joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140046cc0
Capabilities:
Check if file exists
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rax, qword [rax + 0x348]
call qword [case.0x1400136d6.0]
mov rcx, qword [rbx + 0x650]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x650]
xor r9d, r9d
movsxd r8, eax
mov edx, 0x150
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test eax, eax
jne 0x140046d3c
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x80]
call qword [case.0x1400136d6.0]
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x30]
mov rcx, rdx
call qword [case.0x1400136d6.0]
mov ebx, eax
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [case.0x1400136d6.0]
mov r8, rax
mov edx, ebx
mov rcx, qword [rax]
mov rax, qword [rcx + 0x28]
mov rcx, r8
call qword [case.0x1400136d6.0]
test rax, rax
je 0x140046eb8
lea rbx, [rax + 0x104]
mov qword [rsp + 0x30], rdi
test rbx, rbx
jne 0x140046dc1
mov rbx, qword [0x1402bbf78]
test rbx, rbx
je 0x140046e4b
call fcn.1401ce6e4
mov qword [rax + 0x18], rbx
mov rcx, qword [0x1402bbf80]
test rcx, rcx
je 0x140046e4b
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1402bbf80], 0
jmp 0x140046e4b
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140046e41
mov rcx, qword [0x1402bbf80]
test rcx, rcx
je 0x140046deb
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1402bbf80], 0
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x1402bbf80], rax
mov rbx, rax
test rax, rax
je 0x140046e35
cmp qword [0x1402bbf78], 0
jne 0x140046e2a
call fcn.1401ce6e4
mov rbx, qword [0x1402bbf80]
mov rcx, qword [rax + 0x10]
mov qword [0x1402bbf78], rcx
call fcn.1401ce6e4
mov qword [rax + 0x18], rbx
jmp 0x140046e4b
mov dword [0x1402bbd98], 0x47
jmp 0x140046e4b
mov dword [0x1402bbd98], 0x60
mov rdi, qword [0x1402bbf50]
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
lea rbx, [rax + 0xac8]
cmp qword [rbx + 0x18], 8
jb 0x140046e73
mov rbx, qword [rbx]
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x20]
call qword [case.0x1400136d6.0]
mov rdi, qword [rsp + 0x30]
add rax, 0xa88
cmp qword [rax + 0x18], 8
jb 0x140046e98
mov rax, qword [rax]
mov rcx, qword [0x1402bbf60]
mov r9, rbx
add rcx, 0x58
mov r8, rax
mov edx, 0x4b0
add rsp, 0x20
pop rbx
jmp fcn.14001ce30
add rsp, 0x20
pop rbx
ret
Function at 0x140047340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rax, r8
mov rbp, rdx
mov r15, rcx
mov r14d, ebx
test r8, r8
je 0x1400474b3
test rdx, rdx
je 0x1400474b3
xor edx, edx
mov qword [rsp + 0x40], rsi
lea r8d, [rbx + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
je 0x14004748e
mov edx, 0xfa1
mov qword [rsp + 0x48], rdi
lea r8d, [rbx + 0xa]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400473c8
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400473c8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx r14d, word [rax]
mov edx, 0xb0
lea ecx, [rdx - 0x70]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
je 0x14004745b
lea rcx, [rax + 4]
mov dword [rax], r14d
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [r15 + 0x18]
lea rcx, [r15 + 0x10]
cmp rdx, qword [rcx + 0x10]
je 0x14004742d
mov qword [rdx], rdi
add qword [rcx + 8], 8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
lea r8, [rsp + 0x50]
call fcn.14002f990
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov rcx, rsi
mov dword [0x1402bbd98], 2
mov ebx, 0x80010002
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov rsi, qword [rsp + 0x40]
mov ebx, 0x80010047
mov eax, ebx
mov dword [0x1402bbd98], 0x47
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov rbx, qword [rsp + 0x58]
mov eax, 0x80010001
mov dword [0x1402bbd98], 1
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x14006a2d0
Capabilities:
Parse url

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x20
xorps xmm0, xmm0
mov qword [rsp + 0x40], rdi
mov edi, dword [rcx + 0x10]
xor eax, eax
movups xmmword [rcx + 0x34], xmm0
mov rbx, rcx
movups xmmword [rcx + 0x44], xmm0
movups xmmword [rcx + 0x54], xmm0
movups xmmword [rcx + 0x64], xmm0
movups xmmword [rcx + 0x74], xmm0
movups xmmword [rcx + 0x84], xmm0
mov dword [rcx + 0x94], eax
mov dword [rcx + 0x30], 0x68
cmp dword [rcx + 0x20], eax
jne 0x14006a32f
mov dword [rcx + 0x40], edi
mov dword [rcx + 0x50], edi
mov dword [rcx + 0x60], edi
mov dword [rcx + 0x70], edi
mov dword [rcx + 0x80], edi
jmp 0x14006a42a
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov rdx, rdi
lea rsi, [rcx + 0x98]
mov rcx, rsi
call fcn.140011420
cmp qword [rsi + 0x18], 8
jb 0x14006a358
mov rsi, qword [rsi]
mov qword [rbx + 0x38], rsi
xor r8d, r8d
lea rsi, [rbx + 0xb8]
mov dword [rbx + 0x40], edi
mov rcx, rsi
mov rdx, rdi
call fcn.140011420
cmp qword [rsi + 0x18], 8
jb 0x14006a37e
mov rsi, qword [rsi]
mov qword [rbx + 0x48], rsi
xor r8d, r8d
lea rsi, [rbx + 0xd8]
mov dword [rbx + 0x50], edi
mov rcx, rsi
mov rdx, rdi
call fcn.140011420
cmp qword [rsi + 0x18], 8
jb 0x14006a3a4
mov rsi, qword [rsi]
mov qword [rbx + 0x58], rsi
xor r8d, r8d
lea rsi, [rbx + 0xf8]
mov dword [rbx + 0x60], edi
mov rcx, rsi
mov rdx, rdi
call fcn.140011420
cmp qword [rsi + 0x18], 8
jb 0x14006a3ca
mov rsi, qword [rsi]
mov qword [rbx + 0x68], rsi
xor r8d, r8d
lea rsi, [rbx + 0x118]
mov dword [rbx + 0x70], edi
mov rcx, rsi
mov rdx, rdi
call fcn.140011420
cmp qword [rsi + 0x18], 8
jb 0x14006a3f0
mov rsi, qword [rsi]
mov qword [rbx + 0x78], rsi
xor r8d, r8d
lea rsi, [rbx + 0x138]
mov dword [rbx + 0x80], edi
mov rcx, rsi
mov rdx, rdi
call fcn.140011420
cmp qword [rsi + 0x18], 8
mov rbp, qword [rsp + 0x30]
jb 0x14006a41e
mov rsi, qword [rsi]
mov qword [rbx + 0x88], rsi
mov rsi, qword [rsp + 0x38]
mov dword [rbx + 0x90], edi
mov rcx, rbx
cmp qword [rbx + 0x18], 8
mov rdi, qword [rsp + 0x40]
jb 0x14006a442
mov rcx, qword [rbx]
mov r8d, dword [rbx + 0x20]
lea r9, [rbx + 0x30]
mov edx, dword [rbx + 0x10]
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
mov dword [rbx + 0x24], 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140094360
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x700
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov rbp, rdx
lea rcx, [rsp + 0x30]
lea rdx, str.OperateFile::FindFile
mov rbx, r8
call fcn.14001abe0
mov rcx, qword [0x1402a8360]
lea r14, [0x1402a8360]
lea rdi, [0x1402bbdb0]
cmp rcx, r14
je 0x14009442a
test byte [rcx + 0x1c], 1
je 0x1400943ed
cmp qword [0x1402bbdc8], 8
lea r8, str.eXK3
mov rcx, qword [rcx + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x2e
call fcn.140001ad0
mov rcx, qword [0x1402a8360]
cmp rcx, r14
je 0x14009442a
test byte [rcx + 0x1c], 1
je 0x14009442a
cmp qword [0x1402bbdc8], 8
lea r8, str.eXK3
mov rcx, qword [rcx + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x2f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call fcn.14002fbe0
xor edx, edx
lea rcx, [rsp + 0x4e0]
mov r8d, 0x208
call fcn.1401e7e40
xor edx, edx
lea rcx, [rsp + 0x2d0]
mov r8d, 0x208
call fcn.1401e7e40
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x250
call fcn.1401e7e40
mov rdx, rbp
lea rcx, [rsp + 0x2d0]
xor esi, esi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x2ce], 0x5c
je 0x1400944ad
lea rdx, [0x140251df8]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9, rbx
lea r8, [rsp + 0x2d0]
lea rdx, [0x1402528f8]
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14009450f
mov esi, 1
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400944f1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov cl, 1
mov byte [rsp + 0x38], cl
mov rax, qword [0x1402a8360]
cmp rax, r14
je 0x14009455e
test byte [rax + 0x1c], cl
je 0x14009455e
cmp qword [0x1402bbdc8], 8
lea r8, str.eXK3
mov rcx, qword [rax + 0x10]
mov r9, rdi
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x30
mov dword [rsp + 0x20], esi
call fcn.140001b40
movzx ecx, byte [rsp + 0x38]
mov rax, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rsp + 0x30], rdx
test cl, cl
jne 0x1400945b7
cmp rax, r14
je 0x1400945b7
test byte [rax + 0x1c], 1
je 0x1400945b7
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
mov edx, 0xa
lea r8, [0x140252818]
cmovae rcx, qword [rsp + 0x40]
cmp qword [0x1402bbdc8], 8
mov qword [rsp + 0x20], rcx
cmovae rdi, qword [0x1402bbdb0]
mov rcx, qword [rax + 0x10]
mov r9, rdi
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, esi
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140097060
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov eax, 1
xor ebx, ebx
cmp rbx, qword [rdi + 0x10]
jge 0x140097099
test rbx, rbx
js 0x1400970a4
mov rax, qword [rdi + 8]
mov edx, 0x20
mov rcx, qword [rax + rbx*8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
inc rbx
test eax, eax
jne 0x140097074
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1401bb848
int3
Function at 0x140098af0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x700
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x6f0], rax
mov rsi, rdx
lea rcx, [rsp + 0x30]
lea rdx, str.OperateFile::GetFileCountInFolder
call fcn.14001abe0
mov rbx, qword [0x1402a8360]
lea r14, [0x1402a8360]
lea rbp, [0x1402bbdb0]
cmp rbx, r14
je 0x140098b7a
test byte [rbx + 0x1c], 1
je 0x140098b7a
cmp qword [0x1402bbdc8], 8
lea r8, str.eXK3
mov rcx, qword [rbx + 0x10]
mov r9, rbp
cmovae r9, qword [0x1402bbdb0]
mov edx, DllRegisterServer
call fcn.140001ad0
mov rbx, qword [0x1402a8360]
xor edx, edx
lea rcx, [rsp + 0x2d0]
mov r8d, 0x208
call fcn.1401e7e40
xor edx, edx
lea rcx, [rsp + 0x4e0]
mov r8d, 0x208
call fcn.1401e7e40
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x250
call fcn.1401e7e40
xor edi, edi
test rsi, rsi
jne 0x140098bd4
mov dword [0x1402bbd98], 1
mov edi, 0xffffffff
jmp 0x140098c89
mov rdx, rsi
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x2d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [rsp + 0x2d0]
lea rdx, str._s.
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x4e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140098c82
nop
lea rdx, [0x140252314]
lea rcx, [rsp + 0xac]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140098c64
lea rdx, [0x140255880]
lea rcx, [rsp + 0xac]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140098c64
inc edi
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140098c30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [0x1402a8360]
mov al, 1
mov byte [rsp + 0x38], al
cmp rbx, r14
je 0x140098cd1
test byte [rbx + 0x1c], al
je 0x140098cd1
cmp qword [0x1402bbdc8], 8
lea r8, str.eXK3
mov rcx, qword [rbx + 0x10]
mov r9, rbp
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.OLEAUT32.dll_SysAllocStringByteLen
mov dword [rsp + 0x20], edi
call fcn.140001b40
movzx eax, byte [rsp + 0x38]
mov rbx, qword [0x1402a8360]
lea rcx, vtable.WppTrace.0
mov qword [rsp + 0x30], rcx
test al, al
jne 0x140098d2a
cmp rbx, r14
je 0x140098d2a
test byte [rbx + 0x1c], 1
je 0x140098d2a
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
mov edx, 0xa
lea r8, [0x140252818]
cmovae rcx, qword [rsp + 0x40]
cmp qword [0x1402bbdc8], 8
mov qword [rsp + 0x20], rcx
cmovae rbp, qword [0x1402bbdb0]
mov rcx, qword [rbx + 0x10]
mov r9, rbp
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, edi
mov rcx, qword [rsp + 0x6f0]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x700]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a3620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
lea rcx, [rsp + 0x30]
lea rdx, str.OperateString::GetCRC
call fcn.14001abe0
mov r10, qword [0x1402a8360]
lea rbp, [0x1402a8360]
lea rsi, [0x1402bbdb0]
cmp r10, rbp
je 0x1400a36ad
test byte [r10 + 0x1c], 1
je 0x1400a36ad
cmp qword [0x1402bbdc8], 8
lea r8, [0x140259f50]
mov rcx, qword [r10 + 0x10]
mov r9, rsi
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x35
call fcn.140001ad0
mov r10, qword [0x1402a8360]
xor edi, edi
mov r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], di
jne 0x1400a36b6
test r8, r8
je 0x1400a3707
lea r9, [0x140000000]
nop dword [rax]
movzx edx, byte [rbx]
lea rbx, [rbx + 2]
movzx eax, dil
xor rdx, rax
mov rax, rdx
and edx, 0xf
shr rax, 4
mov ecx, dword [r9 + rax*4 + 0x246030]
mov eax, edi
xor ecx, dword [r9 + rdx*4 + 0x245ff0]
shr eax, 8
mov edi, ecx
xor edi, eax
sub r8, 1
jne 0x1400a36d0
mov al, 1
mov byte [rsp + 0x38], al
cmp r10, rbp
je 0x1400a3750
test byte [r10 + 0x1c], al
je 0x1400a3750
cmp qword [0x1402bbdc8], 8
lea r8, [0x140259f50]
mov rcx, qword [r10 + 0x10]
mov r9, rsi
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x36
mov dword [rsp + 0x20], edi
call fcn.140001b40
movzx eax, byte [rsp + 0x38]
mov r10, qword [0x1402a8360]
lea rcx, vtable.WppTrace.0
mov qword [rsp + 0x30], rcx
test al, al
jne 0x1400a37aa
cmp r10, rbp
je 0x1400a37aa
test byte [r10 + 0x1c], 1
je 0x1400a37aa
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
mov edx, 0xa
lea r8, [0x140252818]
cmovae rcx, qword [rsp + 0x40]
cmp qword [0x1402bbdc8], 8
mov qword [rsp + 0x20], rcx
cmovae rsi, qword [0x1402bbdb0]
mov rcx, qword [r10 + 0x10]
mov r9, rsi
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400a81f0
Capabilities:
Copy file
Set file attributes

Disassembly:
sub rsp, 0xe68
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0xe50], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1401e7e40
xor edx, edx
lea rcx, [rsp + 0x650]
mov r8d, 0x800
call fcn.1401e7e40
xor edx, edx
lea rcx, [rsp + 0x440]
mov r8d, 0x208
call fcn.1401e7e40
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.1401e7e40
mov r9d, 0x104
lea r8, [rsp + 0x20]
lea rdx, str.InitSettings
lea rcx, [0x1402bbdd0]
call fcn.1400d98a0
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [case.0x1400136d6.0]
mov r9, rax
lea r8, [rsp + 0x650]
lea rdx, str.TEMPPATH
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rcx, r9
call qword [case.0x1400136d6.0]
lea rcx, [rsp + 0x650]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r9, str.InitSettings.ini
lea r8, [rsp + 0x20]
lea rdx, [0x1402528f8]
lea rcx, [rsp + 0x440]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, str.InitSettings.ini
lea r8, [rsp + 0x650]
lea rdx, [0x1402528f8]
lea rcx, [rsp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r8d, r8d
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x1400a835a
mov edx, 0x20
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [0x1402bbf50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x98]
call qword [case.0x1400136d6.0]
mov dword [rax + 0x18], 1
mov rcx, qword [rsp + 0xe50]
xor rcx, rsp
call fcn.1401e2900
add rsp, 0xe68
ret
Function at 0x1400c0230
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rdx
lea rdx, str.UninstallerInstall::DeleteUnInstFiles
lea rcx, [rsp + 0x30]
call fcn.14001abe0
nop
lea rsi, [0x1402a8360]
lea rbx, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400c02b1
test byte [rcx + 0x1c], 1
je 0x1400c02b1
mov r9, rbx
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x27
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x80]
call fcn.1401e7e40
mov edx, 0x104
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1400c02f4
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400c0364
test byte [rcx + 0x1c], 4
je 0x1400c0364
lea edx, [rax + 0x28]
jmp 0x1400c0341
mov rcx, qword [0x1402bbf58]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x1400136d6.0]
mov r9, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x100]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, r9
call qword [case.0x1400136d6.0]
test eax, eax
jne 0x1400c0364
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400c0364
test byte [rcx + 0x1c], 4
je 0x1400c0364
lea edx, [rax + 0x29]
mov r9, rbx
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov rdx, rdi
call fcn.140019690
mov rdx, rdi
call fcn.140019a00
mov rdx, rdi
call fcn.140019bd0
mov al, 1
mov byte [rsp + 0x38], al
mov rcx, qword [0x1402a8360]
cmp rcx, rsi
je 0x1400c03c7
test byte [rcx + 0x1c], al
je 0x1400c03c7
mov r9, rbx
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x2a
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
movzx eax, byte [rsp + 0x38]
mov rcx, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rsp + 0x30], rdx
test al, al
jne 0x1400c0420
cmp rcx, rsi
je 0x1400c0420
test byte [rcx + 0x1c], 1
je 0x1400c0420
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rax, qword [rsp + 0x40]
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x140252818]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c1cb0
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, r9
mov rbp, r8
mov rsi, rdx
lea rdx, str.UninstallerInstall::CopyUninstallerExe
lea rcx, [rsp + 0x30]
call fcn.14001abe0
nop
lea r15, [0x1402a8360]
lea rdi, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, r15
je 0x1400c1d38
test byte [rcx + 0x1c], 1
je 0x1400c1d38
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x37
lea r8, [0x14025b960]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
xor ebx, ebx
lea r9, str.UNINSTAL.exe
mov r8, r14
lea rdx, [0x1402528f8]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea edx, [rbx + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400c1dde
mov rax, qword [0x1402a8360]
cmp rax, r15
je 0x1400c1dcf
test byte [rax + 0x1c], 2
je 0x1400c1dcf
mov rbx, rdi
cmp qword [0x1402bbdc8], 8
cmovae rbx, qword [0x1402bbdb0]
lea rcx, [rsp + 0x30]
call fcn.14001b0b0
mov edx, 0x38
mov qword [rsp + 0x20], rax
mov r9, rbx
lea r8, [0x14025b960]
mov rcx, qword [0x1402a8360]
mov rcx, qword [rcx + 0x10]
call fcn.140006c90
mov ebx, 0x8001000c
mov dword [0x1402bbd98], 0xc
mov edx, 0x20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov cl, 1
mov byte [rsp + 0x38], cl
mov rax, qword [0x1402a8360]
cmp rax, r15
je 0x1400c1e3b
test byte [rax + 0x1c], cl
je 0x1400c1e3b
mov r9, rdi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, 0x39
mov dword [rsp + 0x20], ebx
lea r8, [0x14025b960]
mov rcx, qword [rax + 0x10]
call fcn.140001b40
movzx ecx, byte [rsp + 0x38]
mov rax, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rsp + 0x30], rdx
test cl, cl
jne 0x1400c1e94
cmp rax, r15
je 0x1400c1e94
test byte [rax + 0x1c], 1
je 0x1400c1e94
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
cmp qword [0x1402bbdc8], 8
cmovae rdi, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea r8, [0x140252818]
mov rcx, qword [rax + 0x10]
call fcn.140006c90
lea rcx, [rsp + 0x60]
call fcn.1400048a0
lea rcx, [rsp + 0x40]
call fcn.1400048a0
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401e2900
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c9350
Capabilities:
Read data from internet
Receive data

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.WININET.dll_InternetReadFile]
xor edx, edx
mov ecx, 0x80004005
test eax, eax
cmovne ecx, edx
mov eax, ecx
add rsp, 0x28
ret