joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084e30
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, qword [rsp + 0xe0]
xor r15d, r15d
mov rsi, rcx
mov r14, r8
mov ebp, r9d
test rdi, rdi
je 0x140084e7c
mov dword [rdi], r15d
mov qword [rsp + 0x88], rbx
test rsi, rsi
je 0x140084fdf
mov rsi, qword [rsi]
test r14, r14
je 0x140084fdf
test ebp, ebp
jne 0x140084ea4
xor eax, eax
jmp 0x140084fe4
mov qword [rsp + 0x80], r12
mov dword [rsp + 0x50], r15d
cmp rsi, 0xffffffffffffffff
je 0x140084fce
mov rax, qword [0x14017fac0]
mov ebx, r15d
mov r12d, 0x103
test rax, rax
je 0x140084f56
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
xor r9d, r9d
mov dword [rsp + 0x30], ebp
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x58], rdx
xor r8d, r8d
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call qword [case.0x1400a96cf.0]
mov ebx, eax
cmp eax, r12d
jne 0x140084f36
mov rax, qword [0x14017fa80]
test rax, rax
je 0x140084f40
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [case.0x1400a96cf.0]
test eax, eax
mov ebx, eax
cmovns ebx, dword [rsp + 0x60]
test ebx, ebx
jne 0x140084f40
mov eax, dword [rsp + 0x68]
jmp 0x140084fb0
mov rax, qword [0x14017faa8]
test rax, rax
je 0x140084fa8
mov ecx, ebx
call qword [case.0x1400a96cf.0]
jmp 0x140084fa6
mov rax, rdx
lea r8, [rsp + 0x58]
sar rax, 0x20
xor r9d, r9d
mov rcx, rsi
mov dword [rsp + 0x58], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140084f83
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x140084fd3
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], r15
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140084fac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x140084fd3
mov eax, dword [rsp + 0x50]
test rdi, rdi
je 0x140084fb7
mov dword [rdi], eax
cmp eax, ebp
je 0x140084fd3
test rdi, rdi
cmove ebx, r12d
mov r12, qword [rsp + 0x80]
mov eax, ebx
jmp 0x140084fe4
mov ebx, 0x57
mov r12, qword [rsp + 0x80]
mov eax, ebx
jmp 0x140084fe4
mov eax, 0x57
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140085010
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r15, qword [rsp + 0xd0]
mov r14, r9
mov eax, r14d
xor edi, edi
cmp rax, r9
mov qword [rsp + 0x38], r15
lea rax, [r11 - 0x60]
mov esi, r14d
mov r12d, 0x80000000
mov qword [rsp + 0x20], rax
cmovne esi, r12d
mov r13, rcx
mov r9d, esi
mov rbp, r8
call fcn.140084e30
mov ebx, eax
mov eax, dword [rsp + 0x48]
sub r14, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r14
mov ecx, eax
je 0x140085152
test ebx, ebx
jne 0x140085152
cmp eax, esi
jne 0x140085152
lea r15, [rax + rbp]
mov esi, edi
nop
mov eax, r14d
mov ebp, r14d
cmp rax, r14
cmovne ebp, r12d
mov r12d, edi
test r13, r13
je 0x140085138
mov rcx, qword [r13]
test r15, r15
je 0x140085138
test ebp, ebp
jne 0x1400850d9
mov ebx, edi
mov rax, rdi
jmp 0x140085125
mov dword [rsp + 0x48], edi
cmp rcx, 0xffffffffffffffff
je 0x140085112
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, r15
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14008510b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x140085117
mov r12d, dword [rsp + 0x48]
jmp 0x140085117
mov ebx, 0x57
mov eax, r12d
add rsi, rax
test ebx, ebx
jne 0x14008513d
cmp eax, ebp
jne 0x14008513d
add r15, rax
sub r14, rax
je 0x14008513d
mov r12d, 0x80000000
jmp 0x1400850b0
mov ebx, 0x57
mov r14, qword [rsp + 0x30]
mov rdi, rsi
mov r15, qword [rsp + 0x38]
sub r14, rsi
mov rcx, qword [rsp + 0x40]
add rdi, rcx
test r15, r15
je 0x14008515f
mov qword [r15], rdi
jmp 0x14008516e
test r14, r14
je 0x14008516e
test ebx, ebx
mov eax, 0x103
cmove ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140085190
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
test byte [rsp + 0x58], 6
mov rax, qword [rsp + 0x50]
je 0x14008521a
test rax, rax
je 0x140085206
mov rcx, qword [rax]
xor eax, eax
mov dword [rsp + 0x34], eax
cmp rcx, 0xffffffffffffffff
je 0x140085206
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r8d, [rax + 1]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14008521a
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x48
ret
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x48
ret
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x48
ret
Function at 0x140085230
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x10], edx
mov r11, rsp
mov qword [r11 + 8], rcx
push rsi
sub rsp, 0x60
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
test rcx, rcx
je 0x140085408
movzx eax, word [rcx]
test ax, ax
je 0x140085408
mov qword [r11 - 0x10], rdi
xor edi, edi
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x18], r14
cmp ax, 0x2a
jne 0x140085356
lea r8d, [rdi + 5]
lea rdx, str.FILE:
lea rcx, [rcx + 2]
call fcn.1400da8e8
test eax, eax
jne 0x140085356
xor edx, edx
lea r8d, [rdi + 0x10]
lea rcx, [rsi + 0xc]
call fcn.1400ca0d0
cmp rax, 0xffffffffffffffff
je 0x140085356
test byte [rsp + 0x78], 6
lea ebx, [rdi + 1]
je 0x140085327
cmp word [rsi], 0x2a
jne 0x140085322
lea r8d, [rdi + 5]
lea rdx, str.FILE:
lea rcx, [rsi + 2]
call fcn.1400da8e8
test eax, eax
jne 0x140085322
xor edx, edx
lea r8d, [rdi + 0x10]
lea rcx, [rsi + 0xc]
call fcn.1400ca0d0
cmp rax, 0xffffffffffffffff
je 0x140085322
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], edi
mov r8d, ebx
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140085327
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140085327
mov ebx, 0xfffffffe
mov eax, ebx
mov rbx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x60
pop rsi
ret
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140086690
test eax, eax
jne 0x140085401
mov ebp, dword [rsp + 0x78]
mov edi, 1
mov eax, ebp
and eax, 1
dec eax
test byte [rsp + 0x38], 0x10
cmovne edi, eax
test bpl, 6
je 0x140085401
test edi, edi
jle 0x140085401
mov edx, 0x10084071
lea r8, [rsp + 0x38]
mov eax, 0x4071
test bpl, 4
mov rcx, rsi
cmove edx, eax
call fcn.140084770
test eax, eax
jne 0x1400853fc
mov rsi, qword [rsp + 0x38]
mov edx, ebp
mov rcx, rsi
call fcn.140085190
test al, al
mov ebx, 0xfffffffe
cmove edi, ebx
test rsi, rsi
je 0x140085401
cmp byte [rsi + 0xa], 0
mov rcx, qword [rsi]
je 0x1400853dc
cmp byte [rsi + 8], 1
jae 0x1400853e8
cmp rcx, 0xffffffffffffffff
je 0x1400853e8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x10
mov rcx, rsi
call fcn.1400b8a80
mov eax, edi
jmp 0x140085329
mov edi, 0xfffffffe
mov eax, edi
jmp 0x140085329
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x60
pop rsi
ret
Function at 0x1400863b0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14008642f
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14008642f
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140086422
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140086422
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x38
ret
mov eax, dword [rsp + 0x20]
shl rax, 0x20
or rax, rbx
jmp 0x14008640b
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x38
ret

Function at 0x140086690
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rdi, rcx
mov dword [rdx], ebx
mov rsi, rdx
cmp word [rcx], 0x2a
jne 0x140086723
lea rcx, [rcx + 2]
lea r8d, [rbx + 5]
lea rdx, str.FILE:
call fcn.1400da8e8
test eax, eax
jne 0x140086723
lea rcx, [rdi + 0xc]
xor edx, edx
lea r8d, [rbx + 0x10]
call fcn.1400ca0d0
cmp rax, 0xffffffffffffffff
je 0x140086723
xor r8d, r8d
mov dword [rsp + 0x58], 0x10002
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.140086460
test eax, eax
mov ecx, 0xffffffff
cmove ecx, dword [rsp + 0x20]
mov dword [rsi], ecx
jmp 0x140086741
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0xffffffff
mov dword [rsi], eax
cmp eax, ecx
jne 0x14008673f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400b89f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400868c0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, qword [rbp + 0x67]
xor edi, edi
cmp qword [0x14017fa98], rdi
mov rsi, qword [rbp + 0x6f]
je 0x140086aaf
cmp qword [0x14017fa68], rdi
je 0x140086aaf
movdqa xmm1, xmmword [0x140156bb0]
lea r8d, [rdi + 4]
xorps xmm0, xmm0
lea rdx, str._UNC_
movups xmmword [rbp - 1], xmm0
mov rcx, rbx
mov word [rbp - 1], di
movdqu xmmword [rbp + 0xf], xmm1
call fcn.1400da8e8
test eax, eax
jne 0x14008694a
add rbx, 8
jmp 0x140086968
lea rdx, [rbp - 1]
mov rcx, rbx
call fcn.140086760
test eax, eax
jne 0x140086968
cmp qword [rbp + 0x17], 7
lea rbx, [rbp - 1]
cmova rbx, qword [rbp - 1]
movdqa xmm1, xmmword [0x140156bb0]
lea rdx, [0x140153528]
xorps xmm0, xmm0
lea rcx, [rbp - 0x21]
movups xmmword [rbp - 0x21], xmm0
mov r8d, 4
mov word [rbp - 0x21], di
movdqu xmmword [rbp - 0x11], xmm1
call fcn.14000be50
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], di
jne 0x1400869a0
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.14000bdb0
cmp qword [rbp - 9], 7
lea rdx, [rbp - 0x21]
mov rax, qword [0x14017faa0]
lea rcx, [rbp + 0x1f]
cmova rdx, qword [rbp - 0x21]
call qword [case.0x1400a96cf.0]
mov eax, 0x40
test rsi, rsi
je 0x1400869f5
mov rcx, qword [rsi + 0x808]
cmp dword [rsi + 0x810], edi
je 0x1400869f8
mov eax, 0x42
jmp 0x1400869f8
mov rcx, rdi
mov dword [rsp + 0x50], edi
lea r9, [rbp + 0x2f]
mov qword [rsp + 0x48], rdi
lea r8, [rbp - 0x51]
mov dword [rsp + 0x40], 1
mov edx, 1
mov dword [rbp - 0x39], eax
lea rax, [rbp + 0x1f]
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], edi
mov qword [rbp - 0x41], rax
mov rax, qword [0x14017fa98]
mov qword [rbp - 0x31], rcx
lea rcx, [rbp - 0x59]
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x20], rdi
mov dword [rbp - 0x51], 0x30
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x29], rdi
call qword [case.0x1400a96cf.0]
mov ebx, eax
test eax, eax
jne 0x140086a83
mov rcx, qword [rbp - 0x59]
mov rax, qword [0x14017fa68]
call qword [case.0x1400a96cf.0]
cmp qword [rbp + 0x37], 1
jne 0x140086a99
mov ebx, 0xb7
jmp 0x140086a99
mov rax, qword [0x14017faa8]
test rax, rax
je 0x140086a99
mov ecx, ebx
call qword [case.0x1400a96cf.0]
mov ebx, eax
lea rcx, [rbp - 0x21]
call fcn.14000c080
lea rcx, [rbp - 1]
call fcn.14000c080
mov eax, ebx
jmp 0x140086ad4
test rsi, rsi
lea rdx, [rsi + 0x800]
mov rcx, rbx
cmove rdx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140086ad2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x140086b00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rbx
mov eax, 0x10030
call fcn.1400b9560
sub rsp, rax
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x10020], rax
mov rbx, qword [rsp + 0x10040]
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x140086b49
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140086b6f
lea rcx, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], 0
jne 0x140086b55
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000be50
xor eax, eax
mov rcx, qword [rsp + 0x10020]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x10030
pop rbx
ret

Function at 0x140087710
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push r14
sub rsp, 0x248
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov r14, rdx
test rcx, rcx
je 0x14008785f
cmp word [rcx], 0
je 0x14008785f
mov qword [r11 - 0x18], rdi
lea rdx, [rsp + 0x20]
mov qword [r11 + 0x18], rbp
mov r8d, 0x104
mov qword [r11 + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x140087852
mov ebp, edi
cmp edi, 0x104
jae 0x1400877c6
mov r8d, edi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.14000be50
xor eax, eax
mov rsi, qword [rsp + 0x278]
mov rbp, qword [rsp + 0x270]
mov rdi, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x248
pop r14
pop rbx
ret
mov rcx, 0xffffffffffffffff
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.1400c89d0
mov rsi, rax
test rax, rax
je 0x140087846
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14008782f
cmp eax, edi
jae 0x14008781b
mov r8, rbp
mov rdx, rsi
mov rcx, r14
call fcn.14000be50
mov rcx, rsi
call fcn.1400c89e0
jmp 0x140087791
mov rcx, rsi
mov ebx, 0x7a
call fcn.1400c89e0
mov eax, ebx
jmp 0x140087793
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov ebx, eax
call fcn.1400c89e0
mov eax, ebx
jmp 0x140087793
mov ebx, 8
mov eax, ebx
jmp 0x140087793
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140087793
mov eax, 0x57
jmp 0x1400877ab
Function at 0x14008d5c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008d644
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14008d644
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [rsp + 0x40]
mov edx, eax
add rdx, rbx
and ecx, 0xf
jbe 0x14008d62d
cmp rbx, rdx
jae 0x14008d644
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add ecx, 0xffffffff
jne 0x14008d618
cmp rbx, rdx
jae 0x14008d644
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14008f320
Capabilities:
Get common file path
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rsi
sub rsp, 0x240
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor esi, esi
mov ebx, esi
cmp qword [0x14017fbf8], rbx
jne 0x14008f369
lea ecx, [rsi + 1]
call fcn.14008f050
mov ebx, eax
test eax, eax
jne 0x14008f44e
or dword [0x14017fc0c], 2
mov rcx, qword [0x14017fbf8]
test rcx, rcx
je 0x14008f37b
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x14017fc08]
mov ecx, eax
inc eax
mov dword [0x14017fc08], eax
test ecx, ecx
jne 0x14008f43a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.1400da720
mov r8d, 0x104
mov word [rsp + 0x20], si
lea rdx, [rsp + 0x20]
lea rcx, str._SystemRoot_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movzx eax, word [rsp + 0x20]
cmp si, ax
je 0x14008f3d1
mov ecx, 0x25
cmp cx, ax
jne 0x14008f3f3
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rsp + 0x20]
lea rcx, str.SystemRoot
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [rsp + 0x250]
call fcn.14007fcf0
mov ebx, eax
test eax, eax
jne 0x14008f435
or dword [0x14017fc0c], 1
mov cl, 1
call fcn.14008da80
mov ebx, eax
test eax, eax
jne 0x14008f435
mov edx, dword [rsp + 0x250]
call fcn.14008e550
mov edx, dword [rsp + 0x250]
call fcn.14008eef0
mov ebx, esi
jmp 0x14008f43a
call fcn.14008f470
mov rcx, qword [0x14017fbf8]
test rcx, rcx
je 0x14008f44c
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400b89f0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rsi
ret
Function at 0x140098820
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1401761c0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
test rcx, rcx
je 0x1400989c8
test rdx, rdx
je 0x1400989c8
mov qword [r11 - 0x20], rbp
lea rdx, [0x140154378]
mov r8d, 4
mov qword [r11 - 0x28], r14
call fcn.1400d00c4
test eax, eax
je 0x1400988dc
mov r8d, 4
lea rdx, [0x140153528]
mov rcx, rbx
call fcn.1400d00c4
test eax, eax
je 0x1400988dc
mov eax, 0x3a
cmp ax, word [rbx + 2]
jne 0x14009890e
mov edx, 0x5c
cmp dx, word [rbx + 4]
jne 0x14009890e
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400d55a8
xor ebp, ebp
lea r14, [rsp + 0x24]
mov word [rsp + 0x226], bp
lea rcx, [rsp + 0x20]
jmp 0x14009894b
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1400d55a8
xor ebp, ebp
lea rcx, [rsp + 0x28]
mov word [rsp + 0x226], bp
lea edx, [rbp + 0x5c]
call fcn.1400bbc3c
mov r14, rax
test rax, rax
jne 0x140098946
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rbp, qword [rsp + 0x248]
mov r14, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400b89f0
add rsp, 0x250
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x28]
mov r8d, esi
mov word [r14], bp
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x140098919
mov eax, eax
cmp rax, rsi
jae 0x140098919
mov rax, 0xffffffffffffffff
mov rcx, rax
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x140098970
test rcx, rcx
je 0x140098919
lea rdx, [rsp + 0x20]
sub r14, rdx
sar r14, 1
lea rdx, [rbx + r14*2]
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140098990
inc rax
add rax, rcx
cmp rax, rsi
jbe 0x1400989af
mov ecx, 0x7a
jmp 0x140098913
sub rsi, rcx
lea rcx, [rdi + rcx*2]
mov r8, rsi
call fcn.1400d55a8
mov eax, 1
jmp 0x14009891b
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14009892b

Function at 0x14009d7a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
cmp qword [rcx + 0x18], 7
jbe 0x14009d7b8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009d7ce
test al, 0x10
jne 0x14009d7ce
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x14009d7e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
cmp qword [rcx + 0x18], 7
jbe 0x14009d7f8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009d80e
test al, 0x10
je 0x14009d80e
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14009dd20
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push r14
push r15
sub rsp, 0x70
xor r15d, r15d
mov rbx, rcx
cmp qword [rcx + 0x18], 7
mov r14, rdx
jbe 0x14009dd47
mov rcx, qword [rcx]
mov rdx, r14
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14009deb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14009dda6
cmp qword [rbx + 0x18], 7
jbe 0x14009dd74
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009dd8a
test al, 0x10
jne 0x14009deb8
mov ecx, 0xb7
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rdi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop r14
pop rbx
ret
cmp eax, 3
jne 0x14009dd95
mov qword [rsp + 0xa0], rbp
mov rbp, r15
mov qword [rsp + 0x68], rsi
nop dword [rax + rax]
mov rdi, qword [rbx + 0x18]
mov rcx, rbx
mov rsi, qword [rbx + 0x10]
cmp rdi, 7
jbe 0x14009ddd4
mov rcx, qword [rbx]
lea r8, [rbp + 1]
mov qword [rsp + 0x20], 2
lea r9, [0x140155560]
mov rdx, rsi
call fcn.14000f950
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14009de55
lea r8, [rax + 1]
mov qword [rsp + 0x48], r15
cmp rsi, r8
mov qword [rsp + 0x50], r15
xorps xmm0, xmm0
mov rdx, rbx
cmovb r8, rsi
movups xmmword [rsp + 0x38], xmm0
cmp rdi, 7
jbe 0x14009de22
mov rdx, qword [rbx]
lea rcx, [rsp + 0x38]
call fcn.14000c360
cmp qword [rsp + 0x50], 7
lea rcx, [rsp + 0x38]
mov rdx, r14
cmova rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x38]
call fcn.14000c080
jmp 0x14009ddc0
mov rsi, qword [rsp + 0x68]
mov rcx, rbx
mov rbp, qword [rsp + 0xa0]
cmp rdi, 7
jbe 0x14009de6e
mov rcx, qword [rbx]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14009deb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rbx + 0x18], 7
mov edi, eax
jbe 0x14009de8d
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14009de9f
test al, 0x10
jne 0x14009deb8
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rdi, qword [rsp + 0x60]
add rsp, 0x70
pop r15
pop r14
pop rbx
ret
mov rdi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x70
pop r15
pop r14
pop rbx
ret