joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ba2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.CheckCoreEdition
lea rcx, [rsp + 0x38]
call fcn.1400075a0
nop
xor ebx, ebx
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0xa8]
test eax, eax
je 0x1400ba3ba
lea r8, str.Win2012_2016
lea edx, [rbx + 7]
lea rcx, [rsp + 0x38]
call fcn.140007780
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400ba469
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ServerCoreExtended
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x1400ba379
lea ebx, [rax - 1]
jmp 0x1400ba3a3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NanoServer
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
test rdi, rdi
je 0x1400ba469
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ba469
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x78]
cmp eax, 1
jne 0x1400ba469
lea r8, str.Win2008
lea edx, [rax + 6]
lea rcx, [rsp + 0x38]
call fcn.140007780
mov dword [rsp + 0x60], ebx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ba469
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ba469
movzx r9d, word [rdi + 0x13a]
movzx r8d, word [rdi + 0x138]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov edx, dword [rdi + 0x2c]
mov ecx, dword [rdi + 0x28]
call rax
test eax, eax
je 0x1400ba469
mov eax, dword [rsp + 0x60]
cmp eax, 0xc
jb 0x1400ba469
cmp eax, 0xe
jbe 0x1400ba44e
cmp eax, 0x1d
je 0x1400ba44e
cmp eax, 0x26
jbe 0x1400ba469
cmp eax, 0x29
ja 0x1400ba469
lea r8, str.Core_Edtion___
mov edx, 7
lea rcx, [rsp + 0x38]
call fcn.140007780
mov ebx, 1
mov r9d, ebx
lea r8, str.return___d
mov edx, 2
lea rcx, [rsp + 0x38]
call fcn.140007780
nop
lea rcx, [rsp + 0x38]
call fcn.140007730
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400baa20
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoPrinterEx::IsExistRestoreFile
lea rcx, [rsp + 0x28]
call fcn.1400075a0
nop
mov dword [rsp + 0x50], 0
lea rcx, [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
test eax, eax
je 0x1400baaa3
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + VarBstrFromDisp]
mov r8, qword [rax]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [r8 + 0x88]
mov r11d, dword [rsp + 0x50]
test r11d, r11d
je 0x1400baaa1
cmp r11d, 0x3e8
je 0x1400baaa1
cmp r11d, 0x270f
je 0x1400baaa1
mov ebx, 1
jmp 0x1400baaa3
xor ebx, ebx
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x28]
call fcn.140007780
nop
lea rcx, [rsp + 0x28]
call fcn.140007730
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x1400baad0
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x150
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoPrinterEx::OpenRestoreFile
lea rcx, [rsp + 0x20]
call fcn.1400075a0
nop
xor edi, edi
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r8, qword [rax]
lea edx, [rdi + 3]
mov rcx, rax
call qword [r8 + 0x58]
mov esi, edi
test rax, rax
setne sil
add rbx, 0x210
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400bab52
lea edx, [rdi + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
je 0x1400bac66
lea rcx, [rsp + 0x40]
call fcn.1400c18b0
nop
mov r8d, gethostbyaddr
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400ab810
test rax, rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x40]
jne 0x1400bab9d
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x1400babab
or edx, 4
jmp 0x1400babab
mov edx, edi
mov eax, 4
cmp qword [rcx + 0x48], rdx
cmove edx, eax
xor r8d, r8d
call fcn.1400015e0
cmp qword [rsp + 0xe0], 0
jne 0x1400babcf
mov edi, 0x80010005
mov dword [0x1403b95bc], 5
jmp 0x1400bac05
lea rcx, [rsp + 0x48]
call fcn.1400ab900
test rax, rax
jne 0x1400bac05
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rcx, [rsp + rcx + 0x40]
mov edx, dword [rcx + 0x10]
or edx, 2
cmp qword [rcx + 0x48], 0
jne 0x1400babfc
or edx, 4
xor r8d, r8d
call fcn.1400015e0
nop
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
lea rcx, [rsp + 0x48]
call fcn.1400aa320
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x40], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe8]
call fcn.140266564
mov r9d, edi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.140007780
nop
lea rcx, [rsp + 0x20]
call fcn.140007730
mov eax, edi
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400bad90
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov ebx, edx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoPrinterEx::DeletePrinterInfoFile
lea rcx, [rsp + 0x28]
call fcn.1400075a0
nop
xor esi, esi
mov dword [rsp + 0x20], esi
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x28]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + VarBstrFromDisp]
mov r8, qword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [r8 + 0x88]
mov r11d, dword [rsp + 0x20]
test r11d, r11d
je 0x1400bae2b
cmp r11d, 0x3e8
je 0x1400bae2b
cmp r11d, 0x270f
je 0x1400bae2b
cmp ebx, 1
jne 0x1400baefd
lea rcx, [rdi + 0x210]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400bae5b
mov edx, 0x20
lea rcx, [rdi + 0x210]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rdi + 0x210]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rdi + 8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400bae82
mov edx, 0x20
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x30]
mov word [rsp + 0x40], si
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x42]
call fcn.14024b970
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov r9, qword [rax]
lea r8, [rsp + 0x40]
lea rdx, str.RESTORE_COLOR_FOLDER
mov rcx, rax
call qword [r9 + 0x18]
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0xe8]
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x28]
call fcn.140007780
nop
lea rcx, [rsp + 0x28]
call fcn.140007730
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400baf50
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoPrinterEx::BackupBasicPrinterInfo
lea rcx, [rsp + 0x30]
call fcn.1400075a0
nop
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x78]
test eax, eax
je 0x1400bb0f7
lea rcx, [rdi + 8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400baff1
mov qword [rsp + 0x28], rbx
lea r8, str.w_ccsUNICODE
lea rdx, [rdi + 8]
lea rcx, [rsp + 0x28]
call fcn.140245760
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400baff1
call fcn.140246710
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
mov edx, 2
mov rcx, rdi
call qword [rax + 0x120]
mov ebx, eax
test eax, eax
jne 0x1400bb0f7
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
lea edx, [rbx + 3]
mov rcx, rdi
call qword [rax + 0x120]
mov ebx, eax
test eax, eax
jne 0x1400bb0f7
mov rax, qword [rdi]
lea r8, [rsp + 0x20]
lea edx, [rbx + 1]
mov rcx, rdi
call qword [rax + 0x120]
mov ebx, eax
test eax, eax
jne 0x1400bb0f7
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + VarBstrFromDisp]
mov r8, qword [rax]
mov edx, 0x10000
mov rcx, rax
call qword [r8 + 0x50]
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov edx, pe_nt_image_headers64
call qword [rax + 0x178]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + VarBstrFromDisp]
mov r8, qword [rax]
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [r8 + 0x60]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + VarBstrFromDisp]
mov r8, qword [rax]
mov edx, dword [rsp + 0x20]
mov rcx, rax
call qword [r8 + WSAStartup]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + VarBstrFromDisp]
mov r8, qword [rax]
lea edx, [rbx + 0xa]
mov rcx, rax
call qword [r8 + 0x80]
mov rcx, qword [0x1403b9750]
mov rax, qword [rcx]
call qword [rax + VarBstrFromDisp]
mov r8, qword [rax]
mov edx, dword [0x1403b9778]
mov rcx, rax
call qword [r8 + DllRegisterServer]
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
lea rcx, [rsp + 0x30]
call fcn.140007730
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c5870
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoProperty::DeletePropertyInfoFile
lea rcx, [rsp + 0x28]
call fcn.1400075a0
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
add rbx, 0x28
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400c58c8
mov edx, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x28]
call fcn.140007780
nop
lea rcx, [rsp + 0x28]
call fcn.140007730
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1400c7520
Capabilities:
Read .ini file

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x103a0]
mov eax, 0x104a0
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x104e0], rbx
mov qword [rsp + 0x104e8], rsi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rbp + 0x10390], rax
mov r12, rdx
mov r13, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoResBasicIni::Read_PrnInfo_SectionList
lea rcx, [rsp + 0x30]
call fcn.1400075a0
nop
xor r14d, r14d
mov esi, r14d
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r14
mov word [rsp + 0x50], r14w
xor r8d, r8d
lea rdx, [0x1402dc4e0]
lea rcx, [rsp + 0x50]
call fcn.140001f40
nop
mov r9, qword [r12 + 8]
mov r8, qword [r12]
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.140035f90
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rbp + 0x390]
call fcn.14024b970
lea rdx, [r13 + 8]
cmp qword [rdx + 0x18], 8
jb 0x1400c75ea
mov rdx, qword [rdx]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x7fff
lea r9, [rbp + 0x390]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rbx, [rbp + 0x390]
cmp word [rbp + 0x390], 0
je 0x1400c76f4
lea rdx, str.InstallInfo
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400c76da
lea rdx, str.DeletedDriverList
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400c76da
lea rdx, str.AddedDriverList
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1400c76da
mov word [rbp - 0x80], r14w
xor edx, edx
mov r8d, 0x40e
lea rcx, [rbp - 0x7e]
call fcn.14024b970
mov r8, rbx
mov edx, 0x208
lea rcx, [rbp - 0x80]
call fcn.140246628
mov rax, qword [r13]
xor r9d, r9d
mov r8d, 0x208
lea rdx, [rbp - 0x80]
mov rcx, r13
call qword [rax + 0x198]
mov esi, eax
test eax, eax
jne 0x1400c76cd
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x80]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.140001f40
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.140040160
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
lea rbx, [rbx + rdx*2 + 2]
cmp word [rbx], 0
jne 0x1400c7620
mov r9d, esi
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x30]
call fcn.140007780
nop
cmp qword [rsp + 0x68], 8
jb 0x1400c7720
mov rcx, qword [rsp + 0x50]
call fcn.1401026ec
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r14
mov word [rsp + 0x50], r14w
lea rcx, [rsp + 0x30]
call fcn.140007730
mov eax, esi
mov rcx, qword [rbp + 0x10390]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x104a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x1400c9500
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x10080
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x100b0], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x10070], rax
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoResBasicIni::Read_DeletedDriverList
lea rcx, [rsp + 0x20]
call fcn.1400075a0
nop
mov qword [rsp + 0x58], 7
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
xor r8d, r8d
lea rdx, [0x1402dc4e0]
lea rcx, [rsp + 0x40]
call fcn.140001f40
nop
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140035f90
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x70]
call fcn.14024b970
lea r9, [rdi + 8]
cmp qword [r9 + 0x18], 8
jb 0x1400c95ad
mov r9, qword [r9]
mov r8d, 0x7fff
lea rdx, [rsp + 0x70]
lea rcx, str.DeletedDriverList
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
lea rbx, [rsp + 0x70]
cmp word [rsp + 0x70], 0
je 0x1400c9623
nop word [rax + rax]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140001f40
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140040160
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
lea rbx, [rbx + rdx*2 + 2]
cmp word [rbx], 0
jne 0x1400c95e0
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x20]
call fcn.140007780
nop
cmp qword [rsp + 0x58], 8
jb 0x1400c964e
mov rcx, qword [rsp + 0x40]
call fcn.1401026ec
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
lea rcx, [rsp + 0x20]
call fcn.140007730
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x100b0]
add rsp, 0x10080
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c98a0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x10080
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x100b0], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x10070], rax
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.CBaseInfoResBasicIni::Read_AddedDriverList
lea rcx, [rsp + 0x20]
call fcn.1400075a0
nop
mov qword [rsp + 0x58], 7
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
xor r8d, r8d
lea rdx, [0x1402dc4e0]
lea rcx, [rsp + 0x40]
call fcn.140001f40
nop
mov r9, qword [rsi + 8]
mov r8, qword [rsi]
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140035f90
xor edx, edx
mov r8d, 0xfffe
lea rcx, [rsp + 0x70]
call fcn.14024b970
lea r9, [rdi + 8]
cmp qword [r9 + 0x18], 8
jb 0x1400c994d
mov r9, qword [r9]
mov r8d, 0x7fff
lea rdx, [rsp + 0x70]
lea rcx, str.AddedDriverList
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
lea rbx, [rsp + 0x70]
cmp word [rsp + 0x70], 0
je 0x1400c99c3
nop word [rax + rax]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140001f40
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140040160
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, eax
lea rbx, [rbx + rdx*2 + 2]
cmp word [rbx], 0
jne 0x1400c9980
xor r9d, r9d
lea r8, str.return___08x
lea edx, [r9 + 2]
lea rcx, [rsp + 0x20]
call fcn.140007780
nop
cmp qword [rsp + 0x58], 8
jb 0x1400c99ee
mov rcx, qword [rsp + 0x40]
call fcn.1401026ec
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbp
mov word [rsp + 0x40], bp
lea rcx, [rsp + 0x20]
call fcn.140007730
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x100b0]
add rsp, 0x10080
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400cc8c0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x4e0], rbx
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbx, rdx
mov rdi, rcx
xor r14d, r14d
mov rax, qword [rcx]
call qword [rax + 0x98]
test al, al
jne 0x1400cca9a
mov rax, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [rax + 0xa0]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x38]
test al, al
je 0x1400cc940
mov rax, qword [rdi]
mov edx, 4
mov rcx, rdi
call qword [rax + 0x80]
jmp 0x1400cca80
mov dword [rsp + 0x70], r14d
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0x74]
call fcn.14024b970
mov r11, qword [rdi]
mov r9d, 0x104
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rdi
call qword [r11 + WSAStartup]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0xb0]
mov rcx, rax
lea rdx, [rsp + 0x38]
call fcn.1400cc700
mov r12, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
cmp r12, rsi
sete r13b
mov rbx, r12
cmp r12, rsi
je 0x1400cca23
nop
mov dword [rsp + 0x280], r14d
xor edx, edx
mov r8d, 0x204
lea rcx, [rsp + 0x284]
call fcn.14024b970
cmp qword [rbx + 0x18], 8
jb 0x1400cc9d9
mov rax, qword [rbx]
jmp 0x1400cc9dc
mov rax, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x1402e3978]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.14024679c
lea rcx, [rsp + 0x280]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400cca28
add rbx, 0x28
cmp rbx, rsi
jne 0x1400cc9b0
test r13b, r13b
je 0x1400cca2f
mov edx, 2
jmp 0x1400cca34
mov edx, 1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x80]
nop
test r12, r12
je 0x1400cca80
mov rbx, r12
cmp r12, rsi
je 0x1400cca78
nop
cmp qword [rbx + 0x18], 8
jb 0x1400cca5f
mov rcx, qword [rbx]
call fcn.1401026ec
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
add rbx, 0x28
cmp rbx, rsi
jne 0x1400cca50
mov rcx, r12
call fcn.1401026ec
mov r8, qword [rdi]
mov dl, 1
mov rcx, rdi
call qword [r8 + DllRegisterServer]
mov eax, r14d
jmp 0x1400ccaa9
mov dword [0x1403b95bc], 4
mov eax, 0x80010004
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4a0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400cced0
Capabilities:
Check if file exists

Disassembly:
push rdi
mov eax, 0x1070
call fcn.14024c240
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1088], rbx
mov qword [rsp + 0x1090], rbp
mov qword [rsp + 0x1098], rsi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov rbx, rcx
xor ebp, ebp
mov edi, ebp
mov rax, qword [rcx]
call qword [rax + 0x98]
test al, al
jne 0x1400ccf3a
mov dword [0x1403b95bc], 4
mov eax, 0x80010004
jmp 0x1400cd08b
mov dword [rsp + 0x860], ebp
xor edx, edx
mov r8d, 0x7fc
lea rcx, [rsp + 0x864]
call fcn.14024b970
mov dword [rsp + 0x60], ebp
xor edx, edx
mov r8d, 0x7fc
lea rcx, [rsp + 0x64]
call fcn.14024b970
mov r11, qword [rbx]
mov r9d, 0x400
lea r8, [rsp + 0x860]
mov edx, 1
mov rcx, rbx
call qword [r11 + WSAStartup]
test eax, eax
je 0x1400ccfa7
mov rax, qword [rbx]
mov r9d, 0x400
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rbx
call qword [rax + VarBstrFromDisp]
test eax, eax
jne 0x1400ccfb6
mov dword [0x1403b95bc], 0xc
mov edi, 0x8001000c
lea rcx, [rsp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400ccfda
mov rcx, qword [0x1403b9768]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x168]
test edi, edi
jne 0x1400cd089
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rbp
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xb0]
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1400cc700
test eax, eax
je 0x1400cd032
mov rax, qword [rbx]
mov byte [rsp + 0x20], dil
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x860]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [rax + 0x78]
mov edi, eax
jmp 0x1400cd041
mov edi, 0x80010002
mov dword [0x1403b95bc], 2
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400cd089
mov rsi, qword [rsp + 0x38]
cmp rbx, rsi
je 0x1400cd081
cmp qword [rbx + 0x18], 8
jb 0x1400cd064
mov rcx, qword [rbx]
call fcn.1401026ec
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov word [rbx], bp
add rbx, 0x28
cmp rbx, rsi
jne 0x1400cd055
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.1401026ec
mov eax, edi
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400cd9f0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa40
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0xa30], rax
mov rbx, rcx
lea rcx, [rsp + 0x234]
xor edi, edi
xor edx, edx
mov r8d, 0x7fc
mov dword [rsp + 0x230], edi
call fcn.14024b970
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x204
mov dword [rsp + 0x20], edi
call fcn.14024b970
mov r11, qword [rbx]
lea r8, [rsp + 0x230]
mov r9d, 0x400
xor edx, edx
mov rcx, rbx
call qword [r11 + WSAStartup]
test eax, eax
je 0x1400cdab3
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rcx, str.MFNP_ALRDY_INST.ini
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ebx, eax
cmp ebx, 0x104
jae 0x1400cdab3
lea rdx, str.MFNP_ALRDY_INST.ini
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
mov rcx, qword [rsp + 0xa30]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0xa58]
add rsp, 0xa40
pop rdi
ret