joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019550
Capabilities:
Delete file
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x690
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
xor r8d, r8d
lea rdx, str.DeleteOldVersionLanguageMonitor
lea rcx, [rsp + 0x30]
call fcn.140017fc0
nop
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9, rsi
lea r8, str.lpszFile___s__lpszMon___s__bDebug___d
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.140017c80
test ebx, ebx
je 0x1400195e6
mov r8, rdi
lea rdx, str.OldVersionMonitorName:__s_
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.DeleteOldVersionLanguageMonitor
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call sub.WINSPOOL.DRV_DeleteMonitorW
test eax, eax
jne 0x140019617
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x140019647
mov r8d, eax
lea rdx, str.DeleteMonitor_Error:_d
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140019630
test ebx, ebx
je 0x140019647
mov r8, rdi
lea rdx, str.WinAPI_DeleteMonitor__OK_n_Old_Version_Monitor_Point:__d_
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.DeleteOldVersionLanguageMonitor
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.140192cb0
mov edx, 0x104
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r9, rsi
lea r8, [rsp + 0x260]
cmp word [rsp + rcx*2 + 0x25e], 0x5c
lea rcx, [rsp + 0x470]
lea rdx, str._s_s
jne 0x1400196ac
lea rdx, [0x1401c9460]
call qword [sym.imp.USER32.dll_wsprintfW]
test ebx, ebx
je 0x1400196e7
lea r8, [rsp + 0x470]
lea rdx, str.Delete_File:__s_
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
lea r8, str.DeleteOldVersionLanguageMonitor
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x470]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
test eax, eax
jne 0x140019718
test ebx, ebx
je 0x140019718
xor r9d, r9d
lea r8, str.DeleteOldVersionLanguageMonitor
lea rdx, str.WinAPI_DeleteFile__ERROR
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140017c80
nop
lea rcx, [rsp + 0x30]
call fcn.140018150
mov eax, edi
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1401945b0
add rsp, 0x690
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001a2a0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x6b8], rbx
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov rbx, rcx
xor r8d, r8d
lea rdx, str.DeleteRegICMProfile
lea rcx, [rsp + 0x40]
call fcn.140017fc0
nop
mov r9, rbx
lea r8, str.lpszFileName___s
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.140017c80
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.140192cb0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x170]
call fcn.140192cb0
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x380]
call fcn.140192cb0
test rbx, rbx
jne 0x14001a36c
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rbx + 2]
lea rcx, [rsp + 0x40]
call fcn.140017c80
nop
lea rcx, [rsp + 0x40]
call fcn.140018150
xor eax, eax
jmp 0x14001a4ce
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMmntr
mov edx, 0x104
lea rcx, [rbp + 0x170]
call fcn.140195e58
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionICMprtr
mov edx, 0x104
lea rcx, [rbp + 0x380]
call fcn.140195e58
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x5c
lea rcx, [rsp + 0x60]
call fcn.140193dc0
test rax, rax
je 0x14001a3cd
lea rdx, [rax + 2]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, [rbp + 0x170]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x14001a42e
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a42e
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, [rbp + 0x380]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001a48d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001a48d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 1
lea r8, str.return___08x
lea edx, [r9 + 1]
lea rcx, [rsp + 0x40]
call fcn.140017c80
nop
lea rcx, [rsp + 0x40]
call fcn.140018150
mov eax, 1
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.1401945b0
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x6a0
pop rbp
ret
Function at 0x14001b270
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
xor r8d, r8d
lea rdx, str.Tool_GetProcType64
lea rcx, [rsp + 0x28]
call fcn.140017fc0
nop
xor ebx, ebx
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x38]
cmp eax, 6
je 0x14001b2ba
add eax, 0xfffffff7
cmp eax, 1
ja 0x14001b2bf
mov ebx, 2
jmp 0x14001b2bf
mov ebx, 1
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x28]
call fcn.140017c80
nop
lea rcx, [rsp + 0x28]
call fcn.140018150
mov eax, ebx
add rsp, 0x70
pop rbx
ret
Function at 0x14001bcf0
Capabilities:
Check if file exists
Delete file
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x4a8
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbp, r9
mov r12, r8
mov rdi, rdx
mov rbx, rcx
xor r8d, r8d
lea rdx, str.Tool_DeleteSMModule
lea rcx, [rsp + 0x58]
call fcn.140017fc0
nop
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, str.pRegRoot___s__pSubKey___s__pValueName___s__pModuleName___s
mov esi, 1
mov edx, esi
lea rcx, [rsp + 0x58]
call fcn.140017c80
xor r13d, r13d
mov qword [rsp + 0x48], r13
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x50], 0x104
mov dword [rsp + 0x70], r13d
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0x74]
call fcn.140192cb0
mov dword [rsp + 0x280], r13d
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0x284]
call fcn.140192cb0
mov rdx, rbx
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rdi
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r11, [rsp + 0x48]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x280]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001be63
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001be58
mov rdx, rbp
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14001be58
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
cmove esi, r13d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, esi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.140017c80
nop
lea rcx, [rsp + 0x58]
call fcn.140018150
mov eax, esi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1401945b0
add rsp, 0x4a8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001c910
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x690
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x6c8], rbx
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov r12, r8
mov edi, edx
mov rsi, rcx
xor r8d, r8d
lea rdx, str.Tool_GetDriverColorProfilesReg
lea rcx, [rsp + 0x40]
call fcn.140017fc0
nop
mov dword [rsp + 0x20], edi
mov r9, rsi
lea r8, str.lpcDriverName___s__cVer___08x
mov edx, 1
lea rcx, [rsp + 0x40]
call fcn.140017c80
test rsi, rsi
jne 0x14001c99b
xor r9d, r9d
lea r8, str.return___08x
lea edx, [rsi + 2]
lea rcx, [rsp + 0x40]
call fcn.140017c80
nop
jmp 0x14001caed
xor ebx, ebx
mov word [rsp + 0x60], bx
xor edx, edx
mov r8d, 0x616
lea rcx, [rsp + 0x62]
call fcn.140192cb0
mov qword [rsp + 0x20], rsi
lea r8, str._s_s
mov edx, 0x30c
lea rcx, [rsp + 0x60]
cmp edi, 3
je 0x14001c9db
cmp edi, 5
lea r9, str.SystemCurrentControlSetControlPrintEnvironmentsWindows_x64DriversVersion_3
je 0x14001c9e2
lea r9, str.SystemCurrentControlSetControlPrintEnvironmentsWindows_NT_x86DriversVersion_3
call fcn.140196100
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], 7
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001cad4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.ColorProfiles
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001cac4
cmp dword [rsp + 0x30], ebx
jbe 0x14001cac4
mov ecx, dword [rsp + 0x30]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140050e70
mov rdi, rax
test rax, rax
je 0x14001cac0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.ColorProfiles
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001cab7
mov rdx, r12
mov rcx, rdi
call fcn.14001beb0
mov rcx, rdi
call fcn.140050e78
nop
jmp 0x14001cac4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x40]
call fcn.140017c80
nop
lea rcx, [rsp + 0x40]
call fcn.140018150
xor eax, eax
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1401945b0
mov rbx, qword [rsp + 0x6c8]
add rsp, 0x690
pop r12
pop rdi
pop rsi
ret
Function at 0x140025e10
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rsi, rcx
xor r8d, r8d
lea rdx, str.Tool_DeletePSWRegistry
lea rcx, [rsp + 0x28]
call fcn.140017fc0
nop
mov r9, rsi
lea r8, str.lpszPrinter___s
mov edx, 1
lea rcx, [rsp + 0x28]
call fcn.140017c80
call fcn.140054cb8
mov rbp, qword [rax + 8]
xor edi, edi
call fcn.140051e58
mov r11, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x140025e89
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, str.SOFTWARECANON_
test rdx, 0xffffffffffff0000
jne 0x140025ecc
movzx ebx, dx
mov ecx, ebx
call fcn.140051c2c
test rax, rax
je 0x140025edd
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140001b00
jmp 0x140025edd
mov r8d, 0xf
lea rcx, [rsp + 0x58]
call fcn.140001c20
nop
mov rdx, qword [rbp + 0x800]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140006c60
test rsi, rsi
je 0x140025f10
mov r9, rsi
mov r8, qword [rsp + 0x58]
lea rdx, str._s_s
lea rcx, [rsp + 0x58]
call fcn.140007540
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x140025f2e
cmp eax, 2
jne 0x140025f33
mov edi, 1
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x28]
call fcn.140017c80
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x140025f6a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0x28]
call fcn.140018150
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400294a0
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
xor r8d, r8d
lea rdx, str.Tool_CleanupCAPModuleAndRegistry
lea rcx, [rsp + 0x28]
call fcn.140017fc0
nop
mov edi, 1
call fcn.140051e58
mov r11, rax
xor ebp, ebp
mov ecx, ebp
test rax, rax
setne cl
test ecx, ecx
jne 0x1400294f9
mov ecx, 0x80004005
call fcn.140001010
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
lea rdx, str.SOFTWARECANON_
test rdx, 0xffffffffffff0000
jne 0x14002953c
movzx esi, dx
mov ecx, esi
call fcn.140051c2c
test rax, rax
je 0x140029551
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001b00
jmp 0x14002954c
mov r8d, 0xf
lea rcx, [rsp + 0x50]
call fcn.140001c20
mov rbx, qword [rsp + 0x50]
xor ecx, ecx
call fcn.140025e10
test eax, eax
cmove edi, ebp
mov rcx, 0xffffffff80000001
call fcn.140024e70
test eax, eax
cmove edi, ebp
mov rcx, 0xffffffff80000002
call fcn.140024e70
test eax, eax
cmove edi, ebp
call fcn.1400293f0
test eax, eax
cmove edi, ebp
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.140019030
test eax, eax
je 0x1400295ac
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x28]
call fcn.140017c80
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400295e3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0x28]
call fcn.140018150
mov eax, edi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140031690
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebp, ebp
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x140031755
mov r8, rdx
mov ecx, 0x1f0001
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x1400316e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rbp + 1]
jmp 0x140031757
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400316fa
mov eax, 2
jmp 0x140031757
cmp edi, 1
jne 0x140031755
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bp
call fcn.140192cb0
lea rdx, str.Global_
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r11, qword [rsi]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rsi
call qword [r11 + 0x220]
test eax, eax
je 0x140031757
bts eax, 0x1f
jmp 0x140031757
mov eax, ebp
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401945b0
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret

Function at 0x140031780
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x1400317f1
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x1400317b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400317c8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp eax, 5
jne 0x1400317e5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x20]
mov eax, 2
add rsp, 0x28
ret
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x140031950
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400319a4
mov rdi, qword [rcx + 0x848]
test rdi, rdi
je 0x140031997
call fcn.140054cb8
mov qword [rax + 0x18], rdi
mov rcx, qword [rbx + 0x850]
test rcx, rcx
je 0x140031997
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x850], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rcx + 0x850]
test rcx, rcx
je 0x1400319c1
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x850], 0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x140031a21
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x850], rax
test rax, rax
je 0x140031a11
call fcn.140054cb8
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x848], rcx
mov rbx, qword [rbx + 0x850]
call fcn.140054cb8
mov qword [rax + 0x18], rbx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0x21
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0x20
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140031ac0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x670
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rsp + 0x660], rax
mov r12d, r9d
mov rbp, r8
mov rdi, rdx
mov esi, 1
test r8, r8
je 0x140031bae
test rdx, rdx
je 0x140031bae
xor ebx, ebx
lea rdx, [rsp + 0x30]
cmp dword [rcx + 0x780], ebx
je 0x140031b1c
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x140031b75
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call fcn.140197468
lea r9, [rsp + 0x240]
lea r8, [rsp + 0x450]
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call fcn.14019669c
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rax, [rsp + 0x30]
lea r9, [0x1401c9460]
mov rdx, r12
or r8, 0xffffffffffffffff
mov rcx, rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140196124
test eax, eax
cmovs esi, ebx
mov eax, esi
jmp 0x140031bb2
xor ebx, ebx
mov eax, ebx
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1401945b0
add rsp, 0x670
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003a0f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x490
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x4c0], rbx
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, r8
mov rbx, rdx
mov r12, rcx
xor r8d, r8d
lea rdx, str.CUNINSTALLERDlg::DeleteSurvivalPrinterRegKey
lea rcx, [rsp + 0x50]
call fcn.140017fc0
nop
mov r9, rdi
lea r8, str.lpszPrinter___s
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.140017c80
xor r13d, r13d
mov ebp, r13d
lea esi, [r13 + 1]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003a250
nop word [rax + rax]
mov dword [rsp + 0x48], 0x208
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x70]
call fcn.140192cb0
lea r11, [rsp + 0x68]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x70]
mov edx, ebp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc ebp
test eax, eax
je 0x14003a1ec
cmp eax, 0x103
je 0x14003a23e
mov esi, r13d
jmp 0x14003a235
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.1400395b0
test eax, eax
jne 0x14003a190
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call fcn.140018e80
cmp eax, 1
jne 0x14003a243
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14003a232
cmp eax, 2
je 0x14003a232
mov esi, r13d
mov eax, 0x103
mov ebp, r13d
test eax, eax
jne 0x14003a243
jmp 0x14003a190
mov esi, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003a257
cmp eax, 2
cmovne esi, r13d
mov r9d, esi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.140017c80
nop
lea rcx, [rsp + 0x50]
call fcn.140018150
mov eax, esi
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1401945b0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004a850
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14027bbd0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
call fcn.140054cb8
lea rcx, [rsp + 0x22]
mov rbx, qword [rax + 8]
xor esi, esi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], si
call fcn.140192cb0
lea r8, [rsp + 0x20]
lea rdx, str.InsCmn.dll
mov r9d, 0x104
mov rcx, rbx
call fcn.140031ac0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14004a90c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rdi], rax
test rax, rax
je 0x14004a90c
lea rdx, str.PI_CMN_GetInterface
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 8], rax
test rax, rax
je 0x14004a904
mov ecx, 0x100
call rax
mov qword [rdi + 0x10], rax
test rax, rax
je 0x14004a904
call qword [rax]
mov eax, esi
jmp 0x14004a911
mov rcx, rdi
call fcn.14004a800
mov eax, 0x22
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401945b0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140055ed4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14006c7e0
mov rsi, rax
test rax, rax
je 0x140055f50
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x140055f4b
cmp dword [rbx], 0x40
jb 0x140055f4b
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140055f4b
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x140055f54
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14005ddec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14005de54
call fcn.140054cb8
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14005de54
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14005de76
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14005d7d8
mov esi, eax
test rdi, rdi
je 0x14005de74
test rbx, rbx
je 0x14005de74
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret