joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4060e0
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0xf8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x30], 0x80
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40629e
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Identifier
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test eax, eax
je 0x4061df
call fcn.00418ad4
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x406197
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov edx, edi
lea rcx, str.IsVista64_RegQueryValueEx_errorcode:__d_n
call fcn.00405500
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406287
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x406287
call fcn.00418ad4
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x4061fe
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x60]
lea rcx, str.Identifier:__s_n
call fcn.00405500
lea rdx, [0x0044042c]
lea rcx, [rsp + 0x60]
call fcn.00424c70
test rax, rax
je 0x406269
lea rcx, str.Find_substring_64__So_this_is_a_64bit_OS_n
call fcn.00405500
nop
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406262
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x4062a0
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x406287
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, str.Cant_find_substring_64__So_this_isnt_a_64bit_OS_n
call fcn.00405500
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.004252f0
mov rbx, qword [rsp + 0x110]
mov rdi, qword [rsp + 0x118]
add rsp, 0xf8
ret
Function at 0x4065e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov r11, rsp
sub rsp, 0xb8
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x34], 0x40
xor ecx, ecx
mov qword [r11 - 0x80], rcx
lea rax, str.open
mov qword [r11 - 0x78], rax
mov rax, qword [rbx]
mov qword [r11 - 0x70], rax
mov rax, qword [rdx]
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rcx
mov dword [r11 - 0x58], r9d
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4066ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rdi]
mov rdx, qword [rbx]
lea rcx, str.ERR:_ShellExecuteEx__s_with_para__s__error_last_error:_d..._n
call fcn.00405500
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x406697
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x4066b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x40675e
mov r8, qword [rdi]
mov rdx, qword [rbx]
lea rcx, str.ShellExecuteEx_strExe__s__with_para__s__OK_n
call fcn.00405500
test esi, esi
je 0x4066f9
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rdi]
mov rdx, qword [rbx]
lea rcx, str.INF:_Run_client_strExe__s__strPara__s_setup_SUC..._n
call fcn.00405500
nop
mov rdx, qword [rbx]
sub rdx, 0x18
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x40673d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x406759
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
mov rbx, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
add rsp, 0xb8
ret
Function at 0x4089b0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x168
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x178], rbx
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x12c
call fcn.00425320
lea rcx, [rsp + 0x20]
mov edx, 0x12c
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x408a0d
lea rcx, str.Error_:_GetWindowsDirectory_fail._n
call fcn.00405500
xor al, al
jmp 0x408b18
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x188], rdi
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
cmp rdx, 0x10
not rcx
lea rsi, [rcx - 1]
jb 0x408a48
mov rax, qword [rbx + 8]
lea rdi, [rbx + 8]
jmp 0x408a4f
lea rdi, [rbx + 8]
mov rax, rdi
lea rcx, [rsp + 0x20]
cmp rcx, rax
jb 0x408a96
cmp rdx, 0x10
jb 0x408a64
mov rcx, qword [rdi]
jmp 0x408a67
mov rcx, rdi
add rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x20]
cmp rcx, rax
jbe 0x408a96
cmp rdx, 0x10
jb 0x408a7e
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov r9, rsi
mov rdx, rbx
sub r8, rdi
mov rcx, rbx
call fcn.00403520
jmp 0x408b06
cmp rsi, 0xfffffffffffffffe
jbe 0x408aa1
call fcn.0043db70
mov rax, qword [rbx + 0x20]
cmp rax, rsi
jae 0x408acd
mov r8, qword [rbx + 0x18]
mov rdx, rsi
mov rcx, rbx
call fcn.00402010
test rsi, rsi
je 0x408b06
mov rdx, qword [rbx + 0x20]
cmp rdx, 0x10
jb 0x408ae4
mov rcx, qword [rdi]
jmp 0x408ae7
test rsi, rsi
jne 0x408ab9
cmp rax, 0x10
mov qword [rbx + 0x18], rsi
jb 0x408adf
mov rdi, qword [rdi]
mov byte [rdi], 0
jmp 0x408b06
mov rcx, rdi
lea r8, [rsp + 0x20]
mov r9, rsi
call fcn.00425d30
cmp qword [rbx + 0x20], 0x10
mov qword [rbx + 0x18], rsi
jb 0x408b02
mov rdi, qword [rdi]
mov byte [rdi + rsi], 0
mov rdi, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
mov al, 1
mov rbx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.004252f0
add rsp, 0x168
ret
Function at 0x408b40
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov rsi, rdx
mov qword [rsp + 0x20], r12
mov r12, rcx
lea rcx, [0x0049b7e0]
xor edx, edx
mov r8d, 0x1001
call fcn.00425320
lea rdx, [0x00440ddc]
mov rcx, r12
call fcn.00427680
test rax, rax
mov rbp, rax
je 0x408cc5
lea rcx, [0x0049b7e0]
mov r9, rax
mov edx, 1
mov r8d, 0x1000
call fcn.00428210
lea rcx, [0x0049b7e0]
call fcn.004251a0
lea rcx, [0x0049b7e0]
mov rdx, rsi
call fcn.00424c70
test rax, rax
je 0x408cbd
lea rdx, str..sys
mov rcx, rsi
call fcn.00424c70
test rax, rax
jne 0x408c0a
lea rcx, str.IsDriverInfFiles:find__s__in___s__n
mov r8, r12
mov rdx, rsi
call fcn.00405500
mov rcx, rbp
call fcn.00427260
mov al, 1
mov r12, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rdi
nop
nop
nop
lea rcx, [0x0049b7e0]
mov rdx, rsi
call fcn.00404c90
test al, al
movzx edi, al
jne 0x408c82
lea rcx, [0x0049b7e0]
xor edx, edx
mov r8d, 0x1001
call fcn.00425320
lea rcx, [0x0049b7e0]
mov r9, rbp
mov edx, 1
mov r8d, 0x1000
call fcn.00428210
lea rcx, [0x0049b7e0]
mov rbx, rax
call fcn.004251a0
lea r11, [rbx - 1]
cmp r11, 0xfff
jbe 0x408c20
jmp 0x408c94
lea rcx, str.IsDriverInfFiles:find__s__in___s__n
mov r8, r12
mov rdx, rsi
call fcn.00405500
mov rcx, rbp
call fcn.00427260
mov rbx, qword [rsp + 0x30]
mov al, dil
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x28
ret
mov rcx, rbp
call fcn.00427260
mov r12, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
xor al, al
add rsp, 0x28
ret
Function at 0x409520
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub rsp, 0x2a8
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov eax, dword [rcx + 0x20]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x6c], eax
mov eax, dword [rcx + 0x24]
mov qword [rsp + 0x2c8], rdi
mov dword [rsp + 0x58], eax
mov eax, dword [rcx + 0x28]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x54], 0x104
mov dword [rsp + 0x50], 4
mov dword [rsp + 0x5c], eax
call fcn.00425320
lea r11, [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
lea rdx, str.SOFTWAREHonor_technologiesCurrHandSetWinDriver
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4095ce
lea rcx, str.INFO:_DriverInfo_Open_Key_error._n
call fcn.00405500
jmp 0x409743
cmp dword [rsp + 0x68], 2
jne 0x409724
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x180]
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x2c0], rbx
mov qword [rsp + 0x28], rdi
mov ebx, edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40971c
nop
nop
nop
nop
lea rdx, str.MajorVersion
lea rcx, [rsp + 0x180]
add ebx, 1
call fcn.00424c70
test rax, rax
je 0x409660
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x6c]
call fcn.00425700
lea rdx, str.MinorVersion
lea rcx, [rsp + 0x180]
call fcn.00424c70
test rax, rax
je 0x40968d
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.00425700
lea rdx, str.Customization
lea rcx, [rsp + 0x180]
call fcn.00424c70
test rax, rax
je 0x4096ba
mov r8d, dword [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x5c]
call fcn.00425700
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x104
mov dword [rsp + 0x54], 0x104
mov dword [rsp + 0x50], 4
call fcn.00425320
mov rcx, qword [rsp + 0x60]
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x180]
mov edx, ebx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x409630
mov rbx, qword [rsp + 0x2c0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREHonor_technologiesCurrHandSetWinDriver
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
xor eax, eax
mov rdi, qword [rsp + 0x2c8]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.004252f0
add rsp, 0x2a8
ret
Function at 0x409770
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x128
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x60], 0x80
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlCOM_Name_Arbiter
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea r11, [rsp + 0x60]
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.ComDB
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
xor ebx, ebx
lea ebp, [rbx - 1]
test eax, eax
je 0x40987c
call fcn.00418ad4
mov r11, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x409835
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov r8d, edi
lea rdx, str.RegQueryValueEx_errorcode:__d
lea rcx, [rsp + 0x70]
call fcn.00403da0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40987c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.00418ad4
mov rcx, rax
test rax, rax
setne bl
test ebx, ebx
jne 0x409899
mov ecx, 0x80004005
call fcn.00401000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
movzx eax, byte [rsp + 0x99]
movzx ecx, byte [rsp + 0x98]
movzx edx, byte [rsp + 0x97]
movzx r10d, byte [rsp + 0x96]
movzx r11d, byte [rsp + 0x95]
movzx ebx, byte [rsp + 0x94]
movzx edi, byte [rsp + 0x93]
movzx esi, byte [rsp + 0x92]
movzx r9d, byte [rsp + 0x91]
movzx r8d, byte [rsp + 0x90]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
lea rdx, str.HWHandsetComDB_before_install:__d__d__d__d__d__d__d__d__d__d_n
lea rcx, [rsp + 0x68]
call fcn.00403da0
mov rbx, qword [rsp + 0x68]
mov rcx, rbx
call fcn.00405500
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x409956
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.004252f0
mov rbx, qword [rsp + 0x130]
mov rbp, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
add rsp, 0x128
ret
Function at 0x4099d0
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [r11 - 0x20], 0xf
mov qword [r11 - 0x28], 0
mov byte [rsp + 0x30], 0
lea rcx, [r11 - 0x40]
call fcn.00404f70
test al, al
jne 0x409a38
cmp qword [rsp + 0x48], 0x10
jb 0x409a2e
mov rcx, qword [rsp + 0x30]
call fcn.004185a4
mov eax, 0x4e24
jmp 0x409b28
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
call fcn.00425320
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov rcx, rbx
nop
movzx eax, byte [rdx]
mov byte [rcx], al
add rdx, 1
add rcx, 1
test al, al
jne 0x409a60
call fcn.004060e0
test eax, eax
je 0x409a9e
mov rdi, rbx
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.DriverX64]
mov qword [rdi - 1], rax
mov eax, dword [0x00441098]
mov dword [rdi + 7], eax
jmp 0x409ac0
mov rdi, rbx
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.DriverX86]
mov qword [rdi - 1], rax
mov eax, dword [0x00441088]
mov dword [rdi + 7], eax
lea rcx, str.Info_t:_Driver_path:
call fcn.00405500
mov rcx, rbx
call fcn.00405500
lea rcx, [0x00441060]
call fcn.00405500
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x409b04
cmp qword [rsp + 0x48], 0x10
jb 0x409b00
mov rcx, qword [rsp + 0x30]
call fcn.004185a4
xor eax, eax
jmp 0x409b28
lea rcx, str.Error_:_Driver_path_is_not_founded._n
call fcn.00405500
nop
cmp qword [rsp + 0x48], 0x10
jb 0x409b23
mov rcx, qword [rsp + 0x30]
call fcn.004185a4
mov eax, 0x4e24
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.004252f0
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
add rsp, 0x68
ret
Function at 0x40f140
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x178
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x0045c120]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x40f1a0
cmp qword [rsp + 0x48], 0x10
jb 0x40f196
mov rcx, qword [rsp + 0x30]
call fcn.004185a4
mov eax, 0x4e24
jmp 0x40f293
lea rcx, [rsp + 0x28]
call fcn.00404f70
test al, al
jne 0x40f1ca
cmp qword [rsp + 0x48], 0x10
jb 0x40f1c0
mov rcx, qword [rsp + 0x30]
call fcn.004185a4
mov eax, 0x4e24
jmp 0x40f293
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.00425320
lea r11, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r11, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
nop
nop
nop
nop
movzx eax, byte [r11]
mov byte [rcx], al
add r11, 1
add rcx, 1
test al, al
jne 0x40f200
mov edx, dword [0x0045dcc0]
lea rcx, [0x0046c2d0]
call fcn.004067c0
movzx edx, al
mov dword [0x0045dba0], edx
cmp dword [0x00453010], 2
jne 0x40f272
test al, al
jne 0x40f272
mov r8d, dword [0x004735dc]
lea rdx, [0x00464fd0]
lea rcx, [rsp + 0x50]
call fcn.0040c020
mov r8d, dword [0x0045dcc0]
lea rdx, [0x0046c2d0]
lea rcx, [rsp + 0x50]
call fcn.0040e9d0
mov dword [0x0045dba4], eax
jmp 0x40f27f
lea rcx, str.templog_InstallHOTFIXFiles____g_bRndisBKExist:_d_n
call fcn.00405500
nop
cmp qword [rsp + 0x48], 0x10
jb 0x40f291
mov rcx, qword [rsp + 0x30]
call fcn.004185a4
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.004252f0
add rsp, 0x178
ret
Function at 0x415740
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
je 0x41575f
mov eax, 0x4e24
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
call fcn.004121d0
mov r8d, dword [0x004735d4]
lea rdx, [0x004735e0]
mov rcx, rbx
call fcn.0040a0b0
mov r8d, dword [0x0045dcc8]
lea rdx, [0x0045dcd0]
mov rcx, rbx
call fcn.0040a0b0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x418400
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov rax, rdx
mov qword [rsp + 0x58], rbp
mov rbp, rcx
lea rdx, [0x00442a2c]
mov rcx, rax
mov qword [rsp + 0x68], rdi
xor bl, bl
mov qword [rsp + 0x40], r12
call fcn.00427680
test rax, rax
mov rdi, rax
je 0x4184c3
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.00428ed0
mov rcx, rdi
call fcn.00428d60
xor r8d, r8d
xor edx, edx
mov rcx, rdi
movsxd r12, eax
call fcn.00428ed0
lea r11d, [r12 + 1]
test r11d, r11d
movsxd rcx, r11d
jne 0x4184e8
xor ecx, ecx
mov qword [rsp + 0x60], rsi
call fcn.00418560
mov r9, rdi
mov r8d, 1
mov rdx, r12
mov rcx, rax
mov rsi, rax
call fcn.00428210
cmp rax, 1
jne 0x4184aa
mov rdx, rsi
mov rcx, rbp
mov byte [r12 + rsi], 0
call fcn.00418130
movzx ebx, al
mov rcx, rdi
call fcn.00427260
mov rcx, rsi
call fcn.004185a4
test bl, bl
mov rsi, qword [rsp + 0x60]
jne 0x4184cd
xor edx, edx
mov rcx, rbp
call fcn.00418130
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 1
jae 0x418470
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x28]
call fcn.00425a60
lea r11, [0x0043ff20]
lea rdx, [0x004505b0]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], r11
call fcn.00426320
int3

Function at 0x42c637
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0045c120]
jne 0x42530a
rol rcx, 0x10
test cx, 0xffff
jne 0x425306
repz ret
ror rcx, 0x10
jmp 0x42c590
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x004aecd0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x004aedc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x42c615
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x004aecd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x42c637
mov rax, qword [rsp + 0x88]
mov qword [0x004aedc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x004aed68], rax
mov rax, qword [0x004aedc8]
mov qword [0x004aec40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x004aed50], rax
mov dword [0x004aec30], 0xc0000409
mov dword [0x004aec34], 1
mov rax, qword [0x0045c120]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0045c128]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x004aecc8], eax
mov ecx, 1
call fcn.0042c6e0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x00445440]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x004aecc8], 0
jne 0x42c6be
mov ecx, 1
call fcn.0042c6e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x436370
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0042b930
xor ebx, ebx
cmp qword [0x004af5d8], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x4364a1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x4363d3
xor eax, eax
jmp 0x436581
lea rdx, [0x00445f70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x4363cc
mov rcx, rax
call fcn.0042b8c0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x004af5d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042b8c0
lea rdx, [0x00445f48]
mov rcx, rbp
mov qword [0x004af5e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042b8c0
lea rcx, [rsp + 0x30]
mov qword [0x004af5e8], rax
call fcn.0042a0c0
test eax, eax
je 0x436457
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00425ed0
cmp dword [rsp + 0x30], 2
jne 0x4364a1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042b8c0
test rax, rax
mov qword [0x004af5f8], rax
je 0x4364a1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0042b8c0
mov qword [0x004af5f0], rax
mov rcx, qword [0x004af5f0]
cmp rcx, rsi
je 0x436533
cmp qword [0x004af5f8], rsi
je 0x436533
call fcn.0042b990
call rax
test rax, rax
mov rbp, rax
je 0x4364fe
mov rcx, qword [0x004af5f8]
call fcn.0042b990
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x4364fe
test byte [rsp + 0x48], 1
jne 0x436533
lea rcx, [rsp + 0x34]
call fcn.0042a110
test eax, eax
je 0x436520
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.00425ed0
cmp dword [rsp + 0x34], 4
jb 0x43652d
bts edi, 0x15
jmp 0x436567
bts edi, 0x12
jmp 0x436567
mov rcx, qword [0x004af5e0]
cmp rcx, rsi
je 0x436567
call fcn.0042b990
call rax
test rax, rax
mov rbx, rax
je 0x436567
mov rcx, qword [0x004af5e8]
cmp rcx, rsi
je 0x436567
call fcn.0042b990
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x004af5d8]
call fcn.0042b990
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret