joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006dda0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14006ddc5
xor eax, eax
jmp 0x14006ded5
cmp qword [rcx + 0x68], 0
je 0x14006ddd9
lfence
call fcn.14002edf0
jmp 0x14006ded5
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov qword [rsp + 0x60], rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x14006ddf5
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14006ddf7
xor ecx, ecx
movsxd rax, ecx
mov rbx, rdi
test ecx, ecx
je 0x14006de31
cmp rax, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1400b4020
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov qword [rsp + 0x60], rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
mov rbx, rbp
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14006deca
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14006de6c
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
cmp rbx, r15
jbe 0x14006dea6
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.1400bc1fc
sub rbp, rax
add r14, rax
mov qword [rsp + 0x60], rbp
mov rbx, rbp
cmp rax, r15
jne 0x14006deca
cmp rbp, r15
ja 0x14006de77
test rbx, rbx
je 0x14006deca
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.1400bc1fc
sub rbx, rax
mov qword [rsp + 0x60], rbx
lfence
sub rdi, qword [rsp + 0x60]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140074dd4
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x140074e2f
mov rax, qword [rcx + 8]
mov r10, qword [rcx]
mov r8, qword [rcx + 0x18]
mov r9, qword [rcx + 0x10]
mov r11d, edx
add r10, rax
add r9, r8
rol rax, 0xd
xor rax, r10
rol r8, 0x10
xor r8, r9
rol r10, 0x20
add r9, rax
add r10, r8
rol rax, 0x11
rol r8, 0x15
xor rax, r9
xor r8, r10
rol r9, 0x20
sub r11, 1
jne 0x140074dea
mov qword [rcx + 8], rax
mov qword [rcx], r10
mov qword [rcx + 0x18], r8
mov qword [rcx + 0x10], r9
ret
Function at 0x140074ff0
Capabilities:
Generate random numbers via rtlgenrandom
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
xor ebx, ebx
lea rcx, str.kernel32
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14007517c
lea rdx, str.LoadLibraryExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r14, str.ADVAPI32.DLL
mov rbp, rax
mov rcx, r14
lea rdx, [0x14012a21c]
call fcn.1400ec76c
lea r13d, [rbx + 1]
test rax, rax
je 0x140075074
mov rcx, r14
test rbp, rbp
je 0x14007506c
lea r8d, [rbx + 8]
jmp 0x140075097
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x1400750a2
test rbp, rbp
je 0x1400750aa
lea rdx, str.AddDllDirectory
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400750aa
mov r8d, 0x800
mov rcx, r14
xor edx, edx
mov rax, rbp
call qword [case.0x14007c430.0]
mov rdi, rax
jmp 0x140075144
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x14007517c
lea ecx, [rax + 1]
add rcx, 0xc
call fcn.1400c52c0
mov rsi, rax
test rax, rax
je 0x14007513c
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14007513c
or rcx, 0xffffffffffffffff
mov rax, rcx
inc rax
cmp byte [rsi + rax], bl
jne 0x1400750ea
mov edx, 0x5c
mov word [rax + rsi], dx
inc rcx
cmp byte [rsi + rcx], bl
jne 0x1400750fb
mov rdx, rsi
sub rdx, r14
add rdx, rcx
mov al, byte [r14]
mov byte [rdx + r14], al
add r14, r13
test al, al
jne 0x14007510c
mov rcx, rsi
test rbp, rbp
je 0x140075133
xor edx, edx
mov rax, rbp
lea r8d, [rdx + 8]
call qword [case.0x14007c430.0]
jmp 0x140075139
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rcx, rsi
call fcn.1400bae50
test rdi, rdi
je 0x14007517c
lea rdx, str.SystemFunction036
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140075173
mov edx, 4
mov rcx, r12
call qword [case.0x14007c430.0]
cmp al, r13b
cmove ebx, r13d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14008f64c
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1401600b0]
xor rax, rsp
mov qword [rbp + 0x290], rax
mov rbx, r8
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x78]
call fcn.140004d88
nop
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.14008cec0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.14008cfcc
nop
lea rcx, [rsp + 0x48]
call fcn.140002e10
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x78]
call fcn.14008d0e0
cmp qword [rax + 0x18], 8
jb 0x14008f6d2
mov rax, qword [rax]
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
lea rcx, [rbp - 0x38]
call fcn.140005cfc
cmp rsi, 0xffffffffffffffff
jne 0x14008f717
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
add eax, 0xfffffffe
cmp eax, 1
ja 0x14008f884
xor ebx, ebx
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
jmp 0x14008f85b
mov qword [rsp + 0x38], rsi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rdx, [0x14011b944]
lea rcx, [rbp + 0x6c]
call fcn.1400bd258
test eax, eax
je 0x14008f804
lea rdx, [0x1400fe83c]
lea rcx, [rbp + 0x6c]
call fcn.1400bd258
test eax, eax
je 0x14008f804
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.140004d88
nop
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], bx
lea rax, [rbp + 0x6c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x14008f784
lea rdx, [rbp + 0x6c]
lea rcx, [rsp + 0x68]
call fcn.140005dd4
nop
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x58]
call fcn.14008cec0
nop
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x48]
call fcn.14008cfcc
nop
lea rcx, [rbp - 0x58]
call fcn.140002e10
nop
lea rcx, [rsp + 0x68]
call fcn.140005cfc
lea r8, [rbp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.14008fa40
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14008f584
nop
lea rcx, [rbp - 8]
call fcn.140002e10
nop
lea rcx, [rsp + 0x48]
call fcn.140002e10
lea rdx, [rbp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14008f72c
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
mov rax, qword [rsp + 0x28]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x20]
call fcn.140065028
nop
test rsi, rsi
je 0x14008f85b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp - 0x78]
call fcn.140002e10
mov rax, rdi
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140095410
add rsp, 0x3a0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx ecx, dx
or ecx, 0x80070000
test edx, edx
cmovle ecx, edx
mov r8d, 0x22
lea rdx, str.C:dvsp4_build_sw_relgfclient_rel_03_25_1_backendcommonupdtlib_src_filesystem.cpp
call fcn.14000b32c
int3
Function at 0x14008fae0
Capabilities:
Delete directory
Delete file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401600b0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
xor r14d, r14d
cmp dword [rcx], r14d
setne cl
lea r9d, [r14 + 0x3e]
lea r8, str.C:dvsp4_build_sw_relgfclient_rel_03_25_1_backendcommonupdtlib_src_filesystem_object.cpp
lea rdx, str.Incorrect_state
call fcn.140089888
mov ecx, dword [rdi]
sub ecx, 1
je 0x14008fc0e
cmp ecx, 1
jne 0x14008fbd8
movdqa xmm0, xmmword [0x14012ad40]
movdqu xmmword [rbp + 7], xmm0
mov word [rbp - 9], r14w
mov r8d, ecx
lea rdx, [0x1401293e8]
lea rcx, [rbp - 9]
call fcn.140005dd4
nop
lea r8, [rbp - 9]
lea rdx, [rdi + 8]
lea rcx, [rbp - 0x29]
call fcn.14008f64c
nop
lea rcx, [rbp - 9]
call fcn.140005cfc
mov rbx, qword [rbp - 0x29]
jmp 0x14008fb9a
mov rcx, rbx
call fcn.14008fae0
add rbx, 0x50
cmp rbx, qword [rbp - 0x21]
jne 0x14008fb8e
lea rdx, [rbp + 0x17]
lea rcx, [rdi + 8]
call fcn.14008d0e0
cmp qword [rax + 0x18], 8
jb 0x14008fbb7
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
lea rcx, [rbp + 0x17]
call fcn.140005cfc
test ebx, ebx
je 0x14008fc3f
lea rcx, [rbp - 0x29]
call fcn.140065028
mov dword [rdi], r14d
lea rcx, [rdi + 0x28]
xor edx, edx
lea r8d, [rdx + 0x24]
call fcn.1400b4430
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140095410
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
lea rcx, [rdi + 8]
lea rdx, [rbp + 0x17]
call fcn.14008d0e0
cmp qword [rax + 0x18], 8
jb 0x14008fc25
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
lea rcx, [rbp + 0x17]
call fcn.140005cfc
test ebx, ebx
je 0x14008fc67
jmp 0x14008fbd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov r8d, 0x54
lea rdx, str.C:dvsp4_build_sw_relgfclient_rel_03_25_1_backendcommonupdtlib_src_filesystem_object.cpp
call fcn.14000b32c
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
lea r8d, [rbx + 0x46]
lea rdx, str.C:dvsp4_build_sw_relgfclient_rel_03_25_1_backendcommonupdtlib_src_filesystem_object.cpp
call fcn.14000b32c
int3

Function at 0x1400913a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x1400913b6
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400913c5
xor al, al
jmp 0x1400913cc
shr eax, 4
not al
and al, 1
add rsp, 0x28
ret
Function at 0x1400914f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov byte [r9], 1
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140091788
test al, al
je 0x140091564
mov rcx, rbx
call fcn.140091790
test al, al
je 0x140091564
mov eax, 0xffffffff
cmp rsi, rax
ja 0x140091564
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov r8d, esi
and qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14009155e
mov byte [rdi], 0
mov eax, dword [rsp + 0x58]
jmp 0x140091566
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140091690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov byte [r9], 1
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140091788
test al, al
je 0x140091704
mov rcx, rbx
call fcn.140091798
test al, al
je 0x140091704
mov eax, 0xffffffff
cmp rsi, rax
ja 0x140091704
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov r8d, esi
and qword [rsp + 0x20], 0
mov rdx, rbp
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400916fe
mov byte [rdi], 0
mov eax, dword [rsp + 0x58]
jmp 0x140091706
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400919a0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x30]
call fcn.1400b4430
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [rsp + 0x20]
cmp ecx, 5
ja 0x140091a19
je 0x140091a10
test ecx, ecx
je 0x140091a07
sub ecx, 1
je 0x1400919fe
sub ecx, 1
je 0x1400919f5
sub ecx, 1
je 0x1400919ec
cmp ecx, 1
jne 0x140091a32
lea rax, [0x1400fed98]
jmp 0x140091a66
lea rax, [0x1400fed90]
jmp 0x140091a66
lea rax, str.ALPHA
jmp 0x140091a66
lea rax, str.MIPS
jmp 0x140091a66
lea rax, [0x1400fed68]
jmp 0x140091a66
lea rax, [0x1400feda0]
jmp 0x140091a66
sub ecx, 6
je 0x140091a5f
sub ecx, 1
je 0x140091a56
sub ecx, 1
je 0x140091a4d
sub ecx, 1
je 0x140091a44
cmp ecx, 1
je 0x140091a3b
lea rax, [0x1400fee08]
jmp 0x140091a66
lea rax, str.IA32_ON_WIN64
jmp 0x140091a66
lea rax, str.AMD64
jmp 0x140091a66
lea rax, str.MSIL
jmp 0x140091a66
lea rax, str.ALPHA64
jmp 0x140091a66
lea rax, str.IA64
add rsp, 0x58
ret
Function at 0x14009231c
Capabilities:
Copy file

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov esi, r8d
mov r15, rdx
mov r14, rcx
and esi, 0xf
xor r12d, r12d
cmp esi, 2
je 0x1400924ba
lea r8d, [r12 + 1]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
test eax, eax
je 0x140092370
mov byte [rbp + 0x48], 1
mov dword [rbp + 0x4c], r12d
jmp 0x14009237e
mov byte [rbp + 0x48], r12b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rbp + 0x4c], eax
mov rax, qword [rbp + 0x48]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x50
jne 0x1400924ea
test esi, esi
je 0x1400924ea
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea edi, [rcx - 0x4d]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rcx + 0x31]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400923db
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test eax, eax
je 0x1400923db
mov byte [rbp + 0x48], r12b
jmp 0x1400924e3
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x82
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14009243a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test eax, eax
je 0x14009243a
mov byte [rbp + 0x48], r12b
mov dword [rbp + 0x4c], eax
cmp rbx, 0xffffffffffffffff
je 0x1400924e6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
je 0x140092503
jmp 0x1400924e6
cmp esi, 1
jne 0x140092461
mov dword [rbp + 0x4c], r12d
mov byte [rbp + 0x48], r12b
cmp rdi, 0xffffffffffffffff
je 0x140092419
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
je 0x140092503
jmp 0x140092419
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1400920ac
nop
test eax, eax
je 0x140092477
mov dword [rbp + 0x4c], eax
jmp 0x140092443
lea rdx, [rbp + 0x48]
mov rcx, rdi
call fcn.1400920ac
nop
test eax, eax
jne 0x140092472
mov rax, qword [rbp + 0x48]
cmp qword [rbp - 0x10], rax
jle 0x14009243f
cmp rdi, 0xffffffffffffffff
je 0x1400924a6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
je 0x140092503
cmp rbx, 0xffffffffffffffff
je 0x1400924ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test eax, eax
je 0x140092503
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
test eax, eax
je 0x1400924d8
mov byte [rbp + 0x48], 1
mov dword [rbp + 0x4c], r12d
jmp 0x1400924e6
mov byte [rbp + 0x48], r12b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov dword [rbp + 0x4c], eax
mov rax, qword [rbp + 0x48]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400badf4
nop
int3
Function at 0x14009909c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1400990af
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1400996c8
lea rdx, [0x14015d110]
lea rcx, [rsp + 0x20]
call fcn.1400b45d0
int3

Function at 0x1400a3aec
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140165ca0]
xor edx, edx
jmp fcn.14009909c

Function at 0x1400a44bc
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140165ca0]
jmp fcn.14009909c

Function at 0x1400b0410
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400b04d0]
mov r9, qword [r9 + 8]
jmp fcn.1400a1454

Function at 0x1400b04a4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x1400b04e0]
mov r9, qword [r9 + 8]
jmp fcn.1400a1454
Function at 0x1400e0b10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x1400e0bd3
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x1400e0b44
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x1400e0bd6
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x1400e0b8f
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x1400e0b93
test rax, rax
je 0x1400e0bd3
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400e0bc4
cmp rdx, rax
jb 0x1400e0bb0
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e1470
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rax, qword [0x140166e58]
xor esi, esi
mov rbx, r8
mov r14, rdx
mov ebp, ecx
test rax, rax
jne 0x1400e14b9
xor edx, edx
lea rcx, str.Setupapi.dll
call fcn.1400e33e0
mov qword [0x140166e58], rax
test rax, rax
je 0x1400e1596
cmp qword [0x140166e60], rsi
jne 0x1400e14e9
lea rdx, [0x140113b20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166e60], rax
test rax, rax
je 0x1400e1596
mov rax, qword [0x140166e58]
cmp qword [0x140166e68], rsi
jne 0x1400e1519
lea rdx, [0x140113b38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166e68], rax
test rax, rax
je 0x1400e1596
mov rax, qword [0x140166e58]
cmp qword [0x140166e78], rsi
jne 0x1400e1545
lea rdx, [0x1401139f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166e78], rax
test rax, rax
je 0x1400e1596
mov rax, qword [0x140166e58]
cmp qword [0x140166e70], rsi
jne 0x1400e1571
lea rdx, [0x140113b50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166e70], rax
test rax, rax
je 0x1400e1596
mov rax, qword [0x140166e58]
cmp qword [0x140166bd8], rsi
jne 0x1400e159d
lea rdx, [0x140113a18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140166bd8], rax
test rax, rax
jne 0x1400e159d
xor eax, eax
jmp 0x1400e163d
mov r9d, 6
mov qword [rsp + 0x30], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [0x140166e60]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400e1636
xor eax, eax
mov r8, rbx
mov qword [rbx], rax
xor edx, edx
mov qword [rbx + 8], rax
mov rcx, rdi
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov dword [rbx], 0x20
call qword [0x140166e68]
test eax, eax
je 0x1400e162d
nop word [rax + rax]
mov r8, rbx
mov rdx, rdi
mov ecx, ebp
call fcn.1400e1c80
cmp eax, 1
je 0x1400e1653
xor eax, eax
inc esi
mov qword [rbx], rax
mov r8, rbx
mov qword [rbx + 8], rax
mov edx, esi
mov qword [rbx + 0x10], rax
mov rcx, rdi
mov qword [rbx + 0x18], rax
mov dword [rbx], 0x20
call qword [0x140166e68]
test eax, eax
jne 0x1400e15f0
mov rcx, rdi
call qword [0x140166bd8]
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [r14], rdi
mov eax, 1
jmp 0x1400e1638
Function at 0x1400e4a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rbx, rbx
je 0x1400e4c85
xor edx, edx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], dx
jne 0x1400e4a86
test rax, rax
je 0x1400e4ac4
xor ecx, ecx
nop word [rax + rax]
movzx r8d, word [rbx + rcx*2]
cmp r8w, 0x5c
je 0x1400e4c85
cmp r8w, 0x2f
je 0x1400e4c85
inc edx
mov ecx, edx
cmp rcx, rax
jb 0x1400e4aa0
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
call fcn.1400e4ca0
mov rsi, rax
test rax, rax
je 0x1400e4bb5
mov qword [rsp + 0x50], r14
call fcn.1400e5500
mov r14, rax
test rax, rax
je 0x1400e4ba2
mov rcx, rsi
call fcn.1400e0970
test eax, eax
je 0x1400e4b8b
lea rax, str.system32_
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x20]
lea rax, str.SystemRoot_system32_
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdx, qword [rdi]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], bp
jne 0x1400e4b37
mov r8, rbx
mov rcx, rsi
call fcn.1400c5ee0
test eax, eax
je 0x1400e4b5f
add rdi, 8
lea rax, [rsp + 0x30]
cmp rdi, rax
jb 0x1400e4b30
jmp 0x1400e4b6e
lea rdx, [rsi + rbx*2]
mov rcx, r14
call fcn.1400e3d40
mov rbp, rax
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x1400e4b99
mov rcx, rsi
call fcn.1400e0910
test eax, eax
je 0x1400e4b99
mov rbp, rsi
xor esi, esi
jmp 0x1400e4b99
mov rdx, rsi
mov rcx, r14
call fcn.1400e3d40
mov rbp, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r14, qword [rsp + 0x50]
jmp 0x1400e4c51
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7e
jne 0x1400e4c5a
mov rcx, rbx
call fcn.1400e07f0
mov rdi, rax
test rax, rax
je 0x1400e4c5a
mov ecx, 0x37e4
call fcn.1400e31c0
test eax, eax
je 0x1400e4bef
xor ecx, ecx
call fcn.1400e51a0
jmp 0x1400e4bf4
call fcn.1400e5500
mov rbx, rax
test rax, rax
je 0x1400e4c48
mov rdx, rdi
mov rcx, rax
call fcn.1400e3d40
mov rbp, rax
test rax, rax
je 0x1400e4c3f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400e4c21
test al, 0x50
je 0x1400e4c3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400e4c34
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ebp, ebp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbp, rbp
je 0x1400e4c5a
xor ecx, ecx
jmp 0x1400e4c67
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400e4c6d
lea ecx, [rax + 0x7e]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
mov ecx, 0xa0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rbp
ret