joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140248ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rdx
mov rsi, r8
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.140225160
nop
test rbx, rbx
je 0x140248f46
add rbx, 0xc
mov rdx, rbx
jmp 0x140248f48
xor edx, edx
mov qword [rbp - 0x50], rdx
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x28], rbx
mov rcx, qword [rcx + 8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], rdx
mov r8, rsi
mov qword [rbp - 0x68], r8
mov r9, rdi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.140007170
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.ADVAPI32.dll_RegQueryValueExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.1400071c0
nop
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x140248fc5
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1402251a0
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14037e540
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x14037e5dd
xor eax, eax
cmp r8d, 4
jl 0x14037e591
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x14037e5d8
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x14037e5d1
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x14037e5c9
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x14037e5c1
add rax, 4
test r8d, r8d
jle 0x14037e7ba
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x14037e5d8
inc rax
test r8d, r8d
jg 0x14037e5a0
jmp 0x14037e7ba
add eax, 3
jmp 0x14037e7b5
add eax, 2
jmp 0x14037e7b5
inc eax
jmp 0x14037e7b5
jmp 0x14037e7b5
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x14037e6f6
add rax, 0x10
cmp rax, r10
jbe 0x14037e600
mov eax, r8d
test al, 7
je 0x14037e7ba
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x14037e7ba
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x14037e7ac
mov ecx, 0x20
jmp 0x14037e7af
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x14037e79d
mov r8d, 0x20
jmp 0x14037e7a1
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x14037e7b5
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x1403887c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x140388811
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x140388a3b
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x140388805
inc edx
cmp edx, r9d
jl 0x1403887e5
jmp 0x140388a3b
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [0x14059aa90]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x14038897b
add rax, 0x10
cmp rax, r8
jb 0x140388858
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x140388a3b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140001008
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
lea rax, [rbp + 0x30]
xor esi, esi
mov r9d, 0x2001f
mov qword [rbp + 0x30], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400010d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.WDSCORE.dll_CurrentIP]
nop dword [rax + rax]
lea rdx, str.SetDownlevelRollbackFlag:_Failed_to_open_Setup_key.
mov ecx, 0x30000e7
mov rbx, rax
call fcn.140004c0c
mov dword [rsp + 0x50], esi
lea r8, [0x14000ed78]
mov qword [rsp + 0x48], rsi
mov rcx, rax
mov dword [rsp + 0x40], edi
lea rax, str.SetDownlevelRollbackFlag
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0xe0000
lea rax, str.base_ntsetupmigration_setup_rollback_src_setuprollback.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x7d
call qword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
nop dword [rax + rax]
jmp 0x1400011d7
mov rcx, qword [rbp + 0x30]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rdx, str.SetupRollbacked
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], esi
mov ebx, 4
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov dword [rbp + 0x28], ebx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ecx, dword [rbp + 0x20]
lea rdx, str.SetupRollbacked
test eax, eax
mov dword [rsp + 0x28], ebx
lea rax, [rbp + 0x20]
mov r9d, ebx
cmovne ecx, esi
mov qword [rsp + 0x20], rax
inc ecx
xor r8d, r8d
mov dword [rbp + 0x20], ecx
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x1400011c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.WDSCORE.dll_CurrentIP]
nop dword [rax + rax]
lea rdx, str.SetDownlevelRollbackFlag:_Failed_to_set__SetupRollbacked__value.
mov ecx, 0x30000e8
mov rbx, rax
call fcn.140004c0c
mov dword [rsp + 0x50], esi
lea r8, [0x14000ed78]
mov qword [rsp + 0x48], rsi
mov rcx, rax
mov dword [rsp + 0x40], edi
lea rax, str.SetDownlevelRollbackFlag
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0xe0000
lea rax, str.base_ntsetupmigration_setup_rollback_src_setuprollback.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x97
call qword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001dec
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbx, rdx
lea r8, str.GlobalMicrosoft.Windows.Setup.Rollback
mov rdi, rcx
xor edx, edx
xor ecx, ecx
xor esi, esi
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x140001f7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xb7
je 0x140001f6e
mov rdx, rbx
mov rcx, rdi
call fcn.140009424
test eax, eax
jne 0x140001eda
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.WDSCORE.dll_CurrentIP]
nop dword [rax + rax]
lea rdx, str.OS_Rollback:_ExecuteRollback_failed.
mov ecx, 0x20000cd
mov rbx, rax
call fcn.140004c0c
mov dword [rsp + 0x50], esi
lea r8, [0x14000ed78]
mov qword [rsp + 0x48], rsi
mov rcx, rax
mov dword [rsp + 0x40], edi
lea rax, str.RollbackSetup
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0xe0000
lea rax, str.base_ntsetupmigration_setup_rollback_src_setuprollback.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1ee
call qword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
nop dword [rax + rax]
mov esi, 5
jmp 0x140001f58
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.WDSCORE.dll_CurrentIP]
nop dword [rax + rax]
lea rdx, str.OS_Rollback:_Success.
mov ecx, 0x40000ce
mov rbx, rax
call fcn.140004c0c
mov dword [rsp + 0x50], esi
lea r8, [0x14000ed78]
mov qword [rsp + 0x48], rsi
mov rcx, rax
mov dword [rsp + 0x40], edi
lea rax, str.RollbackSetup
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0xe0000
lea rax, str.base_ntsetupmigration_setup_rollback_src_setuprollback.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1f3
call qword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
nop dword [rax + rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov eax, esi
jmp 0x140002007
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.WDSCORE.dll_CurrentIP]
nop dword [rax + rax]
lea rdx, str.OS_Rollback:_Failed_to_create_setup_mutex.
mov ecx, 0x20000cc
mov rbx, rax
call fcn.140004c0c
mov dword [rsp + 0x50], esi
lea r8, [0x14000ed78]
mov qword [rsp + 0x48], rsi
mov rcx, rax
mov dword [rsp + 0x40], edi
lea rax, str.RollbackSetup
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov edx, 0xe0000
lea rax, str.base_ntsetupmigration_setup_rollback_src_setuprollback.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1e8
call qword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140004c3c
Capabilities:
Create thread
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov rax, qword [0x1400175c8]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor ebx, ebx
mov dword [0x140017bc0], edx
xor edx, edx
mov dword [0x140017bc4], ebx
mov r8d, 0x208
mov dword [rsp + 0x30], ebx
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x38], rbx
call sub.msvcrt.dll_memset
mov r8d, 0x104
lea rdx, [rbp - 0x80]
xor ecx, ecx
movzx edi, bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
je 0x140004d7d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
nop dword [rax + rax]
mov r14d, eax
mov edi, ebx
test eax, eax
je 0x140004d7d
mov edx, r14d
lea ecx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140004d7d
mov edx, dword [rsp + 0x30]
lea rcx, [rbp - 0x80]
mov r9, rax
mov r8d, r14d
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
nop dword [rax + rax]
test eax, eax
je 0x140004d6e
lea r9, [rsp + 0x40]
mov rcx, rsi
lea r8, [rsp + 0x38]
lea rdx, [0x140010644]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x140004d6e
add qword [rsp + 0x38], 0x10
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rcx, rsi
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
nop dword [rax + rax]
test eax, eax
je 0x140004d6e
mov rax, qword [rsp + 0x38]
movzx edi, word [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov eax, 0x3ff
and di, ax
mov word [0x140017dd8], di
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [rax + rax]
movsxd r9, eax
lea r8, [0x140004e60]
lea rax, [rsp + 0x44]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov qword [0x140017df0], rax
test rax, rax
je 0x140004e1a
mov edi, 0xbf1
call qword [sym.imp.USER32.dll_WaitMessage]
nop dword [rax + rax]
mov r9d, edi
mov dword [rsp + 0x20], 1
mov r8d, edi
lea rcx, [rsp + 0x48]
or rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_PeekMessageW]
nop dword [rax + rax]
test eax, eax
je 0x140004dd1
mov rcx, qword [rsp + 0x60]
mov rax, qword [0x140017df0]
mov qword [0x140017de8], rcx
test rax, rax
setne bl
mov eax, ebx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14000c290
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140005a78
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140005b1c
mov ebx, edi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
lea edx, [rbp + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x140005b1c
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x140005af6
cmp bp, word [rbx]
jne 0x140005b1c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test eax, eax
cmovne rbx, rbp
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400062a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
xor ebx, ebx
xor edx, edx
call fcn.140007290
mov rsi, rax
test rax, rax
je 0x140006332
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
cmp edi, 0xffffffff
je 0x1400062fa
lea eax, [rbx + 1]
bt edi, 0xa
jb 0x1400062fc
mov eax, ebx
test ebp, ebp
mov dword [r14], eax
sete bl
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140006bf4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test rcx, rcx
jne 0x140006c16
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x28
ret
test dl, 1
je 0x140006c29
mov edx, 1
add rsp, 0x28
jmp fcn.140007a40
add rsp, 0x28
jmp 0x140007fbc
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rsi, rcx
mov ebp, r14d
mov edi, r14d
test rcx, rcx
je 0x1400080e6
cmp r14w, word [rcx]
je 0x1400080e6
xor edx, edx
call fcn.140007290
mov rbx, rax
test rax, rax
je 0x140008082
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x140008048
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rbx
lea r8, str.WdsRemoveDirectory:_Unable_to_clear_attributes_on___s___GLE__0x_x
lea rcx, [0x140017e08]
mov dword [rsp + 0x20], eax
mov edx, 0x3000000
mov edi, eax
call fcn.140006188
xor edx, edx
mov rcx, rbx
call fcn.140007a40
mov ebp, eax
test eax, eax
jne 0x1400080af
test edi, edi
jne 0x14000806a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rbx
lea r8, str.WdsRemoveDirectory:_Unable_to_remove_directory___s___GLE__0x_x
jmp 0x14000809a
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r9, rsi
lea r8, str.WdsRemoveDirectory:_Unable_to_prepare_path___s___GLE__0x_x
mov edi, eax
mov edx, 0x3000000
mov dword [rsp + 0x20], eax
lea rcx, [0x140017e08]
call fcn.140006188
test rbx, rbx
je 0x1400080d4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebp
jmp 0x1400080f9
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140007548
Capabilities:
Create directory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r14, rcx
mov qword [rsp + 0x78], rbx
mov ebp, ebx
lea r12d, [rbx + 1]
test rcx, rcx
je 0x14000775b
cmp bx, word [rcx]
je 0x14000775b
lea rdx, [rsp + 0x78]
call fcn.140007290
mov rsi, rax
test rax, rax
je 0x14000773b
lea r8, [rsp + 0x80]
mov qword [rsp + 0x80], rbx
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov rcx, rax
call fcn.1400078c4
lea r15d, [rbx + 0x5c]
test eax, eax
js 0x14000768b
cmp dword [rsp + 0x70], r12d
jne 0x140007658
mov r15, qword [rsp + 0x80]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r15 + rcx*2], bx
jne 0x1400075d3
mov rax, qword [rsp + 0x78]
lea rdi, [rax + rcx*2]
test r15, r15
je 0x14000760b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov r15d, 0x5c
cmp r12d, 1
jne 0x1400076ec
mov edx, r15d
mov rcx, rdi
call sub.msvcrt.dll_wcschr
mov rdi, rax
test rax, rax
je 0x1400076a7
mov rcx, rsi
mov word [rax], bx
call fcn.14000811c
test eax, eax
jne 0x14000764e
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
mov word [rdi], r15w
add rdi, 2
jmp 0x14000761b
mov rdi, qword [rsp + 0x78]
movzx ecx, word [rdi]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x140007673
sub cx, 0x41
cmp cx, 0x19
ja 0x140007611
mov eax, 0x3a
cmp ax, word [rdi + 2]
jne 0x140007611
cmp r15w, word [rdi + 4]
jne 0x140007611
add rdi, 8
jmp 0x140007611
movzx ecx, ax
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x78]
jmp 0x140007611
cmp r12d, 1
jne 0x1400076ec
mov rcx, rsi
call fcn.14000811c
cmp eax, r12d
je 0x1400076e5
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
cmp eax, r12d
je 0x1400076e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.CreatePath:_Unable_to_create___s___GLE__0x_x
jmp 0x1400076ff
mov ebx, 1
jmp 0x140007719
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
lea r8, str.CreatePath:_Unable_to_create_parent_directory_for___s___GLE__0x_x
mov r9, r14
mov dword [rsp + 0x20], eax
mov edx, 0x3000000
lea rcx, [0x140017e08]
mov ebp, eax
call fcn.140006188
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x140007749
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebp, eax
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14000776e
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret