joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000212c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
lea rcx, [rax - 0x30]
call fcn.1400127c0
nop
mov rax, qword [0x140058260]
mov edx, dword [rax + 0x642]
lea rcx, [rsp + 0x28]
call fcn.140012800
lea r8, str.INFOEXE
mov edx, 0x7d
mov rcx, qword [0x140058258]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
mov rcx, qword [0x140058258]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [0x140058260]
mov r8d, dword [rcx + 0x642]
mov rdx, rax
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140020ea0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
test rdi, rdi
je 0x14000225c
mov r8d, 0xe
lea rdx, str.WLL_list
mov rcx, rdi
call fcn.1400268f0
test eax, eax
jne 0x14000225c
lea rbx, [rdi + 0xe]
movzx esi, word [rbx]
mov r15d, 0x5800
movzx eax, si
sub ax, r15w
mov ecx, 0x101
cmp ax, cx
ja 0x14000225c
jmp 0x14000224f
mov rbp, rbx
mov rcx, rbx
call fcn.140026150
inc rax
add rbx, rax
mov r14, rbx
movzx edx, word [rbx]
add rbx, 4
test dil, 4
je 0x140002234
mov rcx, rbp
call fcn.140001ff8
cmp si, r15w
cmovbe rbx, r14
mov rax, rbx
mov ecx, 0x5900
add rbx, 4
cmp si, cx
cmovbe rbx, rax
mov dil, byte [rbx + 4]
add rbx, 5
test dil, dil
jns 0x14000220b
lea rcx, [rsp + 0x28]
call fcn.1400127d8
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140002280
Capabilities:
Get file version info

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x110
lea rbp, [rsp + 0x30]
mov rsi, rdx
mov qword [rbp + 0x110], rbx
lea rdx, [rbp + 0x128]
mov r14, rcx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
xor r15d, r15d
movsxd rdi, eax
test eax, eax
je 0x1400023cc
lea rax, [rdi + 0xf]
mov r8, rdi
cmp rax, rdi
ja 0x1400022d6
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140037ab0
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400023cc
xor edx, edx
mov rcx, rbx
call fcn.140021310
mov edx, dword [rbp + 0x128]
mov r9, rbx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1400023cc
lea r9, [rbp + 0x120]
mov rcx, rbx
lea r8, [rbp]
lea rdx, [0x140055a78]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400023cc
mov rax, qword [rbp]
lea rdi, str.VersionVI
lea rdx, [0x140055a38]
mov qword [rsp + 0x20], rdi
lea rcx, [rbp + 0x10]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
call fcn.140003170
lea r9, [rbp + 0x120]
mov rcx, rbx
lea r8, [rbp]
lea rdx, [rbp + 0x10]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x1400023ae
mov r8, rdi
lea rdx, [0x1400559f8]
lea rcx, [rbp + 0x10]
call fcn.140003170
lea r9, [rbp + 0x120]
mov rcx, rbx
lea r8, [rbp]
lea rdx, [rbp + 0x10]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1400023cc
mov rdx, qword [rbp]
mov r8d, 0x14
mov rcx, rsi
call fcn.140026720
mov eax, 1
mov word [rsi + 0x26], r15w
jmp 0x1400023ce
xor eax, eax
mov rbx, qword [rbp + 0x110]
lea rsp, [rbp + 0xe0]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400023e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rdi, rcx
lea r8, str.FRAMEWORK
mov rcx, qword [0x140058258]
mov edx, 0x84
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x140058258]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rax
lea rcx, [0x140058230]
call fcn.140013a90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [0x140058230]
xor esi, esi
test rax, rax
je 0x140002459
cmp word [rax], si
jne 0x14000246c
lea rdx, [0x140044140]
lea rcx, [0x140058230]
call fcn.140013a90
lea rcx, [0x140058248]
call fcn.140013a24
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400266bc
lea rcx, [rsp + 0x20]
call fcn.14000f670
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400266d8
lea rcx, [rsp + 0x20]
call fcn.14000f414
mov rcx, qword [0x140058258]
lea r8, str.FRAMEWORK
mov edx, 0x85
test eax, eax
jne 0x1400024c2
mov edx, 0x86
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x140058258]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdi, [0x140058238]
mov rdx, rax
mov rcx, rdi
call fcn.140013a90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, qword [0x140058238]
test rax, rax
je 0x140002510
cmp word [rax], si
jne 0x140002534
lea rcx, [rsp + 0x20]
call fcn.14000f414
lea rdx, [0x1400442d0]
mov rcx, rdi
test eax, eax
jne 0x14000252f
lea rdx, [0x140044470]
call fcn.140013a90
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140002b68
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140002b70
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor edi, edi
mov qword [rbp + 0x188], rdi
mov ebx, edi
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x140002cb4
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call fcn.140021310
mov dword [rbp + 0x178], 0x208
lea rax, [rbp + 0x178]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Program
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
js 0x140002ca7
mov qword [rbp + 0x180], rdi
lea r8, str.FrameworkWin64x86
mov edx, 0x105
lea rcx, [rsp + 0x40]
call fcn.140012a5c
cmp word [rsp + 0x40], di
je 0x140002c99
lea rcx, [rsp + 0x40]
call fcn.14000f904
test eax, eax
je 0x140002c99
lea r9, [0x140043fe0]
lea r8, [rsp + 0x40]
lea rdx, [0x1400440d8]
lea rcx, [rbp + 0x180]
call fcn.1400142bc
lea rcx, [rbp + 0x180]
call fcn.140013a24
mov rcx, rax
call fcn.14000f8d0
mov ebx, eax
test eax, eax
je 0x140002c9b
lea rdx, [rsp + 0x40]
lea rcx, [0x140058248]
call fcn.140013a90
jmp 0x140002c9b
mov ebx, edi
lea rcx, [rbp + 0x180]
call fcn.140013988
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x250
pop rdi
pop rbx
pop rbp
ret

Function at 0x140002b70
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x140002b70
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor edi, edi
mov qword [rbp + 0x188], rdi
mov ebx, edi
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rcx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x140002cb4
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x40]
call fcn.140021310
mov dword [rbp + 0x178], 0x208
lea rax, [rbp + 0x178]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Program
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
js 0x140002ca7
mov qword [rbp + 0x180], rdi
lea r8, str.FrameworkWin64x86
mov edx, 0x105
lea rcx, [rsp + 0x40]
call fcn.140012a5c
cmp word [rsp + 0x40], di
je 0x140002c99
lea rcx, [rsp + 0x40]
call fcn.14000f904
test eax, eax
je 0x140002c99
lea r9, [0x140043fe0]
lea r8, [rsp + 0x40]
lea rdx, [0x1400440d8]
lea rcx, [rbp + 0x180]
call fcn.1400142bc
lea rcx, [rbp + 0x180]
call fcn.140013a24
mov rcx, rax
call fcn.14000f8d0
mov ebx, eax
test eax, eax
je 0x140002c9b
lea rdx, [rsp + 0x40]
lea rcx, [0x140058248]
call fcn.140013a90
jmp 0x140002c9b
mov ebx, edi
lea rcx, [rbp + 0x180]
call fcn.140013988
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x250
pop rdi
pop rbx
pop rbp
ret
Function at 0x140002d2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x628]
sub rsp, 0x710
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, rcx
mov rdx, qword [0x140058260]
add rdx, 0x87c
lea rcx, [rsp + 0x48]
call fcn.1400266bc
lea rcx, [rsp + 0x48]
call fcn.140012950
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140013934
nop
lea r8, [0x1400446c8]
lea rdx, [0x1400445f8]
lea rcx, [rsp + 0x38]
call fcn.140014248
lea rcx, [rsp + 0x38]
call fcn.140013a24
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400266bc
mov edi, 1
mov r8d, edi
lea rdx, str.xxxxxxxxxx
lea rcx, [rsp + 0x48]
call fcn.140026970
xor ebx, ebx
test eax, eax
je 0x140002f94
lea rcx, [0x140058248]
call fcn.140013a24
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400266bc
lea rcx, [rbp - 0x20]
call fcn.14000f670
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.1400266d8
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x20]
call fcn.140002280
test eax, eax
je 0x140002f94
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x30]
call fcn.140013934
nop
lea r8, [0x1400446c8]
lea rdx, [0x1400445f8]
lea rcx, [rsp + 0x30]
call fcn.140014248
lea rcx, [rsp + 0x30]
call fcn.140013a24
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.1400266bc
mov r8d, edi
lea rdx, str.xxxxxxxxxx
lea rcx, [rbp - 0x80]
call fcn.140026970
test eax, eax
je 0x140002f86
lea r8d, [rdi + 5]
lea rdx, [rsp + 0x4e]
lea rcx, [rbp - 0x7a]
call fcn.140026970
test eax, eax
jns 0x140002f86
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r9d, r9d
lea r8, [rbp + 0x400]
xor edx, edx
lea rcx, [rbp + 0x1f0]
call fcn.1400035d0
lea r9, [rbp + 0x400]
lea r8, str.SOFTWAREPC_SOFTWINDEV25.0APPLI
lea rdx, [0x1400440d8]
lea rcx, [rsp + 0x40]
call fcn.1400031c4
mov qword [rbp + 0x648], rbx
lea rcx, [rsp + 0x40]
call fcn.140013a24
lea rcx, [rbp + 0x648]
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002f7a
lea r8d, [rdi + 0x29]
mov dword [rbp + 0x638], r8d
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140021310
lea rax, [rbp + 0x638]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x640]
xor r8d, r8d
lea rdx, str.LAST_FRAMEWORK
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002f6d
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x4e]
call fcn.140026768
test eax, eax
setne bl
mov edi, ebx
mov rcx, qword [rbp + 0x648]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.140013988
jmp 0x140002f88
mov edi, ebx
lea rcx, [rsp + 0x30]
call fcn.140013988
jmp 0x140002f96
mov edi, ebx
lea rcx, [rsp + 0x38]
call fcn.140013988
mov eax, edi
mov rbx, qword [rsp + 0x730]
add rsp, 0x710
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003020
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x30
mov rdi, rcx
xor esi, esi
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140003091
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140003073
lea r9d, [rsi + 1]
mov rdx, rdi
lea r8d, [rsi + 0x2b]
xor ecx, ecx
call rax
mov esi, eax
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jne 0x140003126
lea rax, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
js 0x1400030fc
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.CommonFilesDir
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rsp + 0x48], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jns 0x140003126
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x3ff
lea rdx, str.C:Program_FilesFichiers_communs
and ax, cx
mov rcx, rdi
cmp ax, 0xc
je 0x140003121
lea rdx, str.C:Program_FilesCommon_Files
call fcn.1400266bc
mov rcx, rdi
call fcn.14000f670
lea r8, str.PC_SOFT25.0Framework
mov edx, 0x104
mov rcx, rdi
call fcn.140012a5c
mov rcx, rdi
call fcn.14000f670
lea rdx, str.64x86
mov rcx, rdi
call fcn.1400266d8
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp fcn.14000f670
Function at 0x140003d54
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x250
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbx, rcx
lea rdi, [rcx + 0x42c]
lea rdx, [rcx + 0x18]
mov rcx, rdi
call fcn.1400266bc
lea rdx, str.WDUPDATE.NET
mov rcx, rdi
call fcn.1400266d8
lea rbp, [rbx + 0x840]
mov r9, rdi
xor r8d, r8d
lea rdx, str.RESEAU
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp dword [rbx + 0xc54], 0
je 0x140003e01
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8, rbp
lea rdx, str.100___Lecture_de_la_cl
lea rcx, [rsp + 0x260]
call fcn.1400031c4
nop
mov rcx, rax
call fcn.140013a24
mov rdx, rax
mov rcx, rbx
call fcn.140003c50
nop
lea rcx, [rsp + 0x260]
call fcn.140013988
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1400446c8]
lea rdx, str.PROTOCOLE
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.LOCAL
lea rcx, [rsp + 0x40]
call fcn.140026768
test eax, eax
jne 0x140003e47
and dword [rbx + 0x11d0], eax
jmp 0x140003e66
lea rdx, str.HTTP
lea rcx, [rsp + 0x40]
call fcn.140026768
test eax, eax
jne 0x140003e6a
mov dword [rbx + 0x11d0], 1
mov eax, esi
jmp 0x140003e6c
xor eax, eax
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140004944
Capabilities:
Get hostname
Get session user name
Query environment variable
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
lea r12, [rcx + 0xcdc]
mov rdi, rcx
mov rcx, r12
lea rdx, [0x1400453a0]
call fcn.1400266bc
lea r13, [rdi + 0xc58]
mov dword [rbp + 0x198], 0x41
mov rcx, r13
lea rdx, [rbp + 0x198]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0x36]
lea rcx, [rdi + 0xd0e]
movzx r9d, word [rsp + 0x32]
lea rdx, str._04i_02i_02i
movzx r8d, word [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.140003170
movzx r9d, word [rsp + 0x3a]
lea rcx, [rdi + 0xd20]
movzx r8d, word [rsp + 0x38]
lea rdx, str._02i_02i
call fcn.140003170
cmp dword [rdi + 0xc54], 0
je 0x140004a07
lea rdx, str.120___R
mov rcx, rdi
call fcn.140003c50
lea rsi, [rdi + 0xd2a]
mov ebx, 0x1e
mov r8d, ebx
lea rcx, str._USERNAME_
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, rsi
lea rcx, str._USERNAME_
call fcn.140026768
test eax, eax
jne 0x140004a4f
lea rdx, [rbp + 0x1a0]
mov dword [rbp + 0x1a0], ebx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [rdi + 0xc54], 0
je 0x140004a67
lea rdx, str.121___R
mov rcx, rdi
call fcn.140003c50
xor r9d, r9d
lea r14, [rdi + 0xd68]
mov rdx, r14
lea r15, [rdi + 0x840]
lea r8d, [r9 + 0x15]
call fcn.140005b54
test eax, eax
jne 0x140004ad3
lea rdx, [rdi + 0x18]
lea rcx, [rsp + 0x40]
call fcn.1400266bc
lea rdx, str.WDUPDATE.NET
lea rcx, [rsp + 0x40]
call fcn.1400266d8
lea rax, [rsp + 0x40]
mov r9, r14
mov qword [rsp + 0x28], rax
lea r8, [0x1400446c8]
lea rdx, str.VERSION
mov dword [rsp + 0x20], 0x14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rbx, [rdi + 0xd92]
mov rdx, r15
mov rcx, rbx
call fcn.1400266bc
mov rcx, qword [rdi + 0x11c8]
lea rdx, [rbp + 0x190]
xor r9d, r9d
mov word [rbp + 0x190], 0xfeff
mov rax, qword [rcx]
lea r8d, [r9 + 2]
call qword [rax + 0x28]
mov rcx, qword [rdi + 0x11c8]
lea rdx, str._LOCK__r_n
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rdi + 0x11c8]
lea rdx, str.MACHINE_s_r_n
mov r8, r13
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rdi + 0x11c8]
lea rdx, str.IP_s_r_n
mov r8, r12
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rdi + 0x11c8]
lea r8, [rdi + 0xd0e]
lea rdx, str.DATECONNECT_s_r_n
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rdi + 0x11c8]
lea r8, [rdi + 0xd20]
lea rdx, str.HEURECONNECT_s_r_n
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rdi + 0x11c8]
lea rdx, str.LOGIN_s_r_n
mov r8, rsi
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rdi + 0x11c8]
lea rdx, str.VERSION_s_r_n
mov r8, r14
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [rdi + 0x11c8]
lea rdx, str.APPLICATION_s_r_n
mov r8, rbx
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rbx, qword [rsp + 0x2a8]
mov eax, 1
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400054a4
Capabilities:
Read .ini file

Disassembly:
push rdi
mov eax, 0x21a0
call fcn.140037ab0
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x21b8], rbx
mov qword [rsp + 0x21c0], rbp
mov qword [rsp + 0x21c8], rsi
mov rsi, rcx
lea rdx, [rcx + 0x18]
lea rcx, [rsp + 0x40]
call fcn.1400266bc
lea rdx, str.WDUPDATE.NET
lea rcx, [rsp + 0x40]
call fcn.1400266d8
lea rbp, [rsi + 0x840]
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.INSTALLENCOURS
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
xor ebx, ebx
cmp dword [rsi + 0xc54], ebx
je 0x14000555a
mov r8d, eax
lea rdx, str.125___Lecture_du_flag_dinstall_en_cours_:__i
lea rcx, [rsp + 0x21b0]
call fcn.1400031c4
nop
mov rcx, rax
call fcn.140013a24
mov rdx, rax
mov rcx, rsi
call fcn.140003c50
nop
lea rcx, [rsp + 0x21b0]
call fcn.140013988
cmp edi, 1
jne 0x1400055ca
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xfa0
lea r9, [rsp + 0x250]
xor r8d, r8d
lea rdx, str.MSG_INSTALLENCOURS
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x1400055a4
lea rdx, str.La_pr
lea rcx, [rsp + 0x250]
call fcn.1400266bc
mov r9d, 0x24
mov r8, rbp
lea rdx, [rsp + 0x250]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x1400055ca
mov rcx, rsi
call fcn.140005194
test edi, edi
setne bl
mov eax, ebx
lea r11, [rsp + 0x21a0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140005640
Capabilities:
Create mailslot

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x240
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x30]
call fcn.140021310
lea r8, [rdi + 0x840]
lea rdx, str..mailslot_s
lea rcx, [rsp + 0x30]
call fcn.140003170
xor r9d, r9d
or r8d, 0xffffffff
mov edx, 0x2000
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov qword [rdi + 0xfb0], rax
xor ebx, ebx
cmp rax, 0xffffffffffffffff
jne 0x140005700
or rax, rax
cmp dword [rdi + 0xc54], ebx
je 0x1400056fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Echec_de_la_cr
lea rcx, [rsp + 0x250]
call fcn.1400031c4
nop
mov rcx, rax
call fcn.140013a24
mov rdx, rax
mov rcx, rdi
call fcn.140003c50
nop
lea rcx, [rsp + 0x250]
call fcn.140013988
mov rax, qword [rdi + 0xfb0]
cmp rax, 0xffffffffffffffff
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x140005718
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5b8]
sub rsp, 0x6b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rbx, rcx
lea rdi, [rcx + 0x222]
lea r9, str.INST.WXF
mov r8, rdi
lea rdx, str._s_s
lea rcx, [rbp - 0x80]
call fcn.140003170
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x14
lea r9, [rsp + 0x48]
lea r8, [0x1400446c8]
lea rdx, [0x1400461b0]
lea rcx, [0x1400461b8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, str.WXF7
lea rcx, [rsp + 0x48]
call fcn.140026768
test eax, eax
jne 0x14000589a
cmp dword [rbx + 0xc54], eax
je 0x1400057c0
lea rdx, str.132___Retour
mov rcx, rbx
call fcn.140003c50
mov rcx, rdi
call fcn.14000f670
mov r8, rdi
lea rdx, str.__sWDSETUP7.EXE_
lea rcx, [rbp + 0x3a0]
call fcn.140003170
mov r8, rdi
lea rdx, str._REP_s
lea rcx, [rbp + 0x190]
call fcn.140003170
mov r8, rdi
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3a0]
call fcn.1400180cc
test rax, rax
jne 0x1400058b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea rax, [rbp + 0x5c0]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1300
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [rbx + 0xc54], 0
je 0x14000588d
mov r8, qword [rbp + 0x5c0]
mov r9, r8
lea rdx, str.Impossible_de_lancer_lapplication_de_contr
lea rcx, [rbp + 0x5c8]
call fcn.1400031c4
nop
mov rcx, rax
call fcn.140013a24
mov rdx, rax
mov rcx, rbx
call fcn.140003c50
nop
lea rcx, [rbp + 0x5c8]
call fcn.140013988
mov rcx, qword [rbp + 0x5c0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14000589c