joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14090d4c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14090d4cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14090d4dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14090d4c5
lea eax, [rcx + 1]
jmp 0x14090d4eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14090d4fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14090d4e4
sub eax, 3
jb 0x14090d51e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14090d56d
sar eax, 1
movsxd rbp, eax
jb 0x14090d554
jmp 0x14090d52c
add ebx, ebx
jne 0x14090d52a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14090d554
inc ecx
add ebx, ebx
jne 0x14090d53a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14090d554
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14090d54d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14090d53c
add ecx, 2
jmp 0x14090d559
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14090d482
jmp 0x14090d4cd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x903000]
mov eax, dword [rdi]
or eax, eax
je 0x14090d5cd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x9274d0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14090d57d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14090d5c7
mov qword [rbx], rax
add rbx, 8
jmp 0x14090d59d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14090d611
cmp al, 0xef
ja 0x14090d5f9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14090d5d9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14090d5e8
mov eax, dword [rdi]
add rdi, 4
jmp 0x14090d5e8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14090d690], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14090d690
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14090d680
sub rsp, 0xffffffffffffff80
jmp 0x1400013d0
Function at 0x14002bcf0
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
sub rsp, 0x28
lea rcx, [0x14016f25a]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14002bdd4
mov rsi, rax
lea rdx, str.MiniDumpWriteDump
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rdi
mov qword [0x14019d238], rax
lea rdx, str.StackWalk64
mov rcx, rsi
call rdi
mov qword [0x14019d240], rax
lea rdx, str.SymGetModuleBase64
mov rcx, rsi
call rdi
mov qword [0x14019d248], rax
lea rdx, str.SymGetSymFromAddr64
mov rcx, rsi
call rdi
mov qword [0x14019d250], rax
lea rdx, str.SymGetLineFromAddr64
mov rcx, rsi
call rdi
mov qword [0x14019d258], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, rsi
call rdi
mov qword [0x14019d260], rax
lea rdx, str.SymFunctionTableAccess64
mov rcx, rsi
call rdi
mov qword [0x14019d268], rax
lea rdx, str.SymSetOptions
mov rcx, rsi
call rdi
mov qword [0x14019d270], rax
lea rdx, str.SymInitialize
mov rcx, rsi
call rdi
mov qword [0x14019d278], rax
lea rdx, str.EnumerateLoadedModules64
mov rcx, rsi
call rdi
mov qword [0x14019d220], rax
cmp qword [0x14019d240], 0
je 0x14002be19
cmp qword [0x14019d278], 0
je 0x14002be19
cmp qword [0x14019d270], 0
je 0x14002be19
cmp qword [0x14019d238], 0
je 0x14002be19
cmp byte [0x14019d228], 1
jne 0x14002be21
lea rcx, [0x14019d1e0]
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
add rsp, 0x28
pop rdi
pop rsi
ret
cmp byte [0x14019da80], 0
jne 0x14002be3e
lea rcx, [0x14019d1e0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x14019da80], 1
lea rcx, [0x14019d1e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [0x14019d228], 1
lea rcx, [0x14002c780]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [0x14019d230], rax
lea rcx, [0x14002d660]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]

Function at 0x14002be80
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x20
movups xmm0, xmmword [rcx]
movups xmmword [0x14019d208], xmm0
test dl, dl
jne 0x14002bea5
lea rcx, str.LLVM_DISABLE_CRASH_REPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002beaa
call fcn.14002f5e0
lea rdx, [0x14002bce0]
mov ecx, 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_signal]
mov rsi, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_abort_behavior]
xor ecx, ecx
mov edx, 1
call rsi
xor ecx, ecx
mov edx, 2
call rsi
mov ecx, 0x8003
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__set_error_mode]
call fcn.14002bcf0
lea rcx, [0x14019d1e0]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14002d7c0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x490], rax
test rcx, rcx
je 0x14002d895
mov r12, rdx
mov rbx, rcx
mov dword [rsp + 0x4c], 0
lea rsi, [rsp + 0x4c]
mov qword [rsp + 0x30], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, str.DumpFolder
xor edi, edi
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14002d8ff
mov edi, dword [rsp + 0x4c]
lea r14, [rsp + 0x288]
mov qword [rsp + 0x270], r14
mov qword [rsp + 0x280], 0x104
cmp rdi, 0x105
jb 0x14002d899
mov qword [rsp + 0x278], 0
lea rcx, [rsp + 0x270]
mov r9d, 2
mov rdx, r14
mov r8, rdi
call fcn.1400291c0
mov rcx, qword [rsp + 0x270]
lea r8, [rdi + rdi]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x270]
jmp 0x14002d8b3
xor edi, edi
jmp 0x14002d8ff
test edi, edi
je 0x14002d8b0
lea rcx, [rsp + 0x288]
lea r8, [rdi + rdi]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, r14
mov qword [rsp + 0x278], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r8, str.DumpFolder
xor edi, edi
mov rcx, rbx
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14002d922
mov rcx, qword [rsp + 0x270]
cmp rcx, r14
je 0x14002d8ff
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.14016a260
mov eax, edi
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x270]
xor edi, edi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14002d8ec
mov ebx, eax
mov edi, eax
lea r15, [rsp + 0x68]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], 0x104
cmp eax, 0x105
jb 0x14002d98f
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x50]
mov r9d, 2
mov rdx, r15
mov r8, rdi
call fcn.1400291c0
mov rcx, qword [rsp + 0x50]
lea r8, [rdi + rdi]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rsp + 0x50]
jmp 0x14002d9a2
lea rcx, [rsp + 0x68]
lea r8, [rdi + rdi]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, r15
mov qword [rsp + 0x58], rdi
mov rcx, qword [rsp + 0x270]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp ebx, eax
jne 0x14002d9df
add ebx, 0xffffffff
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
mov r8, rbx
mov r9, r12
call fcn.1400363e0
cmp dword [rsp + 0x38], 0
sete dil
jmp 0x14002d9e1
xor edi, edi
mov rcx, qword [rsp + 0x50]
cmp rcx, r15
je 0x14002d8ec
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14002d8ec
Function at 0x14002f2d0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4c8
movaps xmmword [rsp + 0x4b0], xmm6
mov r13, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x4a8], rax
lea r15, [rsp + 0x3a8]
mov qword [rsp + 0x390], r15
movaps xmm0, xmmword [0x14016ddb0]
movups xmmword [rsp + 0x398], xmm0
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x170]
lea rdx, [rsp + 0x20]
lea r8, [rsp + 0x390]
call fcn.140036220
cmp dword [rsp + 0x170], 0
je 0x14002f35a
mov byte [r13], 0
mov byte [r13 + 0x20], 0
jmp 0x14002f4e9
lea r12, [rsp + 0x188]
mov qword [rsp + 0x170], r12
movaps xmm6, xmmword [0x14016f070]
movups xmmword [rsp + 0x178], xmm6
mov eax, 0x104
lea rbx, [rsp + 0x170]
mov rdi, qword [sym.imp.KERNEL32.dll_SetLastError]
mov rsi, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x104
jmp 0x14002f3e4
xor ecx, ecx
call rdi
mov r8d, dword [rsp + 0x180]
mov rdx, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x390]
call rsi
mov ebp, eax
test eax, eax
je 0x14002f400
mov r8d, ebp
mov rax, qword [rsp + 0x180]
cmp rax, r8
jae 0x14002f419
cmp rax, r8
jae 0x14002f3b0
mov r9d, 2
mov rcx, rbx
mov rdx, r12
call fcn.1400291c0
jmp 0x14002f3b0
call r14
cmp eax, 0xcb
jne 0x14002f3d4
mov byte [r13], 0
mov byte [r13 + 0x20], 0
jmp 0x14002f4d6
mov qword [rsp + 0x178], r8
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x50], rbp
movups xmmword [rsp + 0x58], xmm6
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x50]
call fcn.1400363e0
cmp dword [rsp + 0x30], 0
je 0x14002f45a
mov byte [r13], 0
mov byte [r13 + 0x20], 0
jmp 0x14002f4c6
mov r14, qword [rsp + 0x50]
movaps xmm0, xmmword [0x14016c7a0]
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbx, rax
cmp rax, 0xf
jbe 0x14002f493
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov r9, r14
call fcn.1400058f0
jmp 0x14002f4ad
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rbx + 0x30], 0
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [r13 + 0x10], xmm1
movups xmmword [r13], xmm0
mov byte [r13 + 0x20], 1
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x14002f4d6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x170]
cmp rcx, r12
je 0x14002f4e9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x390]
cmp rcx, r15
je 0x14002f4fc
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x4a8]
xor rcx, rsp
call fcn.14016a260
mov rax, r13
movaps xmm6, xmmword [rsp + 0x4b0]
add rsp, 0x4c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14002f540
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x14019db4c]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x14002f59a
and byte [rsi + 8], 0xfe
mov eax, dword [0x14019db48]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14016a260
mov rax, rsi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x14019db4c]
call fcn.14016a3dc
cmp dword [0x14019db4c], 0xffffffff
jne 0x14002f578
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x2c]
mov dword [0x14019db48], eax
lea rcx, [0x14019db4c]
call fcn.14016a37c
jmp 0x14002f578
Function at 0x140030690
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400306fa
mov rdi, qword [rsp + 0x28]
lea r8, [rsp + 0x38]
mov rcx, rdi
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebx, eax
mov esi, dword [rsp + 0x38]
test rdi, rdi
je 0x1400306f6
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
jne 0x140030723
mov eax, dword [0x14019db54]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x14003073a
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov esi, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14016a260
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14019db54]
call fcn.14016a3dc
cmp dword [0x14019db54], 0xffffffff
jne 0x14003071b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
mov eax, dword [0x14019d000]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x1400307f3
mov rax, qword [rsp + 0x30]
rol rax, 0x20
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], esi
mov rcx, qword [rsp + 0x3c]
lea rdx, [rcx + 0xc]
rol rdx, 0x34
xor rax, qword [0x14019cff8]
xor rax, rdx
movabs rbx, 0x9ddfea08eb382d69
imul rax, rbx
mov rdi, rax
shr rdi, 0x2f
xor rax, rdx
xor rax, rdi
imul rax, rbx
mov rdx, rax
shr rdx, 0x2f
xor edx, eax
imul eax, edx, 0xeb382d69
xor ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [0x14019db54]
call fcn.14016a37c
jmp 0x14003071b
lea rcx, [0x14019d000]
call fcn.14016a3dc
cmp dword [0x14019d000], 0xffffffff
jne 0x140030783
mov rax, qword [0x14019db68]
test rax, rax
movabs rcx, 0xff51afd7ed558ccd
cmovne rcx, rax
mov qword [0x14019cff8], rcx
lea rcx, [0x14019d000]
call fcn.14016a37c
jmp 0x140030783

Function at 0x140032850
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, r8d
mov rdi, rdx
mov qword [rdx + 8], 0
call fcn.140040450
mov rcx, rdi
mov edx, esi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140032880
Function at 0x140035330
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x250
mov r14, rdx
mov r15, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [0x14016f070]
movups xmmword [rsp + 0x30], xmm0
mov eax, 0x104
mov ecx, 0x104
lea rbx, [rsp + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop word cs:[rax + rax]
nop dword [rax]
mov r8d, eax
cmp rcx, r8
jae 0x1400353ae
mov r9d, 2
mov rcx, rbx
mov rdx, rdi
call fcn.1400291c0
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x28]
call rsi
test eax, eax
je 0x1400353e4
mov r9d, eax
mov rcx, qword [rsp + 0x38]
cmp rcx, r9
jb 0x140035390
mov qword [rsp + 0x30], r9
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x20], r14
mov rcx, r15
mov edx, 0xfde9
call fcn.140039f50
jmp 0x1400353f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r15
mov edx, eax
call fcn.14002e8d0
mov rcx, qword [rsp + 0x28]
cmp rcx, rdi
je 0x140035404
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
call fcn.14016a260
mov rax, r15
add rsp, 0x250
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140035890
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x140
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x138], rax
lea rdi, [rsp + 0x38]
mov qword [rsp + 0x20], rdi
movaps xmm0, xmmword [0x14016ddb0]
movups xmmword [rsp + 0x28], xmm0
lea r8, [rsp + 0x20]
mov r9d, 0xf8
call fcn.140035ea0
cmp dword [rsi], 0
jne 0x140035931
mov rcx, qword [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400358ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14003595f
test bl, bl
je 0x14003595f
mov dword [rsi], 0
mov eax, dword [0x14019c710]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x14003596b
lea rax, [0x14019a518]
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x20]
cmp rcx, rdi
je 0x140035941
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14016a260
mov rax, rsi
add rsp, 0x140
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
mov edx, eax
call fcn.14002e8d0
jmp 0x140035931
lea rcx, [0x14019c710]
call fcn.14016a3dc
cmp dword [0x14019c710], 0xffffffff
jne 0x140035926
lea rcx, [0x14003a600]
call fcn.14016a724
lea rcx, [0x14019c710]
call fcn.14016a37c
jmp 0x140035926
Function at 0x140036440
Capabilities:
Set current directory

Disassembly:
push rsi
push rdi
sub rsp, 0x148
mov rsi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x28], rdi
movaps xmm0, xmmword [0x14016ddb0]
movups xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x28]
mov r9d, 0x104
call fcn.140035ea0
cmp dword [rsi], 0
jne 0x1400364dc
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x1400364cc
mov dword [rsi], 0
mov eax, dword [0x14019c710]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140036509
lea rax, [0x14019a518]
mov qword [rsi + 8], rax
jmp 0x1400364dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.14002e8d0
mov rcx, qword [rsp + 0x28]
cmp rcx, rdi
je 0x1400364ec
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14016a260
mov rax, rsi
add rsp, 0x148
pop rdi
pop rsi
ret
lea rcx, [0x14019c710]
call fcn.14016a3dc
cmp dword [0x14019c710], 0xffffffff
jne 0x1400364bf
lea rcx, [0x14003a600]
call fcn.14016a724
lea rcx, [0x14019c710]
call fcn.14016a37c
jmp 0x1400364bf
Function at 0x140036990
Capabilities:
Get disk information

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
mov r14, r8
mov rbx, rdx
mov r12, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea r15, [rsp + 0x40]
mov qword [rsp + 0x28], r15
movaps xmm0, xmmword [0x14016ddb0]
movups xmmword [rsp + 0x30], xmm0
mov edi, 0x80
mov rsi, qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov rbp, qword [sym.imp.KERNEL32.dll_GetLastError]
lea r13, [rsp + 0x28]
xor r8d, r8d
cmp r8, rdi
jbe 0x140036a10
nop word cs:[rax + rax]
nop
mov qword [rsp + 0x30], rdi
mov r8, rdi
jmp 0x140036a60
jae 0x140036a60
cmp qword [rsp + 0x38], rdi
jae 0x140036a32
mov r9d, 2
mov rcx, r13
mov rdx, r15
mov r8, rdi
call fcn.1400291c0
mov r8, qword [rsp + 0x30]
mov rax, rdi
sub rax, r8
je 0x140036a00
add r8, r8
add r8, qword [rsp + 0x28]
add rax, rax
mov rcx, r8
xor edx, edx
mov r8, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x140036a00
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rbx]
call rsi
test eax, eax
jne 0x140036a87
call rbp
cmp eax, 0x7a
jne 0x140036ae4
add rdi, rdi
mov r8, qword [rsp + 0x30]
cmp r8, rdi
jbe 0x140036a10
jmp 0x140036a00
mov rax, qword [rsp + 0x30]
lea r8, [rax + 1]
cmp r8, qword [rsp + 0x38]
ja 0x140036b96
mov rcx, qword [rsp + 0x28]
mov word [rcx + rax*2], 0
add qword [rsp + 0x30], 1
mov rsi, qword [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov qword [rsp + 0x30], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [rax - 4]
cmp ecx, 3
jb 0x140036af0
cmp eax, 2
je 0x140036af0
cmp eax, 3
jne 0x140036b64
mov byte [r14], 1
jmp 0x140036af4
mov rcx, r12
mov edx, eax
call fcn.14002e8d0
jmp 0x140036b2d
mov byte [r14], 0
mov dword [r12], 0
mov eax, dword [0x14019c710]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140036bb3
lea rax, [0x14019a518]
mov qword [r12 + 8], rax
mov rcx, qword [rsp + 0x28]
cmp rcx, r15
je 0x140036b3d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14016a260
mov rax, r12
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140036be9
mov dword [r12], 2
lea rax, [0x14019a3c0]
jmp 0x140036b28
lea rcx, [rsp + 0x28]
mov r9d, 2
mov rdx, r15
call fcn.1400291c0
mov rax, qword [rsp + 0x30]
jmp 0x140036a9b
lea rcx, [0x14019c710]
call fcn.14016a3dc
cmp dword [0x14019c710], 0xffffffff
jne 0x140036b21
lea rcx, [0x14003a600]
call fcn.14016a724
lea rcx, [0x14019c710]
call fcn.14016a37c
jmp 0x140036b21
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x140036b85
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x140036b85
Function at 0x1400378e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x140
mov edi, r8d
mov rsi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x138], rax
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x20], rbx
movaps xmm0, xmmword [0x14016ddb0]
movups xmmword [rsp + 0x28], xmm0
lea r8, [rsp + 0x20]
mov r9d, 0x104
call fcn.140035ea0
cmp dword [rsi], 0
jne 0x140037a17
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140037995
mov dword [rsi], 0
cmp edi, 1
jne 0x1400379eb
and eax, 1
je 0x1400379eb
mov qword [rsi + 8], 0
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140037a51
mov dword [rsi], 0xd
lea rax, [0x14019a3c0]
jmp 0x140037a13
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
cmp ecx, 2
jne 0x140037a45
mov dword [rsi], 0
mov qword [rsi + 8], 0
mov eax, dword [0x14019ced8]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140037abd
mov dword [rsi], 2
lea rax, [0x14019a3c0]
jmp 0x140037a13
mov eax, dword [0x14019c710]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140037a87
lea rax, [0x14019a518]
mov qword [rsi + 8], rax
mov rcx, qword [rsp + 0x20]
cmp rcx, rbx
je 0x140037a27
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14016a260
mov rax, rsi
add rsp, 0x140
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
mov edx, eax
call fcn.14002e8d0
jmp 0x140037a17
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x140037986
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x140037986
lea rcx, [0x14019c710]
call fcn.14016a3dc
cmp dword [0x14019c710], 0xffffffff
jne 0x140037a0c
lea rcx, [0x14003a600]
call fcn.14016a724
lea rcx, [0x14019c710]
call fcn.14016a37c
jmp 0x140037a0c
lea rcx, [0x14019ced8]
call fcn.14016a3dc
cmp dword [0x14019ced8], 0xffffffff
jne 0x1400379dc
lea rcx, [0x14003a0a0]
call fcn.14016a724
lea rcx, [0x14019ced8]
call fcn.14016a37c
jmp 0x1400379dc