joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14029c5cc
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rbx, rcx
mov byte [rcx + 0x4e8], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x32]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_SetTimer]
lea rcx, [rbx + 0x3e0]
call fcn.14012acd8
xor edx, edx
mov rcx, qword [rbx + 0x3c0]
call qword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov rcx, qword [rbx + 0x3c8]
call qword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov rcx, qword [rbx + 0x3d0]
call qword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov rcx, qword [rbx + 0x3d8]
call qword [sym.imp.USER32.dll_EnableWindow]
mov edx, 0x450
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x47b
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 8
call fcn.1400be454
mov rdi, rax
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14029c6dd
lea rax, [0x14029850c]
mov qword [rbp - 0x38], rax
and dword [rbp - 0x30], 0
movups xmm0, xmmword [rbp - 0x38]
movdqu xmmword [rbp - 0x38], xmm0
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rbx
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.140028fc4
nop
mov rcx, rdi
call fcn.140002720
nop
jmp 0x14029c6df
xor edi, edi
lea rcx, [rbx + 0x4d8]
mov rdx, rdi
call fcn.1400013e0
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14029ce64
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
and dword [rcx + 0x48], 0
lea rdx, [rsp + 0x30]
mov rbx, rcx
call fcn.14029cd34
mov r11, qword [rsp + 0x30]
mov rcx, qword [rbx + 0x58]
mov eax, dword [r11 - 0x10]
neg eax
sbb edx, edx
and edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rsp + 0x30]
mov dword [rbx + 0xd0], 1
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14029cece
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x20
pop rbx
ret

Function at 0x14029d134
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
and dword [rcx + 0xd8], 0
or dword [rcx + 0x168], 0xffffffff
mov rdx, qword [rcx + 0x180]
mov rbx, rcx
mov rcx, qword [rcx + 0xf8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x58]
xor edx, edx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x1402a6c40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
and qword [rsp + 0x20], 0
and dword [rsp + 0x28], 0
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.14023dd4c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
cmp dword [rsp + 0x28], 0
je 0x1402a6c7e
mov rcx, qword [rsp + 0x20]
call fcn.14023dbec
mov al, bl
add rsp, 0x30
pop rbx
ret

Function at 0x1402a73d0
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8, qword [rbx]
lea rdx, str._select___s_
lea rcx, [rsp + 0x58]
call fcn.14000d9c8
mov dword [rsp + 0x28], 0xa
and qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x58]
mov r9, rbx
lea r8, str.Explorer
lea rdx, str.Open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402a7458
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x40
pop rbx
ret

Function at 0x1402a7cd0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x48]
mov rbx, rcx
mov dword [rax + 0x58], edx
mov rdx, qword [rcx + 0x48]
mov ecx, dword [rdx + 0x58]
dec ecx
je 0x1402a7d84
dec ecx
jne 0x1402a7dde
mov edx, 1
lea rcx, [rbx + 8]
mov r8d, edx
call fcn.1400207a4
mov rcx, qword [rbx + 0x4e0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x350]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0xc0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x60]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x208]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [rbx + 0x608], 0
je 0x1402a7dde
mov rcx, qword [rbx - 0x80]
xor r9d, r9d
mov byte [rbx + 0x608], 0
lea edx, [r9 + 2]
lea r8d, [r9 + 5]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SetTimer]
lea rcx, [rbx - 0x90]
call fcn.1402a7570
mov rcx, qword [rbx + 0x4e0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x350]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0xc0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x60]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x208]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
add rsp, 0x20
pop rbx
ret
Function at 0x1402aa190
Capabilities:
Write file on windows

Disassembly:
add rcx, 0xffffffffffffff70
xor r8d, r8d
jmp fcn.1402a9a40
Function at 0x1402b82d4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xd0], 0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jne 0x1402b832a
mov rax, qword [rcx]
call qword [rax + 0x68]
test eax, eax
je 0x1402b832a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1402b8319
test rdi, rdi
jne 0x1402b832a
cmp dword [rbx + 0x74], 0
je 0x1402b832a
and dword [rbx + 0x74], 0
mov byte [rbx + 0x128], 1
mov rcx, qword [rbx + 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
and dword [rsi], 0
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1402b8554
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
mov rcx, qword [rcx + 8]
mov r13, rdx
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, qword [rdi + 8]
and dword [rbp - 0x30], 0
and dword [rbp - 0x2c], 0
and dword [rbp - 0x28], 0
and dword [rbp - 0x24], 0
and dword [rbp - 0x20], 0
and dword [rbp - 0x1c], 0
and dword [rbp - 0x18], 0
and dword [rbp - 0x14], 0
lea rdx, [rbp - 0x30]
mov r12, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rdi + 8]
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
lea rdx, [rbp - 0x20]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1402b85fe
lea rdx, [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp qword [rdi + 0x110], 0
mov ebx, 0xcc0020
jne 0x1402b8691
mov rcx, r12
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, dword [rbp - 0x24]
mov edx, dword [rbp - 0x28]
sub r8d, dword [rbp - 0x2c]
sub edx, dword [rbp - 0x30]
mov rcx, r12
mov qword [rdi + 0x110], rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rdi + 0x118], rax
mov rcx, qword [rdi + 0x110]
mov rdx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [rbp - 0x24]
mov r9d, dword [rbp - 0x28]
sub ecx, dword [rbp - 0x2c]
sub r9d, dword [rbp - 0x30]
mov dword [rsp + 0x40], ebx
mov qword [rdi + 0x120], rax
mov eax, dword [rbp - 0x1c]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov eax, dword [rbp - 0x20]
xor edx, edx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ecx
mov rcx, qword [rdi + 0x110]
call qword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [rbp - 0x24]
mov r9d, dword [rbp - 0x28]
mov rax, qword [rdi + 0x110]
sub edx, dword [rbp - 0x2c]
sub r9d, dword [rbp - 0x30]
mov rcx, qword [r13]
mov dword [rsp + 0x40], ebx
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.GDI32.dll_BitBlt]
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400be110
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1402ba29c
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r8, str.Piriform_CCleaner_PreventSecondInstance
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1402ba2cd
mov byte [rbx + 0x40], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1402ba95c
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14048abe8]
mov edx, 1
mov rcx, qword [rax + 0x18]
mov qword [0x14048a8b0], rcx
lea rcx, [0x1402ba51c]
call qword [sym.imp.USER32.dll_EnumWindows]
and qword [0x14048a8b0], 0
mov al, 1
add rsp, 0x28
ret

Function at 0x1402bbaec
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140004658
mov edx, 8
mov rcx, rax
call fcn.14028ef60
test al, al
je 0x1402bbb40
call fcn.1400045d4
call fcn.1402cb878
test al, al
je 0x1402bbb40
lea rcx, [0x1402ba51c]
mov edx, 3
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rbx + 0x18]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41d
call qword [sym.imp.USER32.dll_PostMessageW]
add rsp, 0x20
pop rbx
ret

Function at 0x1402bbb4c
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov bl, 1
call fcn.1400045d4
call fcn.1402cb878
xor edi, edi
test al, al
jne 0x1402bbc09
lea rcx, [rsp + 0x58]
call fcn.1402bac4c
nop
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.14000cb18
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bbbaf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x28], 5
lea rax, [0x140330de8]
mov qword [rsp + 0x20], rax
lea r9, str._monitor
mov r8, qword [rsp + 0x50]
lea rdx, [0x14034e618]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movzx ebx, bl
cmp rax, 0x20
cmovg ebx, edi
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402bbc09
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1402bbc1c
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov bl, 1
xor edi, edi
mov dword [0x140489518], edi
lea edx, [rdi + 2]
lea rcx, [0x1402ba51c]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp dword [0x140489518], edi
jne 0x1402bbce2
lea rcx, [rsp + 0x58]
call fcn.1402bac4c
nop
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.14000cb18
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402bbc8f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x28], 5
lea r9, [0x140330de8]
mov qword [rsp + 0x20], r9
mov r8, qword [rsp + 0x50]
lea rdx, [0x14034e618]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movzx ebx, bl
cmp rax, 0x20
cmovg ebx, edi
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402bbce2
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov al, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1402bfec8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov r13, r9
mov rsi, r8
mov r14, rdx
mov r15, rcx
lea r12d, [rbx + 1]
mov dil, bl
cmp byte [r13], bl
jne 0x1402bff31
mov esi, ebx
mov edx, 0xa
mov rcx, r14
inc esi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1402bff29
mov rax, qword [r15 + 0x40]
lea rcx, [r15 + 0x40]
call qword [rax + 0x10]
test al, al
jne 0x1402bff29
cmp esi, 0x1f4
jl 0x1402bfefe
mov rsi, qword [rsp + 0xc0]
mov rax, qword [r15 + 0x40]
lea rcx, [r15 + 0x40]
call qword [rax + 0x10]
test al, al
jne 0x1402c00c9
cmp byte [rsi], bl
jne 0x1402c00c9
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1402c00ef
test r12d, r12d
jne 0x1402c0006
mov rax, qword [0x14048abe8]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov rax, qword [rcx]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0xb0]
xor r9d, r9d
mov r8d, 0x2cb
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rax + 0x20]
mov rcx, qword [r15 + 8]
lea r9d, [r12 + 0x23]
mov rdx, qword [rax]
lea r8, [0x140330de8]
call fcn.140243460
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
mov edi, eax
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402bfff5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
cmp edi, 6
jne 0x1402c00e5
mov dil, 1
jmp 0x1402c00c9
cmp r12d, 1
jl 0x1402c00c9
cmp byte [r13], bl
jne 0x1402c00b7
mov rax, qword [0x14048abe8]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbx
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov rax, qword [rcx]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0xc8]
xor r9d, r9d
mov r8d, 0x2cc
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rax + 0x20]
mov rcx, qword [r15 + 8]
lea r8, [0x140330de8]
mov rdx, qword [rax]
mov r9d, 0x123
call fcn.140243460
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
mov edi, eax
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402c00a8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
cmp edi, 6
je 0x1402c00b7
cmp edi, 2
je 0x1402c00ea
jmp 0x1402bfffe
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dil, 1
mov byte [r13], dil
mov rax, qword [r15 + 0x40]
lea rcx, [r15 + 0x40]
inc r12d
call qword [rax + 0x10]
test al, al
jne 0x1402c00ef
test dil, dil
je 0x1402c00ef
jmp 0x1402bfef6
cmp edi, 2
jne 0x1402c00ef
mov ebx, 0x4c7
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402c0ff8
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r8
mov rdi, rdx
mov r12, rcx
and dword [rax + 0x20], 0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r12], rax
mov dword [rsp + 0xb8], 1
mov rdx, qword [rdi]
lea rcx, [rsp + 0x20]
call fcn.14000cb18
nop
lea rdx, str.addons.sqlite
lea rcx, [rsp + 0x20]
call fcn.14000f884
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1402c117d
lea rsi, vtable.CppSQLite3DB.0
mov qword [rsp + 0x38], rsi
and qword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0x32
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1401a9e20
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov r8, qword [rbx]
lea rdx, str.Select_creator_From_addon_where_id___s
lea rcx, [rsp + 0x28]
call fcn.14000d9c8
mov rbx, qword [rsp + 0x28]
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.1401aa200
nop
lea rcx, [rsp + 0x50]
call fcn.1401a94e0
cmp byte [rsp + 0x68], 0
jne 0x1402c1135
lea rdx, str.creator
lea rcx, [rsp + 0x50]
call fcn.1401a9b20
mov rdx, rax
test rax, rax
jne 0x1402c1117
xor ecx, ecx
jmp 0x1402c1129
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r12
call fcn.14000c9f8
nop
lea rcx, [rsp + 0x50]
call fcn.1401a9f00
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402c115c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1402c116d
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x38]
call fcn.1401a9d90
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402c119d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop r12
pop rdi
pop rsi
ret
Function at 0x1402c11c8
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x80
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
mov r12, rcx
and dword [rax + 0x18], 0
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r12], rax
mov dword [rsp + 0xb0], 1
mov rdx, qword [rdi]
test rdx, rdx
je 0x1402c1375
mov rdx, qword [rdx + 0x40]
lea rcx, [rsp + 0xb8]
call fcn.14000cb18
nop
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1402c1352
lea rsi, vtable.CppSQLite3DB.0
mov qword [rsp + 0x30], rsi
and qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0x32
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x30]
call fcn.1401a9e20
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r8, qword [rdi]
mov r8, qword [r8]
lea rdx, str.Select_location_from_addon_Where_id___s
lea rcx, [rsp + 0x20]
call fcn.14000d9c8
mov rbx, qword [rsp + 0x20]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1401aa200
nop
lea rcx, [rsp + 0x48]
call fcn.1401a94e0
cmp byte [rsp + 0x60], 0
jne 0x1402c130a
lea rdx, str.location
lea rcx, [rsp + 0x48]
call fcn.1401a9b20
mov rdx, rax
test rax, rax
jne 0x1402c12ec
xor ecx, ecx
jmp 0x1402c12fe
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rcx, r12
call fcn.14000c9f8
nop
lea rcx, [rsp + 0x48]
call fcn.1401a9f00
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402c1331
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1402c1342
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.1401a9d90
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402c1375
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop r12
pop rdi
pop rsi
ret
Function at 0x1402c2018
Capabilities:
Check if file exists

Disassembly:
add rcx, 0xffffffffffffffe8
xor r9d, r9d
jmp 0x1402c1688

Function at 0x1402c2038
Capabilities:
Check if file exists

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
call fcn.1402c1f38
neg al
sbb edi, edi
not edi
and edi, 5
mov dword [rsp + 0x90], edi
mov rdx, qword [rbx]
test rdx, rdx
je 0x1402c2191
test edi, edi
jne 0x1402c2191
mov rdx, qword [rdx + 0x40]
lea rcx, [rsp + 0x98]
call fcn.14000cb18
nop
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1402c20a1
lea edi, [rax + 2]
jmp 0x1402c216d
lea rsi, vtable.CppSQLite3DB.0
mov qword [rsp + 0x30], rsi
and qword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0x32
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.1401a9e20
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
mov r8, qword [rbx]
mov r8, qword [r8]
lea rdx, str.Update_addon_Set_pendingUninstall__1_Where_id___s
lea rcx, [rsp + 0xa0]
call fcn.14000d9c8
mov rbx, qword [rsp + 0xa0]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.1401aa200
lea rcx, [rsp + 0x48]
call fcn.1401a9f00
xor edi, edi
mov dword [rsp + 0x90], edi
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1402c214d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1402c215d
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.1401a9d90
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1402c2191
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret