joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002d80
Capabilities:
Delete file
Get common file path
Move file
Set file attributes

Disassembly:
sub rsp, 0x8a8
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x890], rax
xor eax, eax
lea rcx, [rsp + 0x262]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov word [rsp + 0x260], ax
call fcn.140080d50
lea rcx, [rsp + 0x472]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x470], 0
call fcn.140080d50
lea rcx, [rsp + 0x470]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x46e], 0x5c
je 0x140002e2a
lea rdx, [0x1400a3ff4]
lea rcx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.140015a10
cmp eax, 6
jne 0x140002f44
lea rcx, [rsp + 0x682]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x680], 0
call fcn.140080d50
lea rcx, [rsp + 0x680]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x680]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x67e], 0x5c
je 0x140002e9b
lea rdx, [0x1400a3ff4]
lea rcx, [rsp + 0x680]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x260]
xor edx, edx
mov r8d, 0x208
call fcn.140080d50
mov r9, qword [0x1400e92e8]
lea r11, str..FTS
lea r8, [rsp + 0x680]
lea rdx, [0x1400a4180]
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x20], r11
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x260]
call fcn.140069914
test eax, eax
je 0x140002f2f
lea rcx, [rsp + 0x260]
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140002f2f
lea r8d, [rax + 4]
lea rcx, [rsp + 0x260]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
lea rdx, str.SpoolDriversx643
lea rcx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9, qword [0x1400e92e8]
lea rax, str..GID
lea r8, [rsp + 0x470]
lea rdx, [0x1400a4160]
lea rcx, [rsp + 0x260]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x260]
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.140081050
add rsp, 0x8a8
ret
Function at 0x140003270
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
lea rdx, [0x1400a4120]
lea rcx, [rsp + 0x40]
lea ebx, [rdi + 1]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x1400a3ff4]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
call fcn.140069504
lea rcx, [rsp + 0x40]
mov rdx, qword [rax + 8]
mov rax, qword [rdx + 0x2f8]
cmp dword [rax - 0x10], edi
jne 0x1400032f2
mov rdx, qword [rdx + 0x5b8]
jmp 0x1400032f5
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 0x2011f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003369
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
cmovne ebx, edi
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
cmp eax, 2
je 0x140003346
cmp eax, 3
je 0x140003346
xor eax, eax
jmp 0x140003348
Function at 0x140003a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov ebx, r8d
shr eax, 4
mov rsi, rcx
mov r8d, 6
add ax, 1
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x140003ba2
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140003ba2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x140003ba2
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x140003ae6
nop
cmp rdi, r11
jae 0x140003ba2
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x140003ad0
cmp rdi, r11
jae 0x140003ba2
movzx eax, word [rdi]
test ax, ax
je 0x140003ba2
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x140003b1c
mov edx, ebx
mov rcx, rsi
call fcn.140003180
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x140003b39
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.140080540
test eax, eax
je 0x140003b78
cmp eax, 0xc
je 0x140003b72
cmp eax, 0x16
je 0x140003b6c
cmp eax, 0x22
je 0x140003b6c
cmp eax, 0x50
je 0x140003b78
call fcn.14006766c
int3
call fcn.14006766c
int3
call fcn.140067624
int3
test ebx, ebx
js 0x140003b97
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x140003b97
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x140003ba4
mov ecx, 0x80070057
call fcn.140001000
int3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x140003e80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, edx
mov ebx, edx
call fcn.1400696b8
test rax, rax
jne 0x140003ea6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003a40
Function at 0x1400042c0
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set current directory
Set file attributes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x6b0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x6e0], rbx
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
mov rbp, r8
mov r12, rdx
mov r13, rcx
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140004459
mov rcx, rbx
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140004459
lea rdx, [rsp + 0x490]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140004459
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x140004459
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
call fcn.1400696cc
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140004380
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x30]
lea rcx, str..lnk
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000442b
nop
lea r9, [rsp + 0x5c]
mov r8, r12
lea rdx, [0x1400a3e50]
lea rcx, [rsp + 0x20]
call fcn.1400040b0
lea r9, [rsp + 0x280]
mov rdi, qword [rsp + 0x20]
mov r8, rdi
xor edx, edx
mov rcx, r13
call fcn.140002c30
test eax, eax
js 0x140004410
mov rdx, rbp
lea rcx, [rsp + 0x280]
call fcn.1400807e0
test eax, eax
jne 0x140004410
lea edx, [rax + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400043b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140004459
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x6b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400049d0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x34]
xor edx, edx
mov r8d, 0x204
mov dword [rsp + 0x30], 0
call fcn.140080d50
lea rdx, [rdi + 0x20]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rdx
lea r8, str.0.00
lea rcx, str.VersionInfo
lea rdx, str.AboutDLGVersion
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
or rcx, 0xffffffffffffffff
test eax, eax
je 0x140004a54
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
jmp 0x140004a62
lea rdi, str.0.00
lea rdx, str.0.00
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.140003c40
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x140004aa0
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x64]
xor ebp, ebp
xor edx, edx
mov r8d, 0x204
mov dword [rsp + 0x60], ebp
call fcn.140080d50
mov rax, qword [rsi]
cmp dword [rax - 0x10], ebp
mov rdi, qword [rax - 0x18]
lea rdx, [rax - 0x18]
je 0x140004b3f
cmp dword [rdx + 0x10], ebp
jge 0x140004b17
cmp dword [rax - 0xc], ebp
jge 0x140004b0c
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rax - 0x10], ebp
mov rax, qword [rsi]
mov word [rax], bp
jmp 0x140004b3f
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140004b2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, str.Shell32.dll
mov rcx, rbx
call fcn.1400016d0
cmp eax, 0x50000
jb 0x140004bcd
lea rdx, str.Shlwapi.dll
mov rcx, rbx
call fcn.1400016d0
cmp eax, 0x50000
jb 0x140004bcd
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x140004c4a
lea r8, [rsp + 0x30]
lea edx, [rax + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x140004c4a
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140004c4a
lea rax, [rsp + 0x48]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 0x104
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x48], rbp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004c4a
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.ProgramFilesDir
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004c4a
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140004c93
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
lea rdx, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.140003c40
mov eax, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140004cc0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rdx
lea rcx, [rsp + 0x64]
xor esi, esi
xor edx, edx
mov r8d, 0x204
mov dword [rsp + 0x60], esi
call fcn.140080d50
mov rcx, qword [rbx]
cmp dword [rcx - 0x10], esi
mov rdi, qword [rcx - 0x18]
lea rdx, [rcx - 0x18]
je 0x140004d57
cmp dword [rdx + 0x10], esi
jge 0x140004d2f
cmp dword [rcx - 0xc], esi
jge 0x140004d24
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rcx - 0x10], esi
mov rax, qword [rbx]
mov word [rax], si
jmp 0x140004d57
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140004d47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
call fcn.140015a10
cmp eax, 2
je 0x140004dc8
cmp eax, 3
je 0x140004dc8
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x140004e45
lea r8, [rsp + 0x30]
lea edx, [rax + 0x19]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x140004e45
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140004e45
lea rax, [rsp + 0x48]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionexplorerShell_Folders
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 0x104
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x48], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004e45
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.Common_Desktop
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004e45
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140004e8e
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
lea rdx, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.140003c40
mov eax, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140007d10
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x28
test rdx, rdx
jne 0x140007d20
xor eax, eax
add rsp, 0x28
ret
mov r9, rdx
lea rcx, str.Profiles
lea rdx, str.CAPTVERSION
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
sub eax, 0xd2
je 0x140007d5f
sub eax, 0x5a
je 0x140007d55
cmp eax, 0xa
jne 0x140007d19
mov eax, 0x136
add rsp, 0x28
ret
mov eax, 0x12c
add rsp, 0x28
ret
mov eax, 0xd2
add rsp, 0x28
ret
Function at 0x14000a0b0
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xa80
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0xa70], rax
mov rax, qword [r9]
mov rbx, qword [rsp + 0xad0]
mov rbp, rdx
cmp dword [rax - 0x10], 0
mov rdi, qword [rax - 0x18]
lea rdx, [rax - 0x18]
mov rsi, r9
mov r12, r8
je 0x14000a142
cmp dword [rdx + 0x10], 0
jge 0x14000a11a
cmp dword [rax - 0xc], 0
jge 0x14000a109
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rax - 0x10], 0
mov rax, qword [r9]
mov word [rax], 0
jmp 0x14000a142
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000a132
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
mov rdi, qword [rax - 0x18]
lea rdx, [rax - 0x18]
je 0x14000a1a3
cmp dword [rdx + 0x10], 0
jge 0x14000a17b
cmp dword [rax - 0xc], 0
jge 0x14000a16a
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rax - 0x10], 0
mov rax, qword [rbx]
mov word [rax], 0
jmp 0x14000a1a3
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000a193
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14000a2d8
mov qword [rsp + 0x40], 0x100
lea rax, [rsp + 0x870]
lea r9, [rsp + 0x670]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x470]
mov qword [rsp + 0x30], 0x100
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
mov r8d, 3
mov rcx, rbp
mov qword [rsp + 0x20], 0x100
call fcn.140082440
lea r8, [rsp + 0x470]
lea rcx, [rsp + 0x60]
mov edx, 0x100
call fcn.140081cd0
lea rcx, [rsp + 0x60]
mov r8, r12
mov edx, 0x100
call fcn.140082370
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
lea rdx, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rsi
call fcn.140003c40
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call fcn.140081cd0
lea r8, [rsp + 0x670]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call fcn.140082370
lea r8, [rsp + 0x60]
lea rcx, [rsp + 0x260]
mov edx, 0x104
call fcn.140082370
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x260]
lea rdx, [rsp + 0x260]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.140003c40
mov rdx, qword [rsi]
cmp dword [rdx - 0x10], 0
je 0x14000a2d8
mov rax, qword [rbx]
cmp dword [rax - 0x10], 0
je 0x14000a2d8
mov eax, 1
jmp 0x14000a2da
xor eax, eax
mov rcx, qword [rsp + 0xa70]
xor rcx, rsp
call fcn.140081050
add rsp, 0xa80
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000ee10
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x270
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x10], rbp
xor ebp, ebp
mov rbx, rdx
mov qword [r11 - 0x20], r12
mov r12, rcx
lea edx, [rbp + 6]
xor ecx, ecx
xor sil, sil
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x14000ee63
cmp eax, 0x80010106
jne 0x14000ef32
mov qword [rsp + 0x250], r13
lea rdx, [rsp + 0x20]
mov r13d, 1
mov rcx, r12
mov ebp, r13d
call fcn.14000e570
test eax, eax
js 0x14000ef2a
lea rcx, [rsp + 0x30]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14000ef2a
mov qword [rsp + 0x260], rdi
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
mov eax, dword [0x1400a3ff4]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
xor ecx, ecx
movzx eax, word [rbx + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x14000eed0
mov rdx, qword [rsp + 0x20]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
lea r8, [rsp + 0x30]
repne scasw ax, word [rdi]
mov rax, qword [str.RPD.exe]
mov rcx, r12
mov qword [rdi - 2], rax
mov rax, qword [0x1400a5058]
mov qword [rdi + 6], rax
call fcn.14000ea20
mov rdi, qword [rsp + 0x260]
test eax, eax
movzx esi, sil
cmovns esi, r13d
mov r13, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x20]
mov rcx, r12
call fcn.14000e610
mov r12, qword [rsp + 0x258]
mov rbx, qword [rsp + 0x290]
test ebp, ebp
mov rbp, qword [rsp + 0x268]
je 0x14000ef61
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, sil
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140081050
add rsp, 0x270
pop rsi
ret
Function at 0x140010f90
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x480
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x4a0], rbx
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x38], rdx
xor edi, edi
mov dword [rsp + 0x30], edi
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140011058
mov dx, 0x5c
lea rcx, [rsp + 0x50]
call fcn.140080890
lea rdx, [0x1400a4120]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x1400a3ff4]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.DebugMessage_Uninst.ini
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x260]
lea r8, [0x1400a4510]
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call fcn.1400696cc
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x140011076
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
lea rcx, [rsp + 0x260]
lea rax, [rsp + 0x260]
test rax, 0xffffffffffff0000
jne 0x1400110ba
movzx edi, cx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x1400110e3
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call fcn.140003a40
jmp 0x1400110e3
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x260]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.140003c40
nop
mov rax, rbx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140081050
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x480
pop rdi
pop rsi
pop rbp
ret