30]
mov rcx, r10
call fcn.1400041fc
test al, al
je 0x140001c5b
mov rcx, qword [rsp + 0x48]
mov r9, qword [rsp + 0x40]
sub rcx, r9
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, rdi
lea r8, [rsp + 0x90]
jbe 0x140001b53
lea r8, [r9 + 0x20]
mov r8, qword [r8]
lea rdx, [rsp + 0x88]
jbe 0x140001b64
lea rdx, [r9 + 0x18]
mov rdx, qword [rdx]
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], rsi
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], 7
mov word [rsp + 0x1f0], si
cmp rdx, r8
je 0x140001bac
sub r8, rdx
sar r8, 1
lea rcx, [rsp + 0x1f0]
call fcn.140012de0
nop
mov r9d, edi
mov r8d, edi
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0xe0]
call fcn.140007b68
nop
mov rdx, rbx
lea rcx, [rsp + 0xe0]
call fcn.140001234
nop
lea rcx, [rsp + 0x170]
call fcn.140008c80
lea rax, [rsp + 0x170]
mov qword [rsp + 0xa8], rax
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + 0x170], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x170]
call fcn.1400184ac
nop
lea rcx, [rsp + 0x1f0]
call fcn.140012474
nop
lea rcx, [rsp + 0x40]
call fcn.140012398
nop
lea rcx, [rsp + 0xb0]
call fcn.140008d0c
nop
lea rcx, [rsp + 0x1d0]
call fcn.140012474
mov al, dil
jmp 0x140001c83
lea rcx, [rsp + 0x40]
call fcn.140012398
nop
lea rcx, [rsp + 0xb0]
call fcn.140008d0c
nop
lea rcx, [rsp + 0x1d0]
call fcn.140012474
xor al, al
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140019c60
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000abd8
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x218]
sub rsp, 0x310
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140059088]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
mov dword [rsp + 0x34], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.14001ad60
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [rsp + 0x30], eax
test eax, eax
jns 0x14000ad47
call sub.base.dll_class_base::ILogger____ptr64___cdecl_base::get_log_instance_void_
mov rdi, rax
test rax, rax
je 0x14000ad47
mov rax, qword [rax]
lea edx, [rsi + 5]
mov rcx, rdi
call qword [rax + 0x30]
test al, al
je 0x14000ad47
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, vtable.fmt::BasicWriter_char_.0
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x78], rax
lea rax, vtable.fmt::BasicStringWriter_char__class_std::allocator_char__.0
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
lea rax, vtable.fmt::Buffer_char_.0
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
lea rax, vtable.fmt::internal::StringBuffer_char__class_std::allocator_char__.0
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], sil
mov qword [rbp - 0x40], rdi
lea rax, str.e:wegame_paas_tof_launcherpaas_client_corecodescommon_base_fs_utils_fs_op.h
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], 0x8e
lea rax, [0x14003c5b8]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], 5
lea r8, [rsp + 0x30]
lea rdx, str.GetAppDataPath_failed__hr:
lea rcx, [rsp + 0x60]
call fcn.140004c78
nop
lea rcx, [rsp + 0x60]
call fcn.1400094d8
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
lea rax, [rbp - 0x10]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x14000ad5e
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140012de0
mov dword [rsp + 0x34], 1
mov rax, rbx
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140019c60
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000b01c
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140059088]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14003d6e0]
movdqu xmmword [rsp + 0x38], xmm1
xor eax, eax
mov word [rsp + 0x28], ax
xor r8d, r8d
lea rdx, [0x14003ccf4]
lea rcx, [rsp + 0x28]
call fcn.140012de0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call sub.base.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_base::Application::GetExeDirSubPath_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const____ptr64_
nop
lea rcx, [rsp + 0x28]
call fcn.140012474
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop
lea rcx, [rsp + 0x48]
call fcn.140012474
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140019c60
add rsp, 0x78
ret
Function at 0x2281140
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, rdx
mov rdi, rcx
mov r10, rcx
lea r11, [rdx + 1]
mov esi, 0x56
lea rbp, [0x022a6a80]
nop dword [rax]
movzx r8d, byte [r11 - 1]
movzx r9d, byte [r11]
movzx edx, byte [r11 + 1]
mov eax, r8d
add r10, 4
add r11, 3
shr rax, 2
movzx eax, byte [rax + rbp]
mov byte [r10 - 4], al
movsx eax, r8b
and eax, 3
shl eax, 4
movsxd rcx, eax
mov eax, r9d
shr eax, 4
or rcx, rax
movzx eax, byte [rcx + rbp]
mov byte [r10 - 3], al
movsx eax, r9b
and eax, 0xf
shl eax, 2
movsxd rcx, eax
mov eax, edx
shr rax, 6
or rcx, rax
movzx eax, byte [rcx + rbp]
mov byte [r10 - 2], al
movsx rax, dl
and eax, 0x3f
dec rsi
movzx eax, byte [rax + rbp]
mov byte [r10 - 1], al
jne 0x2281170
movzx ecx, byte [rbx + 0x102]
movzx edx, byte [rbx + 0x103]
mov rbx, qword [rsp + 8]
mov eax, ecx
add r10, 4
shr rax, 2
movzx eax, byte [rax + rbp]
mov byte [r10 - 4], al
movsx eax, cl
and eax, 3
shl eax, 4
movsxd rcx, eax
mov eax, edx
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + rbp]
movsx ecx, dl
mov byte [r10 - 3], al
and ecx, 0xf
shl ecx, 2
movsxd rcx, ecx
movzx ecx, byte [rcx + rbp]
mov rbp, qword [rsp + 0x10]
mov byte [r10 - 2], cl
mov byte [r10 - 1], 0x3d
mov byte [r10], sil
mov rsi, qword [rsp + 0x18]
sub r10, rdi
mov rdi, qword [rsp + 0x20]
lea eax, [r10 + 1]
ret
Function at 0x22817d0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov edi, r8d
mov r14, rdx
mov r13, rcx
xor ebx, ebx
mov qword [rsp + 0x58], rbx
lea rcx, [0x022a6ae8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
lea rdx, str.RegCreateKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
lea rdx, str.RegSetValueExA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
lea rdx, str.RegDeleteKeyA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegDeleteValueA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegOpenKeyExA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
lea rdx, str.RegCloseKey
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rcx, 0xffffffff80000001
call qword [rsp + 0x60]
test eax, eax
jne 0x2281956
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, r13
mov rcx, 0xffffffff80000001
call qword [rsp + 0x68]
test eax, eax
jne 0x2281956
cmp edi, 2
jbe 0x228191f
cmp edi, 4
jne 0x2281956
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x58]
call r15
test eax, eax
jne 0x2281956
lea ebx, [rdi - 3]
jmp 0x2281956
mov r13, qword [rsp + 0xc8]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, edi
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x58]
call r15
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, 0xffffffff80000001
call r12
mov rcx, qword [rsp + 0x58]
call r12
test rsi, rsi
je 0x2281976
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x22819a0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x022ad190]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor edi, edi
lea rax, [0x022a6ba8]
mov rbx, rcx
mov qword [rcx], rax
mov dword [rcx + 0x20], edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
lea rax, [0x022a6ad0]
lea rdx, [rsp + 0x20]
mov qword [rcx + 8], rax
mov qword [rcx + 0x28], rax
mov dword [rcx + 0x40], edi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x48], rax
mov dword [rcx + 0x60], edi
mov qword [rcx + 0x50], rdi
mov qword [rcx + 0x58], rdi
mov qword [rcx + 0x118], rdi
mov dword [rcx + 0x120], edi
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, edi
xor edx, edx
mov qword [rbx + 0x100], rax
xchg dword [rbx + 0x108], ecx
lea rcx, [rbx + 0x80]
mov r8d, 0x80
mov qword [rbx + 0x78], 0xffffffffffffffff
mov qword [rbx + 0x68], rdi
mov qword [rbx + 0x70], rdi
call fcn.02295160
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.0228fda0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1d0
pop rdi
ret