joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ae030
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rdx
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoCtrl::GetCheckVersion
lea rcx, [rsp + 0x30]
call fcn.1400075a0
nop
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x50]
call fcn.14024b970
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + gethostbyaddr]
mov rcx, qword [0x1403b9758]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r9, qword [rax]
lea r8, str.Version
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [r9 + 0x50]
lea r11, [rbx + 8]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x40
mov r9, rdi
lea r8, str.0.00
lea rdx, [rsp + 0x50]
lea rcx, str.CheckVersion
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, str._t_t_tCCDVerKey____s___CCDBorderVer____s_.
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.140007780
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
lea rcx, [rsp + 0x30]
call fcn.140007730
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret

Function at 0x1400ae150
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rdx
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoCtrl::GetCheckCCD3Version
lea rcx, [rsp + 0x30]
call fcn.1400075a0
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [0x1403b9758]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r9, qword [rax]
lea r8, str.NewSpecVersion
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [r9 + 0x50]
lea r11, [rbx + 8]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0x40
mov r9, rdi
lea r8, str.0.00
lea rdx, [rsp + 0x50]
lea rcx, str.CheckNewSpecDriverVersion
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
lea r8, str._t_t_tCCD3VerKey____s___CCD3BorderVer____s_.
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.140007780
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
lea rcx, [rsp + 0x30]
call fcn.140007730
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
ret
Function at 0x1400af080
Capabilities:
Read .ini file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoCtrl::GetUpdateDriver
lea rcx, [rsp + 0x30]
call fcn.1400075a0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.14024b970
mov r11, qword [rbx]
mov rcx, rbx
call qword [r11 + gethostbyaddr]
mov rcx, qword [0x1403b9758]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r9, qword [rax]
lea r8, str.OldModel
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [r9 + 0x50]
add rbx, 8
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
lea r8, str._t_t_tGetSection___SECTION__s__from__s.
mov edx, 7
lea rcx, [rsp + 0x30]
call fcn.140007780
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x208
mov r9, rsi
lea r8, [0x1402dc4e0]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rsp + 0x30]
test eax, eax
jle 0x1400af17d
mov r9d, 5
lea r8, str.return___08x
lea edx, [r9 - 3]
call fcn.140007780
nop
lea rcx, [rsp + 0x30]
call fcn.140007730
mov eax, 5
jmp 0x1400af1d5
mov r9, rdi
lea r8, str._t_t_t_s_is_not_OLD_MODEL.
mov edx, 7
call fcn.140007780
sub rsi, rdi
nop word [rax + rax]
movzx eax, word [rdi]
mov word [rsi + rdi], ax
add rdi, 2
test ax, ax
jne 0x1400af1a0
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
lea rcx, [rsp + 0x30]
call fcn.140007730
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140245660
add rsp, 0x270
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400afac0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x10050
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x10088], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x10040], rax
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.______tCBaseInfoCtrl::GetSectionList__.
lea rcx, [rsp + 0x20]
call fcn.1400075a0
nop
xor esi, esi
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x40]
call fcn.14024b970
lea r9, [rdi + 8]
mov r8d, 0x7fff
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
je 0x1400afb80
cmp word [rsp + 0x40], si
je 0x1400afb7b
lea rdi, [rsp + 0x40]
nop
mov r8, rdi
mov rdx, qword [rbp + 0x10]
mov rcx, rbp
call fcn.140105f30
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
add esi, ecx
movsxd rax, esi
lea rdi, [rsp + rax*2 + 0x40]
cmp word [rdi], 0
jne 0x1400afb50
mov esi, 1
mov r9d, esi
lea r8, str.______tCBaseInfoCtrl::GetSectionList___bRet___08x.
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.140007780
nop
lea rcx, [rsp + 0x20]
call fcn.140007730
mov eax, esi
mov rcx, qword [rsp + 0x10040]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x10088]
add rsp, 0x10050
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b2a20
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rbp
mov ebp, r9d
mov rsi, r8
mov r12, rdx
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoCustomDrv::ReadBackupUPDFileInfo
lea rcx, [rsp + 0x38]
call fcn.1400075a0
nop
xor edi, edi
test r12, r12
je 0x1400b2b58
test rsi, rsi
je 0x1400b2b58
mov r8d, ebp
xor edx, edx
mov rcx, rsi
call fcn.14024b970
add rbx, 0xa8
cmp qword [rbx + 0x18], 8
jb 0x1400b2a94
mov rcx, qword [rbx]
jmp 0x1400b2a97
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400b2b67
lea rdx, [0x1402dc4e0]
lea rcx, [rsp + 0x78]
call fcn.140005900
nop
mov r8, r12
lea rdx, str.__s_
lea rcx, [rsp + 0x78]
call fcn.14000de40
lea rdx, [0x1402e963c]
mov rcx, qword [rsp + 0x78]
call fcn.140249494
test rax, rax
je 0x1400b2b06
sub rax, qword [rsp + 0x78]
sar rax, 1
test eax, eax
js 0x1400b2b06
lea r8, [0x1403016f4]
lea rdx, [0x1402e963c]
lea rcx, [rsp + 0x78]
call fcn.14002fcb0
cmp qword [rbx + 0x18], 8
jb 0x1400b2b10
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebp
mov r9, rsi
lea r8, [0x1402dc4e0]
mov rdx, qword [rsp + 0x78]
lea rcx, [0x1403016f8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400b2b67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400b2b67
mov edi, 0x80010001
mov dword [0x1403b95bc], 1
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.140007780
nop
lea rcx, [rsp + 0x38]
call fcn.140007730
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b3790
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push rdi
mov eax, 0x10070
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x10088], rbx
mov qword [rsp + 0x10090], rsi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x10060], rax
mov rsi, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoCustomDrv::DeleteUPDBackupFolder
lea rcx, [rsp + 0x48]
call fcn.1400075a0
nop
xor edi, edi
lea rbx, [rsi + 0xa8]
cmp qword [rbx + 0x18], 8
jb 0x1400b37f7
mov rcx, qword [rbx]
jmp 0x1400b37fa
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400b38d7
cmp qword [rbx + 0x18], 8
jb 0x1400b3815
mov r9, qword [rbx]
jmp 0x1400b3818
mov r9, rbx
mov r8d, 0x7fff
lea rdx, [rsp + 0x60]
lea rcx, [0x1403016f8]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
test eax, eax
jg 0x1400b38f9
cmp qword [rbx + 0x18], 8
jb 0x1400b3842
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400b38d7
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, ebx
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1400b38b8
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
lea r9, str._t_t_tDeleteFile
lea r8, str.ApiName:__s__ErrorCode:__d_:__s
mov edx, 6
lea rcx, [rsp + 0x48]
call fcn.140007780
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400b38c8
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, 0x8001000e
mov dword [0x1403b95bc], 0xe
mov rcx, qword [0x1403b9768]
lea rdx, [rsi + 0x80]
cmp qword [rdx + 0x18], 8
jb 0x1400b38ef
mov rdx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 0xe8]
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.140007780
nop
lea rcx, [rsp + 0x48]
call fcn.140007730
mov eax, edi
mov rcx, qword [rsp + 0x10060]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x10070]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b3950
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoCustomDrv::CtrlRestoreInst
lea rcx, [rsp + 0x20]
call fcn.1400075a0
nop
cmp dword [0x1403b97b8], 0
jne 0x1400b39d5
mov rcx, qword [0x1403b9768]
lea rdx, [rbx + 0x80]
cmp qword [rdx + 0x18], 8
jb 0x1400b39c0
mov rdx, qword [rdx]
mov rax, qword [rcx]
lea r8, [0x1402f35b0]
call qword [rax + 0xe0]
jmp 0x1400b3b36
lea rcx, [rbx + 0xa8]
cmp qword [rcx + 0x18], 8
jb 0x1400b39e6
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400b3b36
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdi, qword [rax]
mov edx, 3
mov rcx, rax
call qword [rdi + 0x58]
test rax, rax
je 0x1400b3b36
xor r12d, r12d
nop dword [rax]
lea rsi, [rax + 0x418]
mov rax, qword [rbx]
mov r9d, 0x104
lea r8, [rbp - 0x60]
mov rdx, rsi
mov rcx, rbx
call qword [rax + 0xe0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1400b3b17
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140001f40
nop
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r12
mov word [rsp + 0x78], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x78]
call fcn.140001f40
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbx + 0xf0]
call fcn.1400f4af0
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rbx + 0xf0]
call fcn.140028e50
nop
cmp qword [rbp - 0x70], 8
jb 0x1400b3af3
mov rcx, qword [rsp + 0x78]
call fcn.1401026ec
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r12
mov word [rsp + 0x78], r12w
cmp qword [rsp + 0x68], 8
jb 0x1400b3b17
mov rcx, qword [rsp + 0x50]
call fcn.1401026ec
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x60]
test rax, rax
jne 0x1400b3a20
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x20]
call fcn.140007780
nop
lea rcx, [rsp + 0x20]
call fcn.140007730
xor eax, eax
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x1400b3ce0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x4c8], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, r8
mov ebp, edx
mov rsi, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoCustomDrv::GetBackUpFolderPath
lea rcx, [rsp + 0x48]
call fcn.1400075a0
nop
test rdi, rdi
jne 0x1400b3d44
mov ebx, 0x80010001
mov dword [0x1403b95bc], 1
jmp 0x1400b3eab
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov r10, qword [rax]
lea r9, [rsp + 0x60]
mov edx, 1
mov r8d, 0x104
mov rcx, rax
call qword [r10 + 0x118]
mov ebx, eax
test eax, eax
jne 0x1400b3eab
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov r11, qword [rsi]
lea r8, [rsp + 0x270]
mov edx, 0x104
mov rcx, rsi
call qword [r11 + 0x108]
mov ebx, eax
test eax, eax
jne 0x1400b3eab
mov rdx, rbp
lea rax, [rsp + 0x270]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x1402e3978]
or r8, 0xffffffffffffffff
mov rcx, rdi
call fcn.14024679c
test eax, eax
jns 0x1400b3dec
mov ebx, 0x80010041
mov dword [0x1403b95bc], 0x41
jmp 0x1400b3eab
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400b3eab
mov r9, rdi
lea r8, str._t_t_tmake__s_folder.
lea edx, [rax + 7]
lea rcx, [rsp + 0x48]
call fcn.140007780
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400b3eab
xor edi, edi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, ebx
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x1400b3e8c
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
lea r9, str._t_t_tCreateDirectory
lea r8, str.ApiName:__s__ErrorCode:__d_:__s
lea edx, [rdi + 6]
lea rcx, [rsp + 0x48]
call fcn.140007780
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400b3e9c
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 0x80010009
mov dword [0x1403b95bc], 9
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.140007780
nop
lea rcx, [rsp + 0x48]
call fcn.140007730
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x4c8]
add rsp, 0x490
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b70b0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbx, rcx
lea rax, vtable.CBaseInfoICF.0
mov qword [rcx], rax
xor r8d, r8d
lea rdx, [0x140302870]
lea rcx, [rsp + 0x38]
call fcn.1400075a0
nop
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rax
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], eax
lea edx, [rax + 6]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x1400b712a
cmp eax, 0x80010106
je 0x1400b712a
lea r8, str._t_t_tCoInitializeEx___failed.
mov edx, 7
lea rcx, [rsp + 0x38]
call fcn.140007780
jmp 0x1400b71c8
mov dword [rbx + 0x10], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x140302ac8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140302ab8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400b7192
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x38]
test eax, eax
js 0x1400b7189
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, [rbx + 8]
call qword [rax + 0x38]
test eax, eax
jns 0x1400b71a8
lea r8, str._t_t_tget_CurrentProfile___failed.
jmp 0x1400b7199
lea r8, str._t_t_tget_LocalPolicy___failed.
jmp 0x1400b7199
lea r8, str._t_t_tCoCreateInstance___failed.
mov edx, 7
lea rcx, [rsp + 0x38]
call fcn.140007780
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400b71b8
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400b71c8
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
lea r8, [0x1402dc4e0]
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.140007780
nop
lea rcx, [rsp + 0x38]
call fcn.140007730
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400b9600
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
lea r8, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x1400b965d
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x1400b9655
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rcx]
call qword [r8 + 0x28]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx]
call qword [rdx + reloc.WSOCK32.dll_recv]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1400b96a0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x680
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x6a0], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov edi, r8d
mov rbx, rdx
xor r8d, r8d
lea rdx, str.CBaseInfoOSEnv::GetMISCFolder
lea rcx, [rsp + 0x20]
call fcn.1400075a0
nop
test rbx, rbx
jne 0x1400b9702
mov edi, 0x80010001
mov dword [0x1403b95bc], 1
jmp 0x1400b989f
mov r9d, edi
mov r8, rbx
lea rdx, str.MISC
lea rcx, [0x1403b95f0]
call fcn.1400262e0
mov edi, eax
test eax, eax
jne 0x1400b989f
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x460]
call fcn.14024b970
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.14024b970
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x250]
call fcn.14024b970
lea r8d, [rdi + 2]
lea rdx, [0x1402f0008]
mov rcx, rbx
call fcn.140249654
test eax, eax
jne 0x1400b989f
lea edx, [rdi + 0x5c]
lea rcx, [rbx + 4]
call fcn.140247344
mov rsi, rax
test rax, rax
je 0x1400b989f
mov r8, rax
sub r8, rbx
sub r8, 4
sar r8, 1
inc r8d
lea rdx, [rbx + 4]
lea rcx, [rsp + 0x460]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
mov r9d, 0x104
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x460]
call qword [rax + 0x198]
lea rdx, [0x1402dc4e0]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400b989f
lea rdx, [0x1402f0008]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r9, [rsp + 0x40]
lea r8, str._t_t_tChange_Path_is__s
lea edx, [rdi + 7]
lea rcx, [rsp + 0x20]
call fcn.140007780
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400b986e
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1400b989f
lea r9, [rsp + 0x40]
lea r8, str._t_t_tAccess_to_this__s_is_refused.
mov edx, 7
lea rcx, [rsp + 0x20]
call fcn.140007780
lea r8, str.I_get_together_and_decide_to_do_it_in_the_thing_that_I_do_not_convert_an_address_into_and_just_utilize_it.
mov edx, 7
lea rcx, [rsp + 0x20]
call fcn.140007780
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.140007780
nop
lea rcx, [rsp + 0x20]
call fcn.140007730
mov eax, edi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x6a0]
add rsp, 0x680
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b98f0
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rax, qword [rcx]
mov ebx, r8d
mov rdi, rdx
call qword [rax + 0xe0]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rsp + 0x20]
mov r8, rdi
mov edx, 0x104
call fcn.140246628
lea r8, str.Canon_
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140246470
lea r8, str.InstTemp_
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140246470
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea r8, str.Canon_
mov edx, ebx
mov rcx, rdi
test eax, eax
jne 0x1400b99c9
call fcn.140246470
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400b999d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.InstTemp_
mov rdx, rbx
mov rcx, rdi
call fcn.140246470
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400b99e0
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1400b99e0
call fcn.140246470
lea r8, str.InstTemp_
mov rdx, rbx
mov rcx, rdi
call fcn.140246470
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop rdi
ret

Function at 0x1400b9a10
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rax, qword [rcx]
mov ebx, r8d
mov rdi, rdx
call qword [rax + 0xe0]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rsp + 0x20]
mov r8, rdi
mov edx, 0x104
call fcn.140246628
lea r8, str.Canon_
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140246470
lea r8, str.PrinterDriver_
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.140246470
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea r8, str.Canon_
mov edx, ebx
mov rcx, rdi
test eax, eax
jne 0x1400b9ae9
call fcn.140246470
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400b9abd
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.PrinterDriver_
mov rdx, rbx
mov rcx, rdi
call fcn.140246470
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400b9b00
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1400b9b00
call fcn.140246470
lea r8, str.PrinterDriver_
mov rdx, rbx
mov rcx, rdi
call fcn.140246470
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x268]
add rsp, 0x240
pop rdi
ret
Function at 0x1400ba1d0
Capabilities:
Get system information on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.ParseProcessor
lea rcx, [rsp + 0x28]
call fcn.1400075a0
nop
lea rcx, [rdi + 0x140]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 0x164]
sub eax, 0x182
je 0x1400ba283
sub eax, 0x64
je 0x1400ba283
sub eax, 0x64
je 0x1400ba283
lea rcx, [rdi + 0x170]
cmp eax, 0x1f8e
je 0x1400ba25e
xor ebx, ebx
mov dword [rdi + 0xc], ebx
lea r8d, [rbx + 0xe]
lea rdx, str.Windows_NT_x86
call fcn.140001f40
jmp 0x1400ba285
mov eax, dword [rdi + 0x28]
imul eax, eax, 0x64
add eax, dword [rdi + 0x2c]
mov dword [rdi + 0xc], eax
mov r8d, recv
lea rdx, str.Windows_x64
call fcn.140001f40
mov ebx, 0x20000000
jmp 0x1400ba285
xor ebx, ebx
mov r9d, ebx
lea r8, str.return___d
mov edx, 2
lea rcx, [rsp + 0x28]
call fcn.140007780
nop
lea rcx, [rsp + 0x28]
call fcn.140007730
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret