joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027970
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140050028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140027a43
cmp byte [rcx + 0x71], 0
je 0x140027a43
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140027a3f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140027a04
sub eax, 1
je 0x140027a08
cmp eax, 2
jne 0x140027a3f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140031660
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140027a36
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140027a3f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400279ec
xor al, al
jmp 0x1400279ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140031660
add rsp, 0x60
pop rbx
ret
Function at 0x14002f060
Capabilities:
Get hostname

Disassembly:
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x140031210
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x140050028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rcx
mov rdx, rcx
lea rcx, str.___Invoking_RpcRemoteFindFirstPrinterChangeNotification_with_target_path:__ws_r_n
call fcn.140001500
mov dword [rsp + 0x78], 0x10
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
lea r9, [rsp + 0x90]
lea r8, str._hs
mov edx, 0x104
mov rcx, rax
call fcn.140001c30
xor r14d, r14d
mov qword [rsp + 0x70], r14
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
lea edx, [r14 + 1]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov rdi, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x14003135b
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x100
mov r9, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [rax + 0x3e]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x60], rax
mov edi, eax
mov dword [rsp + 0x50], eax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea edx, [r14 + 0x1d]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x68], rax
jmp 0x140031369
mov edx, eax
lea rcx, str.RpcOpenPrinter_failed__d_n
call fcn.140001500
jmp 0x140031371
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140031660
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14002f0a0
Capabilities:
Get hostname

Disassembly:
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x1400313a0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x140050028]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rsi, rcx
mov rdx, rcx
lea rcx, str.___Invoking_RpcRemoteFindFirstPrinterChangeNotificationEx_with_target_path:__ws_r_n
call fcn.140001500
mov dword [rsp + 0x70], 0x10
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
lea r9, [rsp + 0x88]
lea r8, str._hs
mov edx, 0x104
mov rcx, rax
call fcn.140001c30
xor r14d, r14d
mov qword [rsp + 0x68], r14
lea rdi, [rsp + 0x78]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
lea edx, [r14 + 1]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x50], rax
test eax, eax
jne 0x1400314d3
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x100
mov r9, qword [rsp + 0x68]
xor r8d, r8d
lea edx, [rax + 0x41]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea edx, [r14 + 0x1d]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x60], rax
jmp 0x1400314e2
mov edx, eax
lea rcx, str._MS_RPRN______RpcOpenPrinter_failed__d_n
call fcn.140001500
nop
xor eax, eax
jmp 0x1400314e6
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140031660
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140031210
Capabilities:
Get hostname

Disassembly:
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x140031210
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x140050028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rcx
mov rdx, rcx
lea rcx, str.___Invoking_RpcRemoteFindFirstPrinterChangeNotification_with_target_path:__ws_r_n
call fcn.140001500
mov dword [rsp + 0x78], 0x10
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
lea r9, [rsp + 0x90]
lea r8, str._hs
mov edx, 0x104
mov rcx, rax
call fcn.140001c30
xor r14d, r14d
mov qword [rsp + 0x70], r14
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
lea edx, [r14 + 1]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov rdi, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x14003135b
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x100
mov r9, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [rax + 0x3e]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x60], rax
mov edi, eax
mov dword [rsp + 0x50], eax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea edx, [r14 + 0x1d]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x68], rax
jmp 0x140031369
mov edx, eax
lea rcx, str.RpcOpenPrinter_failed__d_n
call fcn.140001500
jmp 0x140031371
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140031660
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400313a0
Capabilities:
Get hostname

Disassembly:
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jmp 0x1400313a0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x140050028]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rsi, rcx
mov rdx, rcx
lea rcx, str.___Invoking_RpcRemoteFindFirstPrinterChangeNotificationEx_with_target_path:__ws_r_n
call fcn.140001500
mov dword [rsp + 0x70], 0x10
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov edx, 0x208
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
lea r9, [rsp + 0x88]
lea r8, str._hs
mov edx, 0x104
mov rcx, rax
call fcn.140001c30
xor r14d, r14d
mov qword [rsp + 0x68], r14
lea rdi, [rsp + 0x78]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov dword [rsp + 0x38], r14d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, rbx
xor r8d, r8d
lea edx, [r14 + 1]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x50], rax
test eax, eax
jne 0x1400314d3
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 0x100
mov r9, qword [rsp + 0x68]
xor r8d, r8d
lea edx, [rax + 0x41]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea edx, [r14 + 0x1d]
lea rcx, [0x14003e5f0]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov qword [rsp + 0x60], rax
jmp 0x1400314e2
mov edx, eax
lea rcx, str._MS_RPRN______RpcOpenPrinter_failed__d_n
call fcn.140001500
nop
xor eax, eax
jmp 0x1400314e6
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140031660
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x140032544
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003258e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003258e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003258e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003258e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003258e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140032590
xor al, al
add rsp, 0x28
ret
Function at 0x43ccc0
Capabilities:
Get common file path

Disassembly:
push rsi
sub rsp, 0x80
mov rax, rdx
mov rsi, rcx
mov qword [rsp + 0x28], 0
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
mov rcx, rax
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
je 0x43ccfd
mov qword [rsi], 0
add rsp, 0x80
pop rsi
ret
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_lstrlenW
movsxd r8, eax
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.00441780
mov rcx, qword [rsp + 0x28]
call sub.ole32.dll_CoTaskMemFree
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x30]
call fcn.0044e040
mov rax, qword [rsp + 0x78]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsi], xmm0
add rsp, 0x80
pop rsi
ret

Function at 0x4474e0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
lea rdi, [0x00502098]
mov rcx, rdi
call fcn.0046a830
mov qword [rsp + 0x28], rdi
mov rbx, qword [rsi]
test rbx, rbx
jne 0x44756b
mov rbx, qword [rsi + 8]
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x447580
mov edi, eax
test rbx, rbx
je 0x44755f
mov ecx, 0x18
mov edx, 8
call fcn.00409e90
test rax, rax
je 0x4475d9
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], 0
mov dword [rax + 0x10], edi
mov rax, qword [0x005020b0]
nop dword [rax + rax]
mov qword [rcx + 8], rax
lock cmpxchg qword [0x005020b0], rcx
jne 0x447550
mov ebx, edi
mov rax, rbx
xchg qword [rsi], rax
test edi, edi
je 0x44759a
mov rcx, qword [rsp + 0x28]
call fcn.0046aac0
mov rax, rbx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_key___c::TLS_OUT_OF_INDEXESstrings_passed_to_WinAPI_cannot_contain_NULsstring_cannot_be_converted_to_requested_code_page
lea r8, str.libstd_syswindows_thread_local.rs
mov edx, 0x2e
call fcn.00441160
lea rax, str.assertion_failed:_key___0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x40], 0
lea rax, [0x004cb338]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x30]
call fcn.00468db0
ud2
mov ecx, 0x18
mov edx, 8
call fcn.00481e70
ud2
Function at 0x447ec0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x488
mov rsi, rdx
mov qword [rsp + 0x40], rcx
xor r13d, r13d
lea rcx, [rsp + 0x88]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
mov qword [rsp + 0x28], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
mov esi, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
mov r15d, 2
xor r12d, r12d
jmp 0x447f33
add rsi, rsi
cmp rsi, 0x201
jb 0x447f90
mov rdi, rsi
sub rdi, r12
mov rax, r13
sub rax, r12
cmp rax, rdi
jae 0x447fc0
add rdi, r12
jb 0x4480da
mov rdx, r13
add rdx, r13
cmp rdi, rdx
cmovb rdi, rdx
mov rbx, rdi
add rbx, rdi
jb 0x4480da
test r13, r13
je 0x447f9f
mov r8d, 2
mov rcx, r15
mov r9, rbx
call fcn.00409eb0
jmp 0x447fac
mov ebx, 0x200
lea rbp, [rsp + 0x88]
jmp 0x447fc9
mov edx, 2
mov rcx, rbx
call fcn.00409e90
mov r15, rax
test rax, rax
je 0x4480f5
mov qword [rsp + 0x20], r15
mov r13, rdi
mov r12, rsi
mov rbx, rsi
mov rbp, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rsp + 0x48]
mov rdx, rbp
mov r8d, esi
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov edi, eax
test eax, eax
jne 0x447ff3
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4480a7
mov r14d, edi
cmp rsi, r14
jne 0x448009
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
je 0x447f30
cmp rsi, r14
mov rsi, r14
jbe 0x447f33
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
cmp rbx, r14
jb 0x44810e
lea rcx, [rsp + 0x70]
mov rdx, rbp
mov r8, r14
call fcn.00474210
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test r13, r13
je 0x448090
add r13, r13
mov r8d, 2
mov rcx, r15
mov rdx, r13
call fcn.00409ea0
mov rax, rsi
add rsp, 0x488
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
call sub.KERNEL32.dll_GetLastError
mov rsi, qword [rsp + 0x40]
mov byte [rsi + 8], 0
mov dword [rsi + 0xc], eax
mov qword [rsi], 1
test r13, r13
jne 0x44807c
jmp 0x448090
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
call fcn.00481da0
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov edx, 2
mov rcx, rbx
call fcn.00481e70
ud2
mov rcx, r14
mov rdx, rbx
call fcn.0048b450
Function at 0x4483b0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x38], rcx
xor r12d, r12d
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov esi, 0x200
mov r14d, 2
mov r13d, 2
xor r15d, r15d
jmp 0x448413
add rsi, rsi
cmp rsi, 0x201
jb 0x448470
mov rbx, rsi
sub rbx, r15
mov rax, r12
sub rax, r15
cmp rax, rbx
jae 0x44849b
add rbx, r15
jb 0x4485a1
lea rdx, [r12 + r12]
cmp rbx, rdx
cmovb rbx, rdx
mov rdi, rbx
add rdi, rbx
jb 0x4485a1
test r12, r12
je 0x44847c
mov r8d, 2
mov rcx, r13
mov r9, rdi
call fcn.00409eb0
jmp 0x448489
mov ebx, 0x200
lea rdi, [rsp + 0x78]
jmp 0x4484a4
mov edx, 2
mov rcx, rdi
call fcn.00409e90
mov r13, rax
test rax, rax
je 0x4485b7
mov r14, r13
mov r12, rbx
mov r15, rsi
mov rbx, rsi
mov rdi, r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, esi
mov rdx, rdi
call sub.KERNEL32.dll_GetTempPathW
mov ebp, eax
test eax, eax
jne 0x4484c8
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x448573
mov ebp, ebp
cmp rsi, rbp
jne 0x4484dd
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
je 0x448410
cmp rsi, rbp
mov rsi, rbp
jbe 0x448413
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
cmp rbx, rbp
jb 0x4485cb
lea rcx, [rsp + 0x60]
mov rdx, rdi
mov r8, rbp
call fcn.00474210
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x38]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test r12, r12
je 0x44855c
add r12, r12
mov r8d, 2
mov rcx, r13
mov rdx, r12
call fcn.00409ea0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
call sub.KERNEL32.dll_GetLastError
mov rsi, qword [rsp + 0x38]
mov byte [rsi + 8], 0
mov dword [rsi + 0xc], eax
mov qword [rsi], 1
test r12, r12
jne 0x448548
jmp 0x44855c
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
call fcn.00481da0
mov qword [rsp + 0x20], r14
mov edx, 2
mov rcx, rdi
call fcn.00481e70
ud2
mov rcx, rbp
mov rdx, rbx
call fcn.0048b450
Function at 0x448ac0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov rsi, rdx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
mov qword [rsp + 0x28], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov r13, qword [rsi]
mov r15d, 0x200
mov eax, 2
mov qword [rsp + 0x20], rax
mov edi, 2
xor r12d, r12d
jmp 0x448b23
add r15, r15
cmp r15, 0x201
jb 0x448b80
mov rbp, r15
sub rbp, r12
mov rax, rbx
sub rax, r12
cmp rax, rbp
jae 0x448bad
add rbp, r12
jb 0x448d03
lea rdx, [rbx + rbx]
cmp rbp, rdx
cmovb rbp, rdx
mov rsi, rbp
add rsi, rbp
jb 0x448d03
test rbx, rbx
je 0x448b8c
mov r8d, 2
mov rcx, rdi
mov r9, rsi
call fcn.00409eb0
jmp 0x448b99
mov esi, 0x200
lea rbp, [rsp + 0x78]
jmp 0x448bb6
mov edx, 2
mov rcx, rsi
call fcn.00409e90
mov rdi, rax
test rax, rax
je 0x448d1e
mov qword [rsp + 0x20], rdi
mov rbx, rbp
mov r12, r15
mov rsi, r15
mov rbp, rdi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov dword [rsp + 0x48], r15d
mov rcx, r13
mov rdx, rbp
lea r8, [rsp + 0x48]
call sub.USERENV.dll_GetUserProfileDirectoryW
test eax, eax
je 0x448bf0
mov ecx, dword [rsp + 0x48]
add ecx, 0xffffffff
test ecx, ecx
jne 0x448c1f
jmp 0x448c10
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x448c10
mov ecx, dword [rsp + 0x48]
test ecx, ecx
jne 0x448c1f
nop word cs:[rax + rax]
nop dword [rax]
call sub.KERNEL32.dll_GetLastError
xor ecx, ecx
test eax, eax
jne 0x448cd0
mov r14d, ecx
cmp r15, r14
jne 0x448c35
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
je 0x448b20
cmp r15, r14
mov r15, r14
jbe 0x448b23
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
cmp rsi, r14
jb 0x448d37
lea rcx, [rsp + 0x48]
mov rdx, rbp
mov r8, r14
call fcn.00474210
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x40]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test rbx, rbx
je 0x448cb9
add rbx, rbx
mov r8d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.00409ea0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
call sub.KERNEL32.dll_GetLastError
mov rsi, qword [rsp + 0x40]
mov byte [rsi + 8], 0
mov dword [rsi + 0xc], eax
mov qword [rsi], 1
test rbx, rbx
jne 0x448ca5
jmp 0x448cb9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbx
call fcn.00481da0
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov edx, 2
mov rcx, rsi
call fcn.00481e70
ud2
mov rcx, r14
mov rdx, rsi
call fcn.0048b450
Function at 0x448d60
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x38], rcx
xor r12d, r12d
lea rcx, [rsp + 0x78]
xor edx, edx
mov r8d, 0x400
call sub.msvcrt.dll_memset
mov qword [rsp + 0x20], 2
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov esi, 0x200
mov r14d, 2
mov r13d, 2
xor r15d, r15d
jmp 0x448dc3
add rsi, rsi
cmp rsi, 0x201
jb 0x448e20
mov rbx, rsi
sub rbx, r15
mov rax, r12
sub rax, r15
cmp rax, rbx
jae 0x448e4b
add rbx, r15
jb 0x448f51
lea rdx, [r12 + r12]
cmp rbx, rdx
cmovb rbx, rdx
mov rdi, rbx
add rdi, rbx
jb 0x448f51
test r12, r12
je 0x448e2c
mov r8d, 2
mov rcx, r13
mov r9, rdi
call fcn.00409eb0
jmp 0x448e39
mov ebx, 0x200
lea rdi, [rsp + 0x78]
jmp 0x448e54
mov edx, 2
mov rcx, rdi
call fcn.00409e90
mov r13, rax
test rax, rax
je 0x448f67
mov r14, r13
mov r12, rbx
mov r15, rsi
mov rbx, rsi
mov rdi, r13
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov ecx, esi
mov rdx, rdi
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov ebp, eax
test eax, eax
jne 0x448e78
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x448f23
mov ebp, ebp
cmp rsi, rbp
jne 0x448e8d
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
je 0x448dc0
cmp rsi, rbp
mov rsi, rbp
jbe 0x448dc3
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
cmp rbx, rbp
jb 0x448f7b
lea rcx, [rsp + 0x60]
mov rdx, rdi
mov r8, rbp
call fcn.00474210
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x38]
mov qword [rsi + 0x18], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi + 8], xmm0
mov qword [rsi], 0
test r12, r12
je 0x448f0c
add r12, r12
mov r8d, 2
mov rcx, r13
mov rdx, r12
call fcn.00409ea0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
call sub.KERNEL32.dll_GetLastError
mov rsi, qword [rsp + 0x38]
mov byte [rsi + 8], 0
mov dword [rsi + 0xc], eax
mov qword [rsi], 1
test r12, r12
jne 0x448ef8
jmp 0x448f0c
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
call fcn.00481da0
mov qword [rsp + 0x20], r14
mov edx, 2
mov rcx, rdi
call fcn.00481e70
ud2
mov rcx, rbp
mov rdx, rbx
call fcn.0048b450