joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065220
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x180
mov qword [rsp + 0x178], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x190]
call fcn.140065550
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x190]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14006530c
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xc0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x90]
call fcn.140011d00
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.cannot_stop_service
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0xf0], rcx
mov r8, qword [rsp + 0xf0]
lea rdx, str.cannot_stop_service
lea rcx, [rsp + 0x90]
call fcn.1400128b0
nop
xor r9d, r9d
mov r8, qword [rsp + 0x190]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.14003e0c0
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0x40]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x90]
call fcn.140011d00
nop
add rsp, 0x180
pop rdi
ret

Function at 0x140065320
Capabilities:
Modify service

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x1a0], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x1c0]
call fcn.140065550
mov eax, dword [rsp + 0x1c8]
mov dword [rsp + 0x1a8], eax
cmp dword [rsp + 0x1a8], 0
je 0x140065378
cmp dword [rsp + 0x1a8], 1
je 0x140065382
cmp dword [rsp + 0x1a8], 2
je 0x14006538c
jmp 0x140065396
mov dword [rsp + 0x60], 2
jmp 0x14006539e
mov dword [rsp + 0x60], 3
jmp 0x14006539e
mov dword [rsp + 0x60], 4
jmp 0x14006539e
mov dword [rsp + 0x60], 0xffffffff
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8d, dword [rsp + 0x60]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1c0]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1400654a1
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.140011d00
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.cannot_change_service_startup_mode
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x118], rcx
mov r8, qword [rsp + 0x118]
lea rdx, str.cannot_change_service_startup_mode
lea rcx, [rsp + 0xb8]
call fcn.1400128b0
nop
xor r8d, r8d
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x68]
call fcn.14003e070
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0x68]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb8]
call fcn.140011d00
nop
add rsp, 0x1b0
pop rdi
ret
Function at 0x140065960
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x30], 0xffffffffffffffff
jne 0x140065984
xor al, al
jmp 0x140065a64
cmp qword [rsp + 0x88], 0
jne 0x140065a2a
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x4c], 0x7530
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x54], 0x493e0
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x5c], 0x124f80
mov dword [rsp + 0x20], 0x15180
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x20]
mov edx, 2
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
cmp eax, 1
jne 0x140065a1a
mov dword [rsp + 0x60], 1
jmp 0x140065a22
mov dword [rsp + 0x60], 0
mov al, byte [rsp + 0x60]
jmp 0x140065a64
mov r8, qword [rsp + 0x88]
mov edx, 2
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
cmp eax, 1
jne 0x140065a58
mov dword [rsp + 0x64], 1
jmp 0x140065a60
mov dword [rsp + 0x64], 0
mov al, byte [rsp + 0x64]
add rsp, 0x78
ret

Function at 0x140065a70
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov qword [rsp + 0xb0], 0xfffffffffffffffe
cmp qword [rsp + 0xe8], 0
jne 0x140065a9f
xor al, al
jmp 0x140065b54
lea rax, [rsp + 0x51]
mov qword [rsp + 0x58], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0xe8]
call fcn.140044090
cmp qword [rsp + 0x40], 8
jb 0x140065ae2
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xb8], rax
jmp 0x140065aef
lea rax, [rsp + 0x28]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x48]
mov edx, 1
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
cmp eax, 1
jne 0x140065b2a
mov dword [rsp + 0xc0], 1
jmp 0x140065b35
mov dword [rsp + 0xc0], 0
movzx eax, byte [rsp + 0xc0]
mov byte [rsp + 0x50], al
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400010c0
mov al, byte [rsp + 0x50]
add rsp, 0xd8
ret
Function at 0x1400dfccc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400dfb34

Function at 0x1400e0754
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400e07dd
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400e079f
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400e07ed
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x1400e07b5
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400e07ed
cmp dword [rax + 0x84], 0xe
ja 0x1400e07c9
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x1400e07ed
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x1400e07ed
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.140291000
test eax, eax
jne 0x1400e081d
cmp dword [0x1401e1fa8], 1
jne 0x1400e0809
call fcn.1400e78a8
mov ecx, 0x1c
call fcn.1400e7680
mov ecx, 0xff
call fcn.1400df9e4
call fcn.1400e8da4
test eax, eax
jne 0x1400e0848
cmp dword [0x1401e1fa8], 1
jne 0x1400e0834
call fcn.1400e78a8
mov ecx, 0x10
call fcn.1400e7680
mov ecx, 0xff
call fcn.1400df9e4
call fcn.1400eaef0
nop
call fcn.1400e65e0
test eax, eax
jns 0x1400e0861
mov ecx, 0x1b
call fcn.1400df978
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x1401e4600], rax
call fcn.1400ebd24
mov qword [0x1401e1fa0], rax
call fcn.1400ebc34
test eax, eax
jns 0x1400e088c
mov ecx, 8
call fcn.1400df978
call fcn.1400eb964
test eax, eax
jns 0x1400e089f
mov ecx, 9
call fcn.1400df978
mov ecx, 1
call fcn.1400dfa84
test eax, eax
je 0x1400e08b4
mov ecx, eax
call fcn.1400df978
call fcn.1400eb908
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call fcn.140015220
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x1400e08eb
mov ecx, eax
call fcn.1400dfcc0
call fcn.1400dfcd8
jmp 0x1400e090c
mov eax, edi
jmp 0x1400e0915
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1400ebdb8
add rsp, 0x28
jmp 0x1400e0754
Function at 0x1400e5ddb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401dd3a0]
jne 0x1400dd79a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400dd796
repz ret
ror rcx, 0x10
jmp 0x1400e5d34
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1401e2070]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1401e2168]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400e5db9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1401e2070]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400e5ddb
mov rax, qword [rsp + 0x88]
mov qword [0x1401e2168], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1401e2108], rax
mov rax, qword [0x1401e2168]
mov qword [0x1401e1fe0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1401e20f0], rax
mov dword [0x1401e1fd0], 0xc0000409
mov dword [0x1401e1fd4], 1
mov rax, qword [0x1401dd3a0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401dd3a8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1401e2068], eax
mov ecx, 1
call fcn.1400e9984
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1401929b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1401e2068], 0
jne 0x1400e5e62
mov ecx, 1
call fcn.1400e9984
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400f7870
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400e8a7c
xor ebx, ebx
mov rdi, rax
cmp qword [0x1401e2e28], rbx
jne 0x1400f7976
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400f7a4b
lea rdx, [0x140194ba8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400f7a4b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1401e2e28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1401e2e30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1401e2e38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1401e2e48], rax
test rax, rax
je 0x1400f796d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1401e2e40], rax
jmp 0x1400f797d
mov rax, qword [0x1401e2e40]
jmp 0x1400f7984
mov rax, qword [0x1401e2e40]
mov r11, qword [0x1401e2e48]
cmp rax, rdi
je 0x1400f79ec
cmp r11, rdi
je 0x1400f79ec
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1401e2e48]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1400f79ec
test rax, rax
je 0x1400f79ec
call rsi
test rax, rax
je 0x1400f79e6
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400f79e6
test byte [rsp + 0x38], 1
jne 0x1400f79ec
bts ebp, 0x15
jmp 0x1400f7a2a
mov rcx, qword [0x1401e2e30]
cmp rcx, rdi
je 0x1400f7a2a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f7a2a
call rax
mov rbx, rax
test rax, rax
je 0x1400f7a2a
mov rcx, qword [0x1401e2e38]
cmp rcx, rdi
je 0x1400f7a2a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f7a2a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401e2e28]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400f7a4b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400f7a4d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140103100
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1f0
mov qword [rsp + 0x1d8], 0xfffffffffffffffe
mov dword [rsp + 0xe0], 0
lea rax, [rsp + 0xe4]
mov qword [rsp + 0xe8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.140011d00
nop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jbe 0x140103334
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x58], rax
mov eax, 2
mul qword [rsp + 0xf8]
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.1400dd688
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x100], rax
mov rdx, qword [rsp + 0x100]
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jbe 0x14010331a
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x50], eax
ja 0x14010331a
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x108], rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x108]
call fcn.1400442b0
mov eax, dword [rsp + 0x50]
sub eax, 1
mov eax, eax
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x110], rax
jbe 0x14010322b
call fcn.1400deebc
cmp qword [rsp + 0x48], 0x10
jb 0x140103242
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x1e0], rax
jmp 0x14010324f
lea rax, [rsp + 0x30]
mov qword [rsp + 0x1e0], rax
mov rcx, qword [rsp + 0x110]
mov rax, qword [rsp + 0x1e0]
add rax, rcx
movsx eax, byte [rax]
cmp eax, 0x5c
je 0x1401032a4
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [0x140185e4c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x118], rcx
mov r8, qword [rsp + 0x118]
lea rdx, [0x140185e4c]
lea rcx, [rsp + 0x28]
call fcn.14002d980
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x200]
call fcn.140011d00
mov r9, qword [0x14019e5a0]
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x200]
call fcn.140011b30
mov eax, dword [rsp + 0xe0]
or eax, 1
mov dword [rsp + 0xe0], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x120], rax
mov rcx, qword [rsp + 0x120]
call fcn.1400df11c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.140011d00
mov rax, qword [rsp + 0x200]
jmp 0x1401033dd
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x148], rax
mov rcx, qword [rsp + 0x148]
call fcn.1400df11c
lea rax, [rsp + 0x150]
mov qword [rsp + 0x158], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.140011d00
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.Cannot_get_current_directory
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x180], rcx
mov r8, qword [rsp + 0x180]
lea rdx, str.Cannot_get_current_directory
lea rcx, [rsp + 0xb8]
call fcn.1400128b0
nop
xor r8d, r8d
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x68]
call fcn.14003e070
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0x68]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb8]
call fcn.140011d00
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x28]
call fcn.140011d00
nop
add rsp, 0x1f0
pop rdi
ret
Function at 0x140103670
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x1e0
mov qword [rsp + 0x1d0], 0xfffffffffffffffe
mov dword [rsp + 0xd8], 0
mov qword [rsp + 0x28], 0x7fff
mov ecx, 0x7fff
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.1400dd688
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0xe8]
mov ecx, dword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jbe 0x140103863
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x100], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.140011d00
nop
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x108], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x108]
call fcn.1400442b0
mov eax, dword [rsp + 0x20]
sub eax, 1
mov eax, eax
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x110], rax
jbe 0x140103774
call fcn.1400deebc
cmp qword [rsp + 0x58], 0x10
jb 0x14010378b
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x1d8], rax
jmp 0x140103798
lea rax, [rsp + 0x40]
mov qword [rsp + 0x1d8], rax
mov rcx, qword [rsp + 0x110]
mov rax, qword [rsp + 0x1d8]
add rax, rcx
movsx eax, byte [rax]
cmp eax, 0x5c
je 0x1401037ed
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [0x140185e4c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x118], rcx
mov r8, qword [rsp + 0x118]
lea rdx, [0x140185e4c]
lea rcx, [rsp + 0x38]
call fcn.14002d980
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1f0]
call fcn.140011d00
mov r9, qword [0x14019e5a0]
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x1f0]
call fcn.140011b30
mov eax, dword [rsp + 0xd8]
or eax, 1
mov dword [rsp + 0xd8], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x38]
call fcn.140011d00
nop
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x160], rax
mov rcx, qword [rsp + 0x160]
call fcn.1400df11c
mov rax, qword [rsp + 0x1f0]
jmp 0x140103917
lea rax, [rsp + 0x168]
mov qword [rsp + 0x170], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140011d00
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, str.Cannot_get_current_directory
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x198], rcx
mov r8, qword [rsp + 0x198]
lea rdx, str.Cannot_get_current_directory
lea rcx, [rsp + 0xb0]
call fcn.1400128b0
nop
xor r8d, r8d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x60]
call fcn.14003e070
lea rdx, [0x1401d8ba0]
lea rcx, [rsp + 0x60]
call fcn.1400e0fa4
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb0]
call fcn.140011d00
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x1c8], rax
mov rcx, qword [rsp + 0x1c8]
call fcn.1400df11c
nop
add rsp, 0x1e0
pop rdi
ret
Function at 0x1401039c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov qword [rsp + 0x158], 0xfffffffffffffffe
mov dword [rsp + 0x88], 0
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x90], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x188]
call fcn.140043d00
mov qword [rsp + 0x50], 0x7fff
mov ecx, 0x7fff
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call fcn.1400dd688
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0x40], 8
jb 0x140103a89
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x160], rax
jmp 0x140103a96
lea rax, [rsp + 0x28]
mov qword [rsp + 0x160], rax
mov r8d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jbe 0x140103bec
mov ecx, dword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
sub rax, 1
cmp rcx, rax
jae 0x140103bec
mov eax, dword [rsp + 0x48]
add eax, 1
mov eax, eax
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0xb0], rax
jb 0x140103b12
mov r8d, 0x69
lea rdx, str....._src_thirdpartypocoFoundationincludePoco_Buffer.h
lea rcx, str.index____size
call fcn.140044860
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
mov rax, qword [rsp + 0xb0]
mov word [rdx + rax*2], cx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xc0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140011d00
nop
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0xc8]
call fcn.1400442b0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x180]
call fcn.140011d00
mov r9, qword [0x14019e5a0]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x180]
call fcn.140011b30
mov eax, dword [rsp + 0x88]
or eax, 1
mov dword [rsp + 0x88], eax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.140011d00
nop
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xd0]
call fcn.1400df11c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400010c0
mov rax, qword [rsp + 0x180]
jmp 0x140103c8c
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x180]
call fcn.140011d00
mov r9, qword [0x14019e5a0]
xor r8d, r8d
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
call fcn.140011b30
mov eax, dword [rsp + 0x88]
or eax, 1
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
call fcn.1400df11c
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400010c0
mov rax, qword [rsp + 0x180]
jmp 0x140103c8c
add rsp, 0x178
ret
Function at 0x140103ca0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x348
mov qword [rsp + 0x328], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x350]
call fcn.140058710
lea rdx, [rsp + 0x40]
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x28]
cmp rax, 0x100
jbe 0x140103cfd
mov qword [rsp + 0x330], 0x100
jmp 0x140103d09
mov eax, dword [rsp + 0x28]
mov qword [rsp + 0x330], rax
mov rax, qword [rsp + 0x330]
lea rax, [rsp + rax*2 + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jae 0x140103e26
lea rax, [rsp + 0x210]
mov qword [rsp + 0x218], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x140]
call fcn.1400010c0
nop
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x20], rax
jae 0x140103da1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
test eax, eax
je 0x140103da1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
mov word [rsp + 0x24a], ax
movzx r8d, word [rsp + 0x24a]
mov edx, 1
lea rcx, [rsp + 0x140]
call fcn.140037400
mov rax, qword [rsp + 0x20]
add rax, 2
mov qword [rsp + 0x20], rax
jmp 0x140103d4e
lea rax, [rsp + 0x24c]
mov qword [rsp + 0x250], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x168]
call fcn.140011d00
nop
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x140]
call fcn.1400440e0
lea rdx, [rsp + 0x168]
mov rcx, qword [rsp + 0x350]
call fcn.140051c00
mov rax, qword [rsp + 0x20]
add rax, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x168]
call fcn.140011d00
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x140]
call fcn.1400010c0
jmp 0x140103d1b
add rsp, 0x348
ret

Function at 0x14010c0c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x20], 0
jne 0x14010c0df
mov dword [rsp + 0x30], 1
jmp 0x14010c0e7
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x14010c109
mov r8d, reloc.WS2_32.dll_WSACleanup
lea rdx, str.c:_forjenkins_basefolderwebprotepp_src_thirdpartypoco_foundation_srcFile_WIN32U.cpp
lea rcx, str.__path.empty__
call fcn.140044860
mov rax, qword [rsp + 0x60]
add rax, 0x30
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 8
jb 0x14010c133
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
jmp 0x14010c141
mov rax, qword [rsp + 0x28]
add rax, 8
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14010c191
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 2
jb 0x14010c183
cmp dword [rsp + 0x40], 3
jbe 0x14010c17f
cmp dword [rsp + 0x40], 0xf
je 0x14010c17f
cmp dword [rsp + 0x40], 0x15
je 0x14010c17f
jmp 0x14010c183
xor al, al
jmp 0x14010c193
mov rcx, qword [rsp + 0x60]
add rcx, 8
call fcn.14010d480
mov al, 1
add rsp, 0x58
ret