joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4346f0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x3c8
mov qword [rsp + 0x3c0], rbx
mov qword [rsp + 0x3b8], rsi
mov qword [rsp + 0x3b0], rdi
mov rsi, rcx
mov qword [rsp + 0x58], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x4347a1
xor r8d, r8d
lea rdx, str.CINIFile::IsLenovoSytleINIFileExist_n
lea rcx, [rsp + 0x1a0]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0xa0], rdx
lea rdi, [rsp + 0xa0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x434770
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.004548a0
xor ebx, ebx
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rax
lea rdx, [0x004af668]
lea rcx, [rsp + 0x40]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsi + 0x1abc]
lea rcx, [rsp + 0x50]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
mov edx, 0xa
lea rcx, [rsp + 0x60]
call fcn.0049a7a0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.00401340
nop
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x4348f8
mov edi, 1
nop
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.004012d0
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.0042fa40
test eax, eax
je 0x4348ec
lea r8, str.DEVICE
lea rdx, [0x004af81c]
lea rcx, [rsp + 0x48]
call fcn.0049a324
lea rdx, [rsp + 0x2a0]
mov qword [rsp + 0x20], rdx
lea r9, str.DEVICEID
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x30]
mov rcx, rsi
call fcn.0044c5a0
test eax, eax
cmovne ebx, edi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp qword [rsp + 0x38], 0
jne 0x434860
call fcn.004545a0
test eax, eax
je 0x434982
mov r8d, ebx
lea rdx, str.CINIFile::IsLenovoSytleINIFileExist_:_bRetVal___d_n
lea rcx, [rsp + 0x1a0]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0xa0], rdx
lea rdi, [rsp + 0xa0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x434950
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x60]
call fcn.0049a80c
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov eax, ebx
mov rbx, qword [rsp + 0x3c0]
mov rsi, qword [rsp + 0x3b8]
mov rdi, qword [rsp + 0x3b0]
add rsp, 0x3c8
ret
Function at 0x43e390
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x688
mov qword [rsp + 0x680], rbx
mov qword [rsp + 0x678], rdi
mov rbx, rdx
mov qword [rsp + 0x40], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x43e42e
xor r8d, r8d
lea rdx, str.CInstallWA1_::_CleanUpSourcePath_n
lea rcx, [rsp + 0x260]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x50]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x260]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x43e400
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.004548a0
mov edx, 0x104
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov r8, 0xffffffff80000002
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
lea rcx, [rsp + 0x470]
call fcn.00465d20
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x360]
lea r8, str.ProgramFilesDir
lea rdx, [rsp + 0x478]
lea rcx, [rsp + 0x470]
call fcn.004651d0
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x30]
call fcn.0049b290
nop
mov dl, 0x5c
lea rcx, [rsp + 0x30]
call fcn.0049bafc
cmp eax, 0xffffffff
je 0x43e4f5
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.00499e24
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
mov r8, qword [rsp + 0x30]
lea rdx, str._SYSTEMDRIVE_
mov rcx, rbx
call fcn.004999f4
lea r8, [rsp + 0x150]
lea rdx, str._HOMEDRIVE_
mov rcx, rbx
call fcn.004999f4
lea r8, [rsp + 0x150]
lea rdx, str._SYSTEMROOT_
mov rcx, rbx
call fcn.004999f4
lea r8, [rsp + 0x150]
lea rdx, str._WINDIR_
mov rcx, rbx
call fcn.004999f4
lea r8, [rsp + 0x360]
lea rdx, str._PROGRAMFILES_
mov rcx, rbx
call fcn.004999f4
mov rdx, qword [rbx]
mov edi, dword [rdx - 8]
mov dl, 0x5c
mov rcx, rbx
call fcn.00499914
lea ecx, [rdi - 1]
cmp eax, ecx
jne 0x43e587
mov dl, 0x5c
mov rcx, rbx
call fcn.00499914
cmp eax, 0xffffffff
je 0x43e587
mov r8d, 1
mov edx, eax
mov rcx, rbx
call fcn.0049993c
call fcn.004545a0
test eax, eax
je 0x43e5ff
xor r8d, r8d
lea rdx, str.CInstallWA1_::_CleanUpSourcePath_n
lea rcx, [rsp + 0x260]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x50]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x260]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x43e5d0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x50]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov rbx, qword [rsp + 0x680]
mov rdi, qword [rsp + 0x678]
add rsp, 0x688
ret
Function at 0x43f780
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x238
mov qword [rsp + 0x230], rbx
mov qword [rsp + 0x228], rdi
mov rbx, rcx
call fcn.004545a0
test eax, eax
je 0x43f811
lea rdx, str.CInstallWA2_::_ClosePNPWindow_n
lea rcx, [rsp + 0x120]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x203a5952544e45
xor eax, eax
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x120]
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x43f7e3
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.004548a0
lea rdx, [rbx + 8]
mov rcx, rbx
call fcn.0043f4d0
lea rcx, [0x0043f340]
mov rdx, rbx
call qword [sym.imp.USER32.dll_EnumWindows]
call fcn.004545a0
mov rbx, qword [rsp + 0x230]
test eax, eax
je 0x43f8ae
lea rdx, str.CInstallWA2_::_ClosePNPWindow_n
lea rcx, [rsp + 0x120]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x20203a54495845
xor eax, eax
mov qword [rsp + 0x20], rdx
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x120]
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x43f880
call fcn.004546e0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
mov rdi, qword [rsp + 0x228]
add rsp, 0x238
ret
Function at 0x4443b0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x148
mov qword [rsp + 0x140], rbx
mov qword [rsp + 0x138], rbp
mov qword [rsp + 0x130], rsi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x120], r12
mov qword [rsp + 0x118], r13
mov qword [rsp + 0x110], r14
mov r13, rcx
mov ebx, r8d
mov r12, rdx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.push_me_x
lea rcx, [rsp + 0x80]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov r14d, 1
lea r9, [rsp + 0x80]
mov edx, r14d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov rsi, rax
je 0x4445c0
mov rax, qword [r13]
mov edx, dword [rax - 8]
mov rax, qword [r12]
mov ecx, dword [rax - 8]
lea eax, [rcx + rdx + 0x1c]
mov ecx, 0x40
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbp, rax
je 0x4445af
bt ebx, 0x15
lea rdx, [rsp + 0x50]
lea rcx, [0x00400000]
jae 0x444491
movzx eax, word [rcx + 0xb2618]
mov word [rdx], ax
movzx eax, byte [rcx + 0xb261a]
jmp 0x4444a2
movzx eax, word [rcx + 0xb2614]
mov word [rdx], ax
movzx eax, byte [rcx + 0xb2616]
bt ebx, 0x19
mov byte [rdx + 2], al
jae 0x4444c5
mov rax, qword [rcx + 0xb2608]
lea rdx, [rsp + 0x58]
mov qword [rdx], rax
mov eax, dword [rcx + 0xb2610]
mov dword [rdx + 8], eax
jmp 0x4444de
movzx eax, word [rcx + 0xb2604]
lea rdx, [rsp + 0x58]
mov word [rdx], ax
movzx eax, byte [rcx + 0xb2606]
mov byte [rdx + 2], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8, qword [r13]
lea rdx, str._s_0x_X__s__s__s
mov r9d, eax
mov rax, qword [r12]
mov rcx, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0xa0]
mov r8d, 0x68
xor edx, edx
call fcn.00499630
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov rdx, rbp
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0xa0], 0x68
mov dword [rsp + 0xdc], 0x80
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4445af
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
cmovne edi, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x138]
mov r14, qword [rsp + 0x110]
mov r13, qword [rsp + 0x118]
mov r12, qword [rsp + 0x120]
mov eax, edi
mov rdi, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x140]
add rsp, 0x148
ret
Function at 0x444600
Capabilities:
Copy file
Delete file
Get common file path
Set file attributes

Disassembly:
sub rsp, 0x288
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x278], rdi
mov edi, ecx
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0049b290
nop
lea rdx, [rsp + 0x160]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, str.KUIU.EXE
lea rcx, [rsp + 0x30]
call fcn.0049b290
mov rbx, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x38]
call fcn.0049b290
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b804
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov edx, 0x80
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4446c4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor r8d, r8d
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, 0x80
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r8d, edi
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.004443b0
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
mov eax, ebx
mov rbx, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x278]
add rsp, 0x288
ret
jmp 0x444600

Function at 0x4447b0
Capabilities:
Copy file
Delete file
Get common file path
Set file attributes

Disassembly:
sub rsp, 0x288
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x278], rdi
mov edi, ecx
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0049b290
nop
lea rdx, [rsp + 0x160]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, str.KUIU.EXE
lea rcx, [rsp + 0x30]
call fcn.0049b290
mov rbx, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x38]
call fcn.0049b290
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b804
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov edx, 0x80
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4446c4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor r8d, r8d
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, 0x80
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov r8d, edi
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.004443b0
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
mov eax, ebx
mov rbx, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x278]
add rsp, 0x288
ret
jmp 0x444600
Function at 0x446ae0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x638
mov qword [rsp + 0x630], rbx
mov qword [rsp + 0x628], rbp
mov qword [rsp + 0x620], rsi
mov qword [rsp + 0x618], rdi
mov rsi, r8
mov rbp, rdx
call fcn.004545a0
test eax, eax
je 0x446b87
lea rdx, str.CVistaWaveRT::IsINIWaveRTSectionExist_n
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x203a5952544e45
xor eax, eax
mov qword [rsp + 0x120], rdx
lea rdi, [rsp + 0x120]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x446b56
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
lea rdx, [rsp + 0x120]
mov rcx, rax
call fcn.004548a0
call fcn.004545a0
test eax, eax
je 0x446bb9
lea rdx, str.pszINIFile___s__pszection___s_n
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8, rbp
call fcn.00486850
call fcn.004546e0
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.004548a0
lea rdx, [rsp + 0x220]
mov r9, rbp
mov r8d, 0x3e8
mov rcx, rsi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov ecx, 1
test eax, eax
cmovg ebx, ecx
call fcn.004545a0
mov rsi, qword [rsp + 0x620]
test eax, eax
mov rbp, qword [rsp + 0x628]
je 0x446c71
lea rdx, str.CVistaWaveRT::IsINIWaveRTSectionExist_:_bRetVal___d_n
lea rcx, [rsp + 0x20]
mov r8d, ebx
call fcn.00486850
xor eax, eax
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x120], rdx
lea rdi, [rsp + 0x120]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rax, [rsp + 0x20]
xor edx, edx
nop
nop
movzx ecx, byte [rax + rdx]
inc rdx
test cl, cl
mov byte [rdi + rdx - 2], cl
jne 0x446c40
call fcn.004546e0
lea rdx, [rsp + 0x120]
mov rcx, rax
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
mov rdi, qword [rsp + 0x618]
mov eax, ebx
mov rbx, qword [rsp + 0x630]
add rsp, 0x638
ret
Function at 0x446c90
Capabilities:
Delete file

Disassembly:
mov eax, 0x1548
call fcn.00499730
sub rsp, rax
mov qword [rsp + 0x1540], rbx
mov qword [rsp + 0x1538], rbp
mov qword [rsp + 0x1530], rsi
mov qword [rsp + 0x1528], rdi
mov rbp, rdx
mov rsi, rcx
mov qword [rsp + 0x28], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x446d43
xor r8d, r8d
lea rdx, str.CVistaWaveRT::ProcessWriteSectionDataThroughINI_n
lea rcx, [rsp + 0x130]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x30], rdx
lea rdi, [rsp + 0x30]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x130]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x446d15
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.004548a0
mov rcx, qword [rsi + 0x108]
call fcn.004874a0
xor edi, edi
mov qword [rsp + 0x230], rdi
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x258], rdi
mov qword [rsp + 0x378], rdi
mov r8d, 0x1f4
mov edx, 0x4b
lea rcx, [rsp + 0x380]
call fcn.00499630
lea rax, [rsp + 0x578]
mov ecx, 0x3e
nop
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
add rax, 0x40
mov qword [rax - 0x28], rdi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x10], rdi
mov qword [rax - 8], rdi
dec rcx
jne 0x446da0
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov qword [rsp + 0x268], 0xffffffffffffffff
mov rdx, rsi
lea rcx, [rsp + 0x230]
call fcn.00428550
nop
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.0049b680
xor r8d, r8d
mov rdx, rax
mov rcx, rsi
call fcn.004468a0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.TASKS
lea rcx, [rsp + 0x230]
call fcn.0042ba50
mov ebx, eax
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.0049b680
mov r8d, 1
mov rdx, rax
mov rcx, rsi
call fcn.004468a0
lea rcx, str.RTWaveTempINI.ini
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.004545a0
test eax, eax
je 0x446ecf
mov r8d, ebx
lea rdx, str.CVistaWaveRT::ProcessWriteSectionDataThroughINI_:_bRetVal___d_n
lea rcx, [rsp + 0x130]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x30], rdx
lea rdi, [rsp + 0x30]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x130]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x446ea0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x230]
call fcn.00424740
mov eax, ebx
mov rbx, qword [rsp + 0x1540]
mov rbp, qword [rsp + 0x1538]
mov rsi, qword [rsp + 0x1530]
mov rdi, qword [rsp + 0x1528]
add rsp, 0x1548
ret
Function at 0x455050
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
sub rsp, 0x288
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x278], rsi
mov qword [rsp + 0x270], rdi
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x20], rax
test rdx, rdx
je 0x4551df
test r8d, r8d
je 0x4550a9
lea rbx, [rcx + 0x30]
mov rcx, rbx
call fcn.0049b398
jmp 0x455146
mov r8d, 0x104
lea rdx, [rsp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x50]
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r11, qword [rsp + 0x38]
mov byte [r11], 0
mov rdx, rsi
lea rcx, [rsp + 0x28]
call fcn.0049b290
mov rbx, rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.0049b290
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.0049b804
nop
lea rbx, [rdi + 0x30]
mov rdx, rax
mov rcx, rbx
call fcn.0049b31c
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
mov rcx, rdi
call fcn.00454770
test eax, eax
jne 0x4551df
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.0049b31c
mov dl, 0x5c
lea rcx, [rsp + 0x20]
call fcn.00499914
inc eax
mov r8d, eax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.0049993c
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.0049b9f4
nop
mov rdx, rax
mov rcx, rbx
call fcn.0049b31c
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
mov edx, 0x80
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4551d6
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
call fcn.00454770
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
mov rbx, qword [rsp + 0x280]
mov rsi, qword [rsp + 0x278]
mov rdi, qword [rsp + 0x270]
add rsp, 0x288
ret
Function at 0x455d50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x128
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x118], rbp
mov qword [rsp + 0x110], rsi
mov qword [rsp + 0x108], rdi
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], 0xfffffffffffffffe
test rdx, rdx
jne 0x455d92
xor eax, eax
jmp 0x455e71
movzx edx, r8w
lea r8, str.IMAGE
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
je 0x455e71
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x455e71
xor r9d, r9d
mov r8d, ebp
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.004a5f14
nop
xor ebx, ebx
mov qword [rsp + 0x20], rbx
mov r9d, 0x1000
mov r8d, 3
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.004a40fc
nop
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.0049a6f4
mov rcx, qword [rdi]
test rcx, rcx
je 0x455e37
test rcx, rcx
je 0x455e37
mov qword [rdi], rbx
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
mov qword [rsp + 0x20], rdi
lea r9, [0x004bcf50]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
nop
lea rcx, [rsp + 0x90]
call fcn.004a4a58
nop
lea rcx, [rsp + 0x50]
call fcn.004a62dc
mov eax, 1
mov rbx, qword [rsp + 0x120]
mov rbp, qword [rsp + 0x118]
mov rsi, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x108]
add rsp, 0x128
ret
Function at 0x456a60
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x388
mov qword [rsp + 0x380], rbx
mov qword [rsp + 0x378], rdi
mov qword [rsp + 0x58], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x456afe
xor r8d, r8d
lea rdx, str.CPrepareInstall_::_PrepareInstallWin98_n
lea rcx, [rsp + 0x270]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x60], rdx
lea rdi, [rsp + 0x60]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x270]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x456ad0
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.004548a0
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x160], 0
mov r8d, 0x103
xor edx, edx
lea rcx, [rsp + 0x161]
call fcn.00499630
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, str.DRVIDX.BIN
lea rcx, [rsp + 0x38]
call fcn.0049b290
mov rbx, rax
lea rdx, str.INF_
lea rcx, [rsp + 0x30]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x48]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.0049b804
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.004230e0
lea rdx, str.DRVDATA.BIN
lea rcx, [rsp + 0x40]
call fcn.0049b290
mov rbx, rax
lea rdx, str.INF_
lea rcx, [rsp + 0x50]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x48]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b804
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.004230e0
call fcn.004545a0
test eax, eax
je 0x456d1f
xor r8d, r8d
lea rdx, str.CPrepareInstall_::_PrepareInstallWin98_n
lea rcx, [rsp + 0x270]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x60], rdx
lea rdi, [rsp + 0x60]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x270]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x456cf0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x60]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
mov rbx, qword [rsp + 0x380]
mov rdi, qword [rsp + 0x378]
add rsp, 0x388
ret