joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f440
Capabilities:
Send data
Send http request

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rsi, rcx
call fcn.14001eed0
test eax, eax
je 0x14001f471
mov dword [rsi + 0x3530], 4
mov eax, 0x80004005
jmp 0x14001f6de
call fcn.140102a14
mov r11, rax
xor ebx, ebx
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x14001f492
mov ecx, 0x80004005
call fcn.140005210
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x98], rax
mov r8d, reloc.WSOCK32.dll_recv
lea rdx, str.SOAPAction:____r_n
lea rcx, [rsp + 0x98]
call fcn.140005f90
mov r8d, 0x24
lea rdx, str.Content_Type:_application_soapxml_r_n
lea rcx, [rsp + 0x98]
call fcn.140005f90
nop
mov eax, ebx
mov ecx, 0x800000
cmp dword [rsi + 0x2458], 3
cmove eax, ecx
or eax, 0x400200
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
lea rax, str.text_
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, str.HTTP_1.0
mov r8, qword [rsi + 0x24c0]
lea rdx, str.POST
mov rcx, qword [rsi + 0x3540]
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov qword [rsi + 0x3548], rax
test rax, rax
je 0x14001f682
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x90], 4
cmp dword [rsi + 0x2458], 3
jne 0x14001f5a1
lea r9, [rsp + 0x90]
lea r8, [rsp + 0x88]
mov edx, 0x1f
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
or dword [rsp + 0x88], 0x3100
mov r9d, 4
lea r8, [rsp + 0x88]
lea edx, [r9 + 0x1b]
mov rcx, qword [rsi + 0x3548]
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov r9, qword [rsi + 0x2480]
mov eax, dword [r9 - 0x10]
mov rdi, qword [rsp + 0x98]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
mov rcx, qword [rsi + 0x3548]
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x14001f694
mov rax, qword [rsi + 0x3548]
mov qword [rsi + 0x2490], rax
mov rcx, rsi
call fcn.14001f7c0
cmp eax, 0x1f4
je 0x14001f613
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001f60c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x14001f6de
mov dword [rsi + 0x3530], 7
mov qword [rsp + 0x40], rbx
mov rax, qword [rsi]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [rax]
test eax, eax
js 0x14001f670
lea rbx, [rsi + 0x2488]
mov qword [rsp + 0x50], rbx
lea rcx, [rsi + 0x3550]
mov r8, qword [rsp + 0x40]
mov rdx, rbx
call fcn.140019650
test eax, eax
jns 0x14001f661
mov dword [rsi + 0x3530], 8
test rbx, rbx
je 0x14001f670
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_recv]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001f694
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
jmp 0x14001f694
mov dword [rsi + 0x3530], 5
mov rdi, qword [rsp + 0x98]
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14001f6af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x80004005
jmp 0x14001f6de
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140026020
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebp, ebp
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400260e5
mov r8, rdx
mov ecx, 0x1f0001
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
test rax, rax
je 0x140026078
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rbp + 1]
jmp 0x1400260e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x14002608a
mov eax, 2
jmp 0x1400260e7
cmp edi, 1
jne 0x1400260e5
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], bp
call fcn.14024b970
lea rdx, str.Global_
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r11, qword [rsi]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rsi
call qword [r11 + 0x2e8]
test eax, eax
je 0x1400260e7
bts eax, 0x1f
jmp 0x1400260e7
mov eax, ebp
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140245660
mov rbx, qword [rsp + 0x270]
add rsp, 0x240
pop rdi
pop rsi
pop rbp
ret

Function at 0x140026110
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
test rdx, rdx
je 0x140026181
mov r8, rdx
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
test rax, rax
je 0x140026149
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140026158
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
cmp eax, 5
jne 0x140026175
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x20]
mov eax, 2
add rsp, 0x28
ret
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400261e0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140026234
mov rdi, qword [rcx + 0x190]
test rdi, rdi
je 0x140026227
call fcn.14010b1bc
mov qword [rax + 0x18], rdi
mov rcx, qword [rbx + 0x198]
test rcx, rcx
je 0x140026227
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x198], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1400262bb
mov rcx, qword [rbx + 0x198]
test rcx, rcx
je 0x14002625f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x198], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x198], rax
test rax, rax
je 0x1400262a1
call fcn.14010b1bc
mov rcx, qword [rax + 0x10]
mov qword [rbx + 0x190], rcx
mov rbx, qword [rbx + 0x198]
call fcn.14010b1bc
mov qword [rax + 0x18], rbx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dword [0x1403b95bc], 0x47
mov eax, 0x80010047
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov dword [0x1403b95bc], 0x60
mov eax, 0x80010060
add rsp, 0x20
pop rdi
ret
Function at 0x140026430
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x508]
sub rsp, 0x608
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov esi, r9d
mov rdi, r8
mov r12, rdx
mov r10, rcx
test rdx, rdx
je 0x140026612
mov ecx, dword [rbp + 0x560]
test ecx, ecx
je 0x140026492
dec ecx
jne 0x140026612
lea rdx, str.MISC
jmp 0x140026499
lea rdx, [0x1402dc4e0]
mov rax, qword [r10]
mov r9d, 0x104
lea r8, [rbp + 0x2e0]
mov rcx, r10
call qword [rax + 0x260]
test eax, eax
jne 0x140026635
lea r13, vtable.CBaseInfoOSEnv.0
mov qword [rsp + 0x30], r13
mov qword [rbp + 0xb8], 7
xor eax, eax
mov qword [rbp + 0xb0], rax
mov word [rbp + 0xa0], ax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x44], eax
xor r8d, r8d
lea rdx, [0x1402dc4e0]
lea rcx, [rbp + 0xa0]
call fcn.140001f40
nop
lea rax, vtable.CPDLInfoOSEnv.0
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.1400b9300
mov r8d, 0x104
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x30]
call fcn.1400b98f0
mov ebx, eax
mov qword [rsp + 0x30], r13
cmp qword [rbp + 0xb8], 8
jb 0x14002654b
mov rcx, qword [rbp + 0xa0]
call fcn.1401026ec
test ebx, ebx
jne 0x140026633
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400265dd
mov r8, r12
mov edx, 0x104
lea rcx, [rbp + 0x2e0]
call fcn.140246470
mov r8, r12
mov edx, 0x104
lea rcx, [rbp + 0xd0]
call fcn.140246470
xor r8d, r8d
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1400265dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x1400265dd
mov dword [0x1403b95bc], 0xc
mov eax, 0x8001000c
jmp 0x140026635
mov edx, 0x20
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test rdi, rdi
je 0x140026633
mov r8, rsi
xor edx, edx
mov rcx, rdi
call fcn.14024b970
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, esi
jbe 0x140026623
mov dword [0x1403b95bc], 1
mov eax, 0x80010001
jmp 0x140026635
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, ebx
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.140245660
add rsp, 0x608
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140026780
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x6a0
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x690], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x270]
xor edx, edx
mov r8d, 0x208
call fcn.14024b970
lea rcx, [rsp + 0x480]
xor edx, edx
mov r8d, 0x208
call fcn.14024b970
lea rcx, [rsp + 0x480]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [rsp + 0x480]
lea rdx, [0x1402e3988]
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400268f0
test byte [rsp + 0x20], 0x10
je 0x1400268a1
lea rdx, [0x1402e3994]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14002689a
lea rdx, [0x1402e3998]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14002689a
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x480]
lea rdx, [0x1402e3978]
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r11, qword [rbx]
lea rdx, [rsp + 0x270]
mov rcx, rbx
call qword [r11 + 0x310]
test byte [rsp + 0x20], 0x10
jne 0x1400268d1
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x480]
lea rdx, [0x1402e3978]
lea rcx, [rsp + 0x270]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140026830
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140027a60
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140027aa4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140245660
add rsp, 0x58
ret
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140027a90
mov rcx, qword [rsp + 0x30]
xor eax, eax
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140027a90
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140245660
add rsp, 0x58
ret
Function at 0x140027b20
Capabilities:
Compare security identifiers

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov word [rsp + 0x7c], 0x500
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x78], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x68]
lea edx, [rbx + 8]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140027b7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
sete bl
jmp 0x140027ccf
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
lea rax, [rsp + 0x60]
lea edx, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140027bbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140027bbd
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140027cd1
mov edx, dword [rsp + 0x60]
mov ecx, 0x40
mov qword [rsp + 0xb0], rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140027cbc
mov r9d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov r8, rdi
mov edx, 2
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140027cb3
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov r8d, 0x20
mov dl, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140027cb3
mov qword [rsp + 0xa8], rsi
mov esi, ebx
cmp dword [rdi], ebx
jbe 0x140027ca0
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xb8], r12
mov r12d, 1
lea rbp, [rdi + 8]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbp]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
cmovne ebx, r12d
inc esi
add rbp, 0x10
cmp esi, dword [rdi]
jb 0x140027c71
mov r12, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rsi, qword [rsp + 0xa8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0xb0]
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140245660
add rsp, 0x90
pop rbx
ret
Function at 0x140027cf0
Capabilities:
Delete directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xb48]
sub rsp, 0xc40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rbp + 0xb30], rax
lea rdi, vtable.CBaseInfoOSEnv.0
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0xc8], 7
xor ebx, ebx
mov qword [rbp + 0xc0], rbx
mov word [rbp + 0xb0], bx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x54], ebx
xor r8d, r8d
lea rdx, [0x1402dc4e0]
lea rcx, [rbp + 0xb0]
call fcn.140001f40
nop
lea rax, vtable.CPDLInfoOSEnv.0
mov qword [rsp + 0x40], rax
mov word [rbp + 0x710], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x712]
call fcn.14024b970
mov word [rbp + 0x2f0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x2f2]
call fcn.14024b970
mov word [rbp + 0x920], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x922]
call fcn.14024b970
mov word [rbp + 0xe0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0xe2]
call fcn.14024b970
mov word [rbp + 0x500], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x502]
call fcn.14024b970
lea r8, [rbp + 0xe0]
lea edx, [rbx + 0x26]
lea rcx, [rsp + 0x40]
call qword [method.CBaseInfoOSEnv.virtual_216]
lea r11, str.Canon_
mov qword [rsp + 0x28], r11
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [0x1402dd6b0]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0xe0]
call fcn.14024679c
lea r11, str.InstTemp_
mov qword [rsp + 0x28], r11
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [0x1402e3978]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0x710]
call fcn.14024679c
lea r11, str.InstRestore
mov qword [rsp + 0x28], r11
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, str._s_s_
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0x2f0]
call fcn.14024679c
lea r11, str.PrinterDriver_
mov qword [rsp + 0x28], r11
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [0x1402e3978]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0x920]
call fcn.14024679c
lea r11, [0x1402e3a88]
mov qword [rsp + 0x28], r11
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
lea r9, [0x1402e3978]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0x500]
call fcn.14024679c
lea rcx, [rbp + 0x710]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rbp + 0x500]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rbp + 0x920]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
mov qword [rsp + 0x40], rdi
cmp qword [rbp + 0xc8], 8
jb 0x140027f67
mov rcx, qword [rbp + 0xb0]
call fcn.1401026ec
mov eax, 1
mov rcx, qword [rbp + 0xb30]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0xc40]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140034e80
Capabilities:
Delete file
Set file attributes

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rsi
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rdx, str.CBaseDlgMgr::DestroyUSBWait
lea rcx, [rsp + 0x48]
call fcn.1400075a0
nop
xor ebx, ebx
test rsi, rsi
je 0x140034fab
cmp dword [rdi + 0xa0], ebx
je 0x140034ee2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x467
mov rcx, qword [rsi + 0x158]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0xc0]
mov rcx, qword [rdi + 0xb0]
test rcx, rcx
je 0x140034f05
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rdi + 0xb0], rbx
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx - 0x10], ebx
je 0x140034fba
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rdi + 0xa8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x78], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x409
mov r8d, edi
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x140034f99
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
lea r9, str._t_t_tDeleteFile__
lea r8, str.ApiName:__s__ErrorCode:__d_:__s
mov edx, 6
lea rcx, [rsp + 0x48]
call fcn.140007780
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140034fba
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140034fba
mov ebx, 0x80010001
mov dword [0x1403b95bc], 1
mov r9d, ebx
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x48]
call fcn.140007780
nop
lea rcx, [rsp + 0x48]
call fcn.140007730
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140035000
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rsi, rcx
xor r8d, r8d
lea rdx, str.CBaseDlgMgr::CreateSetupProgress
lea rcx, [rax - 0x38]
call fcn.1400075a0
nop
mov ecx, 0x750
call fcn.1401026a0
mov rdi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140035067
mov rdx, qword [rsi + 0x98]
mov rcx, rax
call fcn.140047b10
lea rax, vtable.CPDLDlgSetupProgress.0
mov qword [rdi], rax
xor ebx, ebx
jmp 0x14003506b
xor ebx, ebx
mov edi, ebx
mov qword [rsi + 0xb8], rdi
test rdi, rdi
je 0x1400350d5
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x140035120]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x88], rax
mov rax, qword [rsi + 0xb8]
cmp dword [rax + 0x2c8], 0
jne 0x1400350d5
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x32
jg 0x1400350d5
mov rax, qword [rsi + 0xb8]
cmp dword [rax + 0x2c8], 0
je 0x1400350b3
mov r9, qword [rsi + 0xb8]
lea r8, str.return___08x
mov edx, 2
lea rcx, [rsp + 0x40]
call fcn.140007780
mov rbx, qword [rsi + 0xb8]
lea rcx, [rsp + 0x40]
call fcn.140007730
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003d5e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov rax, qword [0x140398250]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
mov edx, 1
mov rdi, rcx
call fcn.1401104f8
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x420]
cmp dword [rsi + 8], 0xf
mov ebx, eax
jne 0x14003d6d3
mov rax, qword [rsi]
cmp rax, qword [rdi + 0x40]
je 0x14003d67e
cmp rax, qword [rdi + 0x3e8]
je 0x14003d67e
lea rcx, [rdi + 0x118]
call fcn.140118c7c
mov rcx, qword [rax + 0x40]
cmp qword [rsi], rcx
je 0x14003d67e
lea rcx, [rdi + 0x1f0]
call fcn.140118c7c
mov rcx, qword [rax + 0x40]
cmp qword [rsi], rcx
je 0x14003d67e
lea rcx, [rdi + 0x2c8]
call fcn.140118c7c
mov rcx, qword [rax + 0x40]
cmp qword [rsi], rcx
jne 0x14003d6d3
mov dword [rsp + 0x40], gethostbyaddr
test ebx, ebx
jne 0x14003d693
lea rcx, [rdi + 0x118]
jmp 0x14003d6ad
cmp ebx, 1
jne 0x14003d6a1
lea rcx, [rdi + 0x1f0]
jmp 0x14003d6ad
cmp ebx, 2
jne 0x14003d6b7
lea rcx, [rdi + 0x2c8]
lea rdx, [rsp + 0x40]
call fcn.14010e164
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x5c]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebp, ebp
mov rcx, rdi
movzx ebx, ax
xor eax, eax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov rax, qword [rdi]
call qword [rax + 0x420]
and ebx, 0x8000
mov r12d, eax
je 0x14003d7d9
cmp dword [rsi + 8], 0x100
jne 0x14003d7d9
cmp qword [rsi + 0x10], 9
jne 0x14003d7d9
lea ecx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r11d, ax
and r11d, 0x8000
test r12d, r12d
jne 0x14003d752
test r11d, r11d
setne bpl
lea r8, [rbp + 1]
jmp 0x14003d771
cmp r12d, 1
jne 0x14003d767
mov r8d, 2
test r11d, r11d
cmovne r8, rbp
jmp 0x14003d771
test r11d, r11d
setne bpl
mov r8, rbp
mov rcx, qword [rdi + 0x3e8]
xor r9d, r9d
mov edx, 0x130c
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, [rsp + 0x38]
mov edx, 0xbc4
mov rcx, rdi
call fcn.140116068
mov r11, qword [rsp + 0x38]
test r11, r11
je 0x14003d7d2
mov rcx, qword [rdi + 0x40]
lea r9, [rsp + 0x20]
mov edx, 0x4e
mov r8d, 0xbc4
mov dword [rsp + 0x30], 0xfffffdd9
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], 0xbc4
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x14003d7e4
mov rdx, rsi
mov rcx, rdi
call fcn.1401167f0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140245660
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret