joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f3fb
Capabilities:
Identify system language via api

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
call qword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx ecx, ax
call fcn.140037b94
lea rsi, [rsp + 0x3c]
mov edx, 0x104
mov r9, qword [0x1400b4ee0]
lea r8, str._s_s_shell32.dll.mui
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, rsi
mov byte [rsp + 0x13f], 0
call fcn.14003a223
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
test rbp, rbp
je 0x14003f46e
mov rcx, rbp
call sub.msvcrt.dll_free
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
test rbx, rbx
je 0x14003f52c
lea r8, [0x140117360]
mov edx, 0x101d
mov rcx, rbx
call fcn.14003a425
test eax, eax
jg 0x14003f4d9
movabs rdx, 0x776f646e69572074
movabs rax, 0x666f736f7263694d
mov word [0x140117370], 0x73
mov qword [0x140117368], rdx
mov qword [0x140117360], rax
call fcn.140038579
mov rdx, rsi
lea rcx, str.Warning:_Could_not_locate_localized_format_prompt_title_string_in__s:__s
mov r8, rax
call fcn.1400380b9
lea r8, [0x1401172e0]
mov edx, 0x101e
mov rcx, rbx
call fcn.14003a425
test eax, eax
jg 0x14003f523
movabs rax, 0x642074616d726f46
mov dword [0x1401172e8], 0x6b7369
mov qword [0x1401172e0], rax
call fcn.140038579
mov rdx, rsi
lea rcx, str.Warning:_Could_not_locate_localized_format_prompt_button_string_in__s:__s
mov r8, rax
call fcn.1400380b9
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ecx, 0xc4d
call fcn.14001e311
test rax, rax
jne 0x14003f567
mov ecx, 0xc4d
mov ebx, 1
call fcn.14001e311
test rax, rax
je 0x14003f587
mov ecx, 0xc4d
call fcn.14001e311
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rbx, [rax + 1]
jmp 0x14003f587
mov ecx, 0xc4d
mov ebx, pe_nt_image_headers64
call fcn.14001e311
mov rcx, rax
call sub.msvcrt.dll_strlen
inc rax
cmp rax, 0x7f
jbe 0x14003f53b
mov ecx, 0xc4d
lea rbp, [0x1401173e0]
call fcn.14001e311
mov rdi, rbp
mov rcx, rbx
mov rsi, rax
rep movsb byte [rdi], byte [rsi]
mov ecx, 0xc4d
call fcn.14001e311
test rax, rax
jne 0x14003f5ca
mov ecx, 0xc4d
call fcn.14001e311
test rax, rax
jne 0x14003f5ee
lea rbp, [0x1401173e0]
jmp 0x14003f603
mov ecx, 0xc4d
call fcn.14001e311
mov rcx, rax
call sub.msvcrt.dll_strlen
inc rax
cmp rax, 0x7f
jbe 0x14003f5b2
lea rbp, [0x14011745f]
jmp 0x14003f603
mov ecx, 0xc4d
call fcn.14001e311
mov rcx, rax
call sub.msvcrt.dll_strlen
add rbp, rax
mov byte [rbp], 0
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14004163f
Capabilities:
Get graphical window text

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
xor eax, eax
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov rbx, rcx
movabs rax, 0x800000004
mov rdx, rsi
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_MapDialogRect]
mov rax, qword [rsp + 0x38]
mov edx, dword [rsp + 0x38]
mov r8d, 4
mov rbp, qword [sym.imp.KERNEL32.DLL_MulDiv]
mov qword [rsp + 0x28], rax
mov rax, qword [0x1400b4480]
cmp dword [rax], 0xa0
sbb edi, edi
and edi, 2
add edi, 0xd
cmp dword [rax], 0xa0
sbb ecx, ecx
and ecx, 2
add ecx, 0xa
call rbp
mov r8d, 4
mov edx, dword [rsp + 0x28]
mov ecx, edi
mov dword [0x1401174ec], eax
call rbp
mov r12, qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rbx
mov edx, 0x3f9
mov dword [0x1401174e8], eax
call r12
mov rbp, qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, rsi
mov rcx, rax
call rbp
mov rdi, qword [sym.imp.USER32.dll_MapWindowPoints]
mov r8, rsi
mov rdx, rbx
mov r9d, 2
xor ecx, ecx
call rdi
mov eax, dword [rsp + 0x30]
mov rcx, rbx
mov edx, 0x3ec
mov dword [0x1401179a0], eax
call r12
mov rdx, rsi
mov rcx, rax
call rbp
mov r8, rsi
mov rdx, rbx
xor ecx, ecx
mov r9d, 2
call rdi
mov eax, dword [rsp + 0x38]
sub dword [0x1401179a0], eax
xor r8d, r8d
mov eax, dword [rsp + 0x30]
lea r9, [rsp + 0x28]
mov edx, 0x463
mov dword [0x14011799c], eax
mov rax, qword [0x1400b4be0]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsp + 0x28]
mov rcx, rbx
mov edx, 0x400
mov dword [0x140117994], eax
call r12
mov rdx, rsi
mov rcx, rax
call rbp
mov r8, rsi
mov r9d, 2
mov rdx, rbx
xor ecx, ecx
call rdi
mov eax, dword [rsp + 0x3c]
sub eax, dword [rsp + 0x34]
mov rdx, rsi
mov dword [0x1401174e0], eax
mov eax, dword [rsp + 0x30]
mov dword [0x140117990], eax
mov rax, qword [0x1400b4af0]
mov rcx, qword [rax]
call rbp
mov r8, rsi
mov r9d, 2
mov rdx, rbx
xor ecx, ecx
call rdi
mov eax, dword [rsp + 0x38]
mov rcx, rbx
sub dword [0x140117990], eax
mov edx, 0x7d5
call r12
mov rdx, rsi
mov rcx, rax
call rbp
mov r8, rsi
mov r9d, 2
mov rdx, rbx
xor ecx, ecx
call rdi
mov eax, dword [rsp + 0x30]
mov rdx, rsi
mov dword [0x14011798c], eax
mov rax, qword [0x1400b4c00]
mov rcx, qword [rax]
call rbp
xor ecx, ecx
mov r9d, 2
mov r8, rsi
mov rdx, rbx
call rdi
mov eax, dword [rsp + 0x38]
sub dword [0x14011798c], eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140042f23
Capabilities:
Get graphical window text

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x198
mov rax, qword [0x1400b4b90]
lea rsi, [0x1400a54e0]
lea r12, [rsi + 0xc]
mov qword [rsp + 0x1e0], rcx
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 0x5a
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r8d, 0x48
mov ecx, 0xe
mov edx, eax
call qword [sym.imp.KERNEL32.DLL_MulDiv]
xor r8d, r8d
xor edx, edx
xor r9d, r9d
neg eax
mov dword [rsp + 0x50], edx
mov ecx, eax
lea rax, str.Segoe_UI
mov dword [rsp + 0x48], edx
xor edx, edx
mov qword [rsp + 0x68], rax
xor eax, eax
mov dword [rsp + 0x38], r8d
mov dword [rsp + 0x30], r8d
mov dword [rsp + 0x28], r8d
xor r8d, r8d
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], 2
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 0x258
call qword [sym.imp.GDI32.dll_CreateFontA]
mov r13, qword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov r14, qword [sym.imp.USER32.dll_GetDlgItem]
mov r15, qword [sym.imp.USER32.dll_GetWindowTextW]
mov rbp, rax
mov ebx, dword [rsi]
mov r9, rbp
mov r8d, 0x30
mov rcx, qword [rsp + 0x1e0]
mov qword [rsp + 0x20], 1
mov edx, ebx
call r13
mov edx, ebx
mov rcx, qword [rsp + 0x1e0]
lea rbx, [rsp + 0x90]
call r14
mov rdi, rbx
mov ecx, 0x40
mov rdx, rbx
mov qword [rsp + 0x70], rax
xor eax, eax
mov r8d, 0x7c
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
call r15
mov rcx, rbx
call sub.msvcrt.dll_wcslen
cmp rax, 0x7d
jbe 0x14004306a
mov r8d, 0x243
lea rdx, str.ui.c
lea rcx, str.wlen___ARRAYSIZE_wtmp____2
call qword [sym.imp.msvcrt.dll__wassert]
mov rcx, qword [rsp + 0x70]
mov rdx, rbx
mov word [rsp + rax*2 + 0x90], 0x20
add rsi, 4
mov word [rsp + rax*2 + 0x92], 0x20
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea r8, [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
mov rdx, r8
mov qword [rsp + 0x78], r8
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r8, qword [rsp + 0x78]
mov r9d, 2
xor ecx, ecx
mov rdx, qword [rsp + 0x1e0]
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call fcn.14003c8f1
mov dword [rsp + 0x30], 4
mov rcx, qword [rsp + 0x70]
mov rdx, rax
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x84]
sar rdx, 0x20
mov r8d, dword [rsp + 0x80]
mov dword [rsp + 0x28], edx
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
cmp rsi, r12
jne 0x140042fea
add rsp, 0x198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140045696
Capabilities:
Get graphical window text

Disassembly:
push rdi
push rsi
sub rsp, 0x88
lea rsi, [0x1400833c0]
mov ecx, 0x14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
lea rdi, [rsp + 0x30]
rep movsd dword [rdi], dword [rsi]
mov rsi, qword [0x1400b4bc0]
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0xc54
movsxd rdx, eax
shl rdx, 4
mov r10d, dword [rsp + rdx + 0x3c]
mov r9d, dword [rsp + rdx + 0x38]
mov r8d, dword [rsp + rdx + 0x34]
mov edx, dword [rsp + rdx + 0x30]
cmp eax, 1
jg 0x1400456f7
lea ecx, [rax + 0xc51]
mov dword [rsp + 0x20], r10d
call fcn.14001e311
mov rcx, qword [rsi]
or r8d, 0xffffffff
mov rdx, rax
add rsp, 0x88
pop rsi
pop rdi
jmp fcn.14003b4c1
Function at 0x140045b54
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x188
xor eax, eax
mov rbx, rdx
mov edx, dword [rsp + 0x1f0]
mov r12, r9
mov r13, rcx
lea rdi, [rsp + 0x7c]
mov ecx, 0x41
xor r9d, r9d
mov r14d, r8d
rep stosd dword [rdi], eax
mov ecx, edx
mov rdi, r12
mov qword [rsp + 0x68], r9
rep stosb byte [rdi], al
mov rcx, rbx
mov dword [rsp + 0x64], edx
lea r15, [rsp + 0x7c]
mov qword [rsp + 0x70], r9
mov dword [rsp + 0x60], 0xffffffff
call sub.msvcrt.dll_strlen
mov rcx, rax
mov rbp, rax
test rbp, rbp
je 0x140045c51
cmp byte [rbx + rbp], 0x5c
je 0x140045bcf
dec rbp
jmp 0x140045bbb
xor esi, esi
cmp rbp, 0x103
ja 0x140045d3d
mov eax, 0x104
inc rcx
mov rdi, r15
mov rsi, rbx
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r9d, 0x20019
mov rcx, r13
lea rdx, [rax + 1]
cmp rdx, 0x104
mov edx, 0x103
cmovae rax, rdx
xor r8d, r8d
mov rdx, r15
mov byte [rsp + rax + 0x7c], 0
lea rax, [rsp + 0x70]
mov byte [rsp + rbp + 0x7c], 0
inc rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140045ccf
xor r8d, r8d
mov qword [rsp + 0x70], r8
jmp 0x140045c7f
lea rax, [rsp + 0x68]
xor r8d, r8d
mov r9d, 0x2001d
mov rcx, r13
mov qword [rsp + 0x20], rax
lea rdx, [0x1400a5615]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140045c86
xor ecx, ecx
mov qword [rsp + 0x68], rcx
xor esi, esi
jmp 0x140045d1d
lea rax, [rsp + 0x5c]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x20], edx
lea rdx, [0x1400a561e]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 7
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140045c47
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], r12
lea rdx, [rbx + rbp]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
mov esi, 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x140045d1d
test eax, eax
jne 0x140045c7f
cmp dword [rsp + 0x60], r14d
jne 0x140045c7f
xor esi, esi
cmp dword [rsp + 0x64], 0
setne sil
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140045d2d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140045d3d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x188
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140046d9a
Capabilities:
Delete file

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140045e79
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_DeleteFileW]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov esi, eax
test rbx, rbx
je 0x140046dc6
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.DLL_SetLastError]
Function at 0x14004713c
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
xor r9d, r9d
xor r10d, r10d
xor r11d, r11d
xor eax, eax
mov dword [rsp + 0x34], r9d
lea r9, [rsp + 0x38]
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov dword [rsp + 0x38], edx
xor edx, edx
mov dword [rsp + 0x3c], r8d
lea r8, [0x140046299]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x1401179e0], rax
mov rcx, rax
test rax, rax
jne 0x1400471a1
lea rcx, str.Unable_to_start_unmount_image_thread
call fcn.1400380b9
xor eax, eax
jmp 0x1400471e9
mov rax, qword [str._b3_b_]
mov edx, dword [rax]
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
or edx, 0xffffffff
mov rcx, qword [0x1401179e0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x1401179e0]
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
test eax, eax
jne 0x1400471dc
xor edx, edx
mov dword [rsp + 0x34], edx
xor eax, eax
mov qword [0x1401179e0], rax
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret
Function at 0x1400471ee
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2d8
xor eax, eax
xor r8d, r8d
mov r9d, 0x20019
mov rbp, rcx
lea rdi, [rsp + 0xc8]
mov ecx, 0x41
mov r12d, edx
rep stosd dword [rdi], eax
xor edx, edx
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x90]
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x70], edx
lea rdx, str.SOFTWAREMicrosoftWIMMountMounted_Images
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140047257
xor eax, eax
jmp 0x14004746c
lea rax, [rsp + 0x8c]
xor r9d, r9d
lea r8, [rsp + 0x74]
mov dword [rsp + 0x74], 0x104
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x88]
lea r14, [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x84]
xor esi, esi
lea r15, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
lea rdx, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov r13, qword [sym.imp.msvcrt.dll__snprintf]
mov rcx, qword [rsp + 0x90]
cmp esi, dword [rsp + 0x70]
jae 0x140047443
xor eax, eax
lea rdi, [rsp + 0xa0]
mov r9, r15
mov edx, esi
mov dword [rsp + 0x68], 0x28
mov r8, rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140047338
inc esi
jmp 0x1400472ea
lea rbx, [rsp + 0x1cc]
mov r9, rdi
mov edx, 0x104
lea r8, str.SOFTWAREMicrosoftWIMMountMounted_Images_sWIM_Path
mov rcx, rbx
call r13
mov dword [rsp + 0x20], 0x104
lea r9, [0x140117a40]
mov rdx, rbx
mov r8d, 1
mov rcx, 0xffffffff80000002
mov byte [rsp + 0x2cf], 0
call fcn.140045b54
test eax, eax
jne 0x1400473ca
mov r9, rdi
lea r8, str.SOFTWAREMicrosoftWIMMountMounted_Images_sImage_Index
mov edx, 0x104
mov rcx, rbx
call r13
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x6c]
mov rdx, rbx
mov r8d, 4
mov rcx, 0xffffffff80000002
mov byte [rsp + 0x2cf], 0
call fcn.140045b54
test eax, eax
jne 0x1400473e2
jmp 0x1400473ed
mov rdx, rbp
lea rcx, [0x140117a40]
call sub.msvcrt.dll__stricmp_1
test eax, eax
je 0x140047385
jmp 0x140047334
cmp dword [rsp + 0x6c], r12d
jne 0x140047334
mov r9, rdi
lea r8, str.SOFTWAREMicrosoftWIMMountMounted_Images_sMount_Path
mov edx, 0x104
mov rcx, rbx
mov byte [0x140117a40], 0
call r13
mov dword [rsp + 0x20], 0x104
lea r9, [0x140117a40]
mov rdx, rbx
mov r8d, 1
mov rcx, 0xffffffff80000002
mov byte [rsp + 0x2cf], 0
call fcn.140045b54
test eax, eax
je 0x140047334
cmp esi, dword [rsp + 0x70]
jb 0x14004744a
mov byte [0x140117a40], 0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x140117a40], 0
je 0x140047250
lea rax, [0x140117a40]
add rsp, 0x2d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140047480
Capabilities:
Create thread

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edi, edi
xor eax, eax
mov rbx, rcx
mov dword [rsp + 0x44], edi
mov ecx, 5
lea rdi, [rsp + 0x4c]
rep stosd dword [rdi], eax
mov rcx, rbx
mov qword [rsp + 0x50], rbx
mov esi, edx
mov dword [rsp + 0x48], edx
call fcn.1400471ee
mov rdi, rax
test rax, rax
je 0x14004750d
mov r9, rax
mov r8d, esi
lea rcx, str.WARNING:_Found_stale__s___d__image_mounted_on__s___Attempting_to_unmount_it...
mov rdx, rbx
call fcn.1400380b9
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
lea rax, [0x140117f60]
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
xor r8d, r8d
mov edx, esi
mov rcx, rbx
mov word [0x140117d40], 0
call fcn.14004713c
xor r11d, r11d
xor ebx, ebx
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x48]
lea r8, [0x140045f26]
mov qword [rsp + 0x28], r11
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x1401179e0], rax
mov rcx, rax
test rax, rax
jne 0x14004754e
lea rcx, str.Unable_to_start_mount_image_thread
call fcn.1400380b9
jmp 0x14004759c
mov rax, qword [str._b3_b_]
mov edx, dword [rax]
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
or edx, 0xffffffff
mov rcx, qword [0x1401179e0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x1401179e0]
lea rdx, [rsp + 0x44]
call qword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
test eax, eax
jne 0x14004758b
xor r10d, r10d
mov dword [rsp + 0x44], r10d
xor r9d, r9d
cmp dword [rsp + 0x44], 0
mov qword [0x1401179e0], r9
jne 0x1400475a3
xor edi, edi
jmp 0x140047652
cmp word [0x140117f60], 0
jne 0x1400475c4
mov edx, 1
mov ecx, 1
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
jmp sub.msvcrt.dll_calloc
xor edx, edx
xor ecx, ecx
xor r8d, r8d
mov rbp, qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov qword [rsp + 0x38], rdx
or r9d, 0xffffffff
mov qword [rsp + 0x30], rdx
xor edx, edx
mov dword [rsp + 0x28], ecx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r8
lea r8, [0x140117f60]
call rbp
mov esi, eax
cmp eax, 1
jle 0x14004759c
movsxd rcx, eax
mov edx, 1
call sub.msvcrt.dll_calloc
mov rbx, rax
mov rdi, rax
test rax, rax
je 0x14004759c
xor eax, eax
or r9d, 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x38], rax
lea r8, [0x140117f60]
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
call rbp
cmp esi, eax
je 0x140047652
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x14004759c
mov rax, rdi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140047aae
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov r14d, dword [rsp + 0x2c0]
mov word [rsp + 0x45], 0x5c23
mov r13, rcx
mov ebx, edx
mov r12, r8
mov byte [rsp + 0x47], 0
mov rbp, r9
test r14d, r14d
jne 0x140047af7
mov r8d, edx
mov rdx, rcx
lea rcx, str.Opening:__s:__d___7_Zip_
call fcn.1400380b9
test r12, r12
sete al
test rbp, rbp
sete dl
or al, dl
jne 0x140047c1a
test r13, r13
je 0x140047c1a
add ebx, 0x30
mov byte [rsp + 0x45], bl
test r14d, r14d
jne 0x140047b32
mov r8, r12
mov rdx, rbp
lea rcx, str.Extracting:__s__From__s_
call fcn.1400380b9
xor r15d, r15d
lea rbx, [rsp + 0x14c]
mov rcx, rbp
mov rdi, rbx
mov rsi, rbp
call sub.msvcrt.dll_strlen
lea rcx, [rax + 1]
mov eax, 0x104
cmp rcx, rax
cmova rcx, rax
mov ecx, ecx
rep movsb byte [rdi], byte [rsi]
mov rcx, rbp
call sub.msvcrt.dll_strlen
mov rcx, rbx
lea rdx, [rax + 1]
cmp rdx, 0x104
mov edx, 0x103
cmovae rax, rdx
mov byte [rsp + rax + 0x14c], 0
call sub.msvcrt.dll_strlen
dec rax
test rax, rax
je 0x140047ba0
mov dl, byte [rbx + rax]
cmp dl, 0x5c
je 0x140047ba0
cmp dl, 0x2f
jne 0x140047b8b
mov byte [rsp + rax + 0x14c], 0
lea rax, [0x1400a5634]
test r15d, r15d
jne 0x140047bb9
lea rax, [rsp + 0x45]
lea rsi, [rsp + 0x48]
mov edx, 0x104
mov qword [rsp + 0x30], r12
lea r9, [0x140117c20]
lea r8, str.__s___y_e___s___s_s
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.msvcrt.dll__snprintf]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
mov byte [rsp + 0x14b], 0
call fcn.140036fa1
test eax, eax
je 0x140047c21
call fcn.140038579
lea rcx, str.__Could_not_launch_7z.exe:__s
mov rdx, rax
call fcn.1400380b9
xor eax, eax
jmp 0x140047d45
mov rcx, r12
call sub.msvcrt.dll_strlen
mov rsi, rax
test rsi, rsi
je 0x140047c42
mov al, byte [r12 + rsi]
cmp al, 0x5c
je 0x140047c6e
cmp al, 0x2f
je 0x140047c6e
dec rsi
jmp 0x140047c2c
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov r8d, 0x103
lea rdx, [0x1400a5fd6]
mov rcx, rbx
sub r8, rax
mov eax, 2
cmp r8, rax
cmova r8, rax
call sub.msvcrt.dll_strncat
add rsi, r12
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rcx, rbx
mov rdi, rax
call sub.msvcrt.dll_strlen
inc rdi
mov rdx, rsi
mov rcx, rbx
mov r8d, 0x103
sub r8, rax
cmp r8, rdi
cmova r8, rdi
call sub.msvcrt.dll_strncat
xor edx, edx
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__access]
test eax, eax
je 0x140047cd9
test r15d, r15d
jne 0x140047cc1
mov r15d, 1
jmp 0x140047b3d
test r14d, r14d
jne 0x140047c1a
mov rdx, rbx
lea rcx, str.__7z.exe_did_not_extract__s
jmp 0x140047c15
mov rcx, rbx
call fcn.140045e79
mov rcx, rbp
mov rsi, rax
call fcn.140045e79
mov r8d, 1
mov rcx, rsi
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.DLL_MoveFileExW]
mov edi, eax
test r12, r12
je 0x140047d10
mov rcx, r12
call sub.msvcrt.dll_free
test rsi, rsi
je 0x140047d1d
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, 1
test edi, edi
jne 0x140047d45
call fcn.140038579
mov r8, rbp
mov rdx, rbx
lea rcx, str.__Could_not_rename__s_to__s:__s
mov r9, rax
call fcn.1400380b9
jmp 0x140047c1a
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400481bd
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
xor r9d, r9d
xor r10d, r10d
xor r11d, r11d
mov dword [rsp + 0x34], r9d
mov dword [rsp + 0x3c], r9d
lea r9, [rsp + 0x38]
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov dword [rsp + 0x38], edx
xor edx, edx
mov qword [rsp + 0x48], r8
lea r8, [0x1400464d8]
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [0x1401179e0], rax
mov rcx, rax
test rax, rax
jne 0x140048221
lea rcx, str.Unable_to_start_apply_image_thread
call fcn.1400380b9
xor eax, eax
jmp 0x140048269
mov rax, qword [str._b3_b_]
mov edx, dword [rax]
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
or edx, 0xffffffff
mov rcx, qword [0x1401179e0]
call qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov rcx, qword [0x1401179e0]
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
test eax, eax
jne 0x14004825c
xor edx, edx
mov dword [rsp + 0x34], edx
xor eax, eax
mov qword [0x1401179e0], rax
mov eax, dword [rsp + 0x34]
add rsp, 0x58
ret
Function at 0x1400490e8
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov r13, rcx
mov rcx, qword [0x1400b4f20]
call fcn.14004903b
lea rcx, [0x1400a63f0]
mov rbp, rax
call fcn.14004903b
mov edx, 2
mov ecx, 0x104
mov r12, rax
call sub.msvcrt.dll_calloc
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
mov r9, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov r14, qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
call r14
mov esi, eax
test ebx, ebx
je 0x140049185
xor eax, eax
mov dword [rsp + 0x28], 0x104
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x38], rax
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ebx, eax
test eax, eax
jne 0x140049185
call r14
mov esi, eax
test rdi, rdi
je 0x140049192
mov rcx, rdi
call sub.msvcrt.dll_free
test r12, r12
je 0x14004919f
mov rcx, r12
call sub.msvcrt.dll_free
test rbp, rbp
je 0x1400491ac
mov rcx, rbp
call sub.msvcrt.dll_free
mov ecx, esi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, ebx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x1400491c5
Capabilities:
Copy file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rdx
call fcn.14004903b
mov rcx, rbx
mov rsi, rax
call fcn.14004903b
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_CopyFileW]
mov edi, eax
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebp, eax
test rsi, rsi
je 0x14004920c
mov rcx, rsi
call sub.msvcrt.dll_free
test rbx, rbx
je 0x140049219
mov rcx, rbx
call sub.msvcrt.dll_free
mov ecx, ebp
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov eax, edi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret