joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469860
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x400]
sub rsp, 0x500
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.00424830
mov r8, qword [rbx + 0xa8]
lea rdx, str.__s_s___install
xor eax, eax
mov dword [rbp - 0xc], 0x200
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x20]
lea rax, [rbp - 8]
xorps xmm0, xmm0
mov qword [rbp - 0x18], rax
lea r9, [r8 + 0x4a4]
lea rax, [0x0048e198]
xor edi, edi
add r8, 0x29c
mov qword [rbp - 0x20], rax
movups xmmword [rsp + 0x50], xmm0
mov dword [rbp - 0x10], edi
mov word [rbp - 8], di
call fcn.004012e8
mov rdx, qword [rbp - 0x18]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x46992d
lea rdx, str.Install_Fail_Start_Program
jmp 0x469967
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x46994d
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x46995d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, 1
lea rdx, str.Install_Executed
lea rcx, [0x004dbde0]
call fcn.0044c458
lea r11, [rsp + 0x500]
mov al, dil
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x46a268
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x360]
sub rsp, 0x460
xor ebx, ebx
lea rax, [rsp + 0x38]
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea rcx, [0x0048d7e0]
mov dword [rsp + 0x30], ebx
mov r8d, 0x104
mov qword [rsp + 0x20], rcx
lea rax, [rbp + 0x158]
mov qword [rbp + 0x140], rcx
xor ecx, ecx
mov qword [rbp + 0x148], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x34], r8d
mov word [rsp + 0x38], bx
mov dword [rbp + 0x150], ebx
mov dword [rbp + 0x154], r8d
mov word [rbp + 0x158], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x46a300
mov edx, dword [rsp + 0x34]
call fcn.004293f8
mov dword [rsp + 0x30], eax
jmp 0x46a304
mov dword [rsp + 0x30], ebx
mov r8, qword [rdi + 0xa8]
lea rdx, str._suninstall.exe
add r8, 0x29c
lea rcx, [rbp + 0x140]
call fcn.004012e8
mov rdx, qword [rbp + 0x148]
xor r8d, r8d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x46a34f
lea rdx, [rbp + 0x140]
mov rcx, rdi
mov bl, 1
call fcn.00469de0
lea r11, [rsp + 0x460]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x46a6c4
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x480
mov r8, qword [rcx + 0xa8]
mov rsi, rcx
mov eax, dword [r8 + 8]
dec eax
test eax, 0xfffffff6
je 0x46a924
lea rax, [rsp + 0x68]
mov dword [rsp + 0x64], 0x104
mov qword [rsp + 0x58], rax
lea rdx, str._sConfig_
lea rax, [0x0048d7e0]
xor r15d, r15d
add r8, 0x29c
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x60], r15d
mov word [rsp + 0x68], r15w
call fcn.004012e8
lea rcx, [rsp + 0x50]
call fcn.00415a54
mov r8, qword [rsi + 0xa8]
lea r13, [0x00486230]
or r12, 0xffffffffffffffff
mov qword [rsp + 0x40], r13
add r8, 0x29c
mov qword [rsp + 0x48], r12
lea rdx, str._sConfig_terminal.lic
mov r14b, r15b
lea rcx, [rsp + 0x50]
call fcn.004012e8
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
cmp rcx, r12
je 0x46a7a4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
je 0x46a7db
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov qword [rsp + 0x48], rax
cmp rcx, r12
je 0x46a8f7
mov rbx, qword [rsi + 0xb0]
cmp word [rbx + 0x1e], r15w
je 0x46a8ca
movzx eax, word [rbx + 0x1e]
cmp eax, dword [rbx + 0x70]
jne 0x46a8ca
lea rdx, [rbx + 8]
mov dword [rbp + 0x3b0], r15d
test rdx, rdx
je 0x46a8ca
lea r9, [rbp + 0x3b0]
mov qword [rsp + 0x20], r15
mov r8d, 0x58
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb ecx, ecx
and ecx, dword [rbp + 0x3b0]
mov dword [rbp + 0x3b0], ecx
cmp ecx, 0x58
jne 0x46a8ca
mov edi, r15d
cmp dword [rbx + 0x70], r15d
jbe 0x46a870
mov ecx, edi
lea rdx, [rsp + 0x40]
shl rcx, 4
add rcx, qword [rbx + 0x68]
call fcn.0041c430
test al, al
je 0x46a8ca
inc edi
cmp edi, dword [rbx + 0x70]
jb 0x46a851
mov r8, qword [rsp + 0x58]
lea rbx, [rsi + 0x8f0]
mov r14b, 1
test r8, r8
je 0x46a898
mov r9, r12
lea rcx, [rbp + 0x170]
mov edx, 0x104
call fcn.00435528
mov edx, dword [rbx + 0x18]
mov rcx, rbx
inc edx
call fcn.00403cbc
test al, al
je 0x46a8dd
mov eax, dword [rbx + 0x20]
lea rdx, [rbp + 0x170]
mov r8d, eax
imul eax, dword [rbx + 0x18]
mov ecx, eax
add rcx, qword [rbx + 0x10]
call fcn.00424180
inc dword [rbx + 0x18]
jmp 0x46a8dd
lea rdx, str.Install_Fail_License_Extract
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x46a90f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
mov qword [rsp + 0x48], rcx
jmp 0x46a90f
lea rdx, str.Install_Fail_License_Open
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], r13
cmp rcx, r12
je 0x46a91f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, r14b
jmp 0x46a926
mov al, 1
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x46bd48
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x430
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rcx, qword [rbx + 0xa8]
mov esi, 0x29c
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46bd8e
mov rdx, qword [rbx + 0xa8]
add rdx, rsi
call fcn.004791d8
mov rdx, qword [rbx + 0xa8]
add rdx, rsi
call fcn.0046206c
xor edi, edi
test eax, eax
je 0x46bdb6
mov rcx, qword [rbx + 0xa8]
add rcx, rsi
call fcn.00413960
test al, al
jne 0x46be02
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x46be02
mov rcx, qword [rbx + 0xa8]
lea r9, [rsp + 0x30]
lea r8, [0x00491de8]
mov edx, 0x103
lea rax, [rcx + 0x94]
add rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.0041c82c
mov rdx, qword [rbx + 0xa8]
add rdx, rsi
call fcn.0046206c
test eax, eax
je 0x46bedd
mov rdx, qword [rbx + 0xb8]
mov rcx, rbx
call fcn.0046b008
test al, al
jne 0x46be50
lea rdx, str.Install_Fail_Extract_Core
lea rcx, [0x004dbde0]
call fcn.0044c458
lea rcx, [rbx + 0x4778]
call fcn.00478200
jmp 0x46bef0
mov rcx, rbx
call fcn.0046a6c4
test al, al
je 0x46bef0
mov rcx, rbx
call fcn.0046b1dc
mov byte [rbx + 0x84a2], al
test al, al
je 0x46bef0
mov rcx, rbx
call fcn.0046b16c
test al, al
je 0x46bef0
mov rcx, rbx
call fcn.0046a36c
test al, al
jne 0x46be9d
lea rdx, str.Install_Fail_Create_Shortcut
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, rbx
call fcn.0046a268
test al, al
jne 0x46bebc
lea rdx, str.Install_Fail_Create_Uninstall
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, rbx
call fcn.00469994
mov rcx, rbx
call fcn.00469860
test al, al
je 0x46bef0
mov rcx, rbx
call fcn.0046b8f8
mov dil, 1
jmp 0x46bf06
lea rdx, str.Install_Fail_Create_Folder
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov edx, 0x464
lea r8d, [r9 + 7]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r11, [rsp + 0x430]
mov al, dil
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x46bf70
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov bl, dl
mov rdi, rcx
add rcx, 0x4778
mov dl, 1
call fcn.00477e94
mov rcx, rdi
call fcn.0046c030
test bl, bl
je 0x46bff0
mov byte [rdi + 0x84a0], 1
mov dword [rdi + 0x818c], 3
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 2
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, 4
xor r8d, r8d
mov rcx, rax
mov edx, 0x470
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46c01c
mov rcx, qword [rdi + 0x8560]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.0046cff8
and dword [rdi + 0x818c], 0
mov word [rdi + 0x84a0], 0x100
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x46cd14
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 0x3023
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x3024
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
and dword [rdi + 0x8188], 0
cmp qword [rdi + 0x8180], 0
mov dword [rdi + 0x818c], 1
jne 0x46cd98
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov edx, 0x5ba0
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rdi + 0x8180], rax
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x46df18
Capabilities:
Check for software breakpoints
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r13, rcx
movzx edx, dx
mov rcx, qword [0x004b9cd0]
lea r8, [0x004983e0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x46def0
mov rcx, qword [0x004b9cc8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp eax, 0x32
jbe 0x46def0
mov rcx, qword [0x004b9cc8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x46def0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x46def0
mov r14d, esi
lea eax, [rbx + 2]
shr r14, 1
mov r15d, esi
lea rcx, [r14 + 1]
mul rcx
lea rcx, [rbx - 1]
lea rdx, [0x0047b0a0]
cmovo rax, rcx
mov rcx, rax
call fcn.0042267c
mov rsi, rax
test rax, rax
je 0x46dee3
lea r8, [r15 - 2]
mov rcx, rax
lea rdx, [rbp + 2]
call fcn.00424180
mov word [rsi + r14*2 - 4], bx
mov rdx, rsi
mov rcx, qword [r13 + 0xb8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rsi
call fcn.00422660
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, bl
jmp 0x46def2
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.0045f2c0
mov rdx, qword [rbx + 0xa8]
lea r11, [0x004b9a10]
xor r8d, r8d
mov r10d, eax
mov r9d, 0x68
mov ecx, dword [rdx + 8]
xor edx, edx
cmp dword [rdx + r11], ecx
jne 0x46df59
mov eax, dword [rdx + r11 + 4]
cmp eax, r10d
je 0x46df6b
test eax, eax
je 0x46df6b
inc r8
add rdx, 0xc
cmp rdx, 0xcc
jae 0x46df74
jmp 0x46df45
lea rax, [r8 + r8*2]
mov r9d, dword [r11 + rax*4 + 8]
mov edx, r9d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x46ddf4
Function at 0x46e944
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0xb80]
sub rsp, 0xc80
xor r14d, r14d
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rbp + 0xbb8], r14
lea rcx, [rsp + 0x40]
mov qword [rbp + 0xbb0], r14
mov r8d, 0x208
call fcn.00424830
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.00424830
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x820
call fcn.00424830
test rdi, rdi
je 0x46e9cd
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov r8, rdi
mov edx, 0x103
call fcn.00435528
lea rdx, [0x00498428]
lea rcx, [rsp + 0x40]
call fcn.00423b70
test rax, rax
je 0x46eaad
lea rcx, [rsp + 0x40]
sub rax, rcx
sar rax, 1
cmp eax, 1
jne 0x46eaad
lea r9, [rbp + 0xbb0]
mov word [rsp + 0x44], r14w
lea r8, [rbp + 0xbb8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x46ea5e
mov r9d, 0x104
lea r8, [rbp + 0x150]
lea edx, [rax + 0x23]
call fcn.0045f794
lea r9, [rsp + 0x40]
mov edx, 0x40f
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0x360]
call fcn.0041c82c
lea rdx, [rbp + 0x360]
jmp 0x46eacb
cmp qword [rbp + 0xbb0], 0x3200000
jae 0x46eaa9
mov r9d, 0x104
lea r8, [rbp + 0x150]
mov edx, select
call fcn.0045f794
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0x32
lea r8, [rbp + 0x150]
mov edx, 0x40f
lea rcx, [rbp + 0x360]
call fcn.0041c82c
jmp 0x46ea55
mov al, 1
jmp 0x46eaeb
mov r9d, 0x104
lea r8, [rbp + 0x150]
mov edx, 0x1e
call fcn.0045f794
lea rdx, [rbp + 0x150]
mov r8, qword [rbx + 0xa8]
mov r9d, 0x30
mov rcx, qword [rbx + 8]
add r8, 0x94
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
mov rbx, qword [rsp + 0xca0]
add rsp, 0xc80
pop r14
pop rdi
pop rbp
ret
Function at 0x46ed00
Capabilities:
Get common file path
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x20], r9
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
and qword [rsp + 0x30], 0
mov rdi, rcx
and dword [rsp + 0x44], 0
lea rcx, [rsp + 0x60]
and qword [rsp + 0x58], 0
mov ebx, 0x208
and qword [rbp + 0x3a8], 0
mov r8d, ebx
xor edx, edx
call fcn.00424830
mov r8d, ebx
lea rcx, [rbp + 0x170]
xor edx, edx
call fcn.00424830
mov rcx, qword [rdi + 8]
lea r8, [rbp + 0x3a8]
mov edx, select
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x46ee49
cmp qword [rbp + 0x3a8], 0
je 0x46ee49
mov r9d, 0x103
lea r8, [rbp + 0x170]
mov edx, 0x39
call fcn.0045f794
mov rcx, qword [rdi + 0xb8]
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rax, [rbp + 0x170]
mov dword [rsp + 0x40], 0x8047
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
lea rax, [0x0046e8ac]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov rbx, rax
test rax, rax
je 0x46ee35
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rdi + 0xb8]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 1
jmp 0x46ee4b
xor eax, eax
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x46ee68
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xb60]
sub rsp, 0xc60
mov rbx, rcx
mov edi, 0x208
mov r8d, edi
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.00424830
mov r8d, edi
lea rcx, [rbp + 0x130]
xor edx, edx
call fcn.00424830
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x820
call fcn.00424830
mov rcx, qword [rbx + 0x338]
lea rdx, [rbp + 0x340]
mov r8d, 0x410
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rbp + 0x130]
mov rcx, rbx
lea rdx, [rbp + 0x340]
call fcn.0046eb08
mov rcx, qword [rbx + 0x338]
test al, al
jne 0x46ef06
call qword [sym.imp.USER32.dll_SetFocus]
xor al, al
jmp 0x46efeb
lea rdx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0xa8]
or rdi, 0xffffffffffffffff
add rcx, 0x6ac
je 0x46ef3b
mov r9, rdi
lea r8, [rbp + 0x130]
mov edx, 0x104
call fcn.00435528
mov rcx, qword [rbx + 0xb8]
lea rdx, [rbp + 0x340]
mov r8d, 0x410
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rbp + 0x340]
call fcn.0046eb08
mov rcx, qword [rbx + 0xb8]
test al, al
je 0x46eef9
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.0046e944
test al, al
jne 0x46ef9c
mov rcx, qword [rbx + 0xb8]
jmp 0x46eef9
mov rcx, qword [rbx + 0xa8]
add rcx, 0x29c
je 0x46efbe
mov r9, rdi
lea r8, [rsp + 0x20]
mov edx, 0x104
call fcn.00435528
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0xa8]
test eax, eax
je 0x46efe6
or dword [rcx], 4
jmp 0x46efe9
and dword [rcx], 0xfffffffb
mov al, 1
lea r11, [rsp + 0xc60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x46f160
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x368]
sub rsp, 0x460
xor r14d, r14d
lea rax, [rsp + 0x38]
mov rbx, rcx
mov qword [rsp + 0x28], rax
mov edx, 0x104
mov dword [rsp + 0x30], r14d
lea rcx, [0x0048d7e0]
mov dword [rsp + 0x34], edx
lea rax, [rbp + 0x158]
mov word [rsp + 0x38], r14w
lea rsi, [rbx + 0xb0]
mov qword [rsp + 0x20], rcx
lea rdi, [rbx + 0xa8]
mov qword [rbp + 0x148], rax
mov dword [rbp + 0x150], r14d
mov dword [rbp + 0x154], edx
mov word [rbp + 0x158], r14w
mov qword [rbp + 0x140], rcx
cmp qword [rsi + 8], r14
jne 0x46f211
mov rax, rdi
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0045d87c
lea rsi, [rbx + 0x330]
cmp qword [rsi + 8], r14
jne 0x46f244
mov rax, rdi
mov edx, 0x106
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0045d87c
lea rsi, [rbx + 0x5b0]
cmp qword [rsi + 8], r14
jne 0x46f277
mov rax, rdi
mov edx, VarUI4FromDisp
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0041abb8
lea rsi, [rbx + 0x5f8]
cmp qword [rsi + 8], r14
jne 0x46f2aa
mov rax, rdi
mov edx, VarUI4FromDisp
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0041abb8
mov rdx, qword [rbx + 8]
mov r8d, 7
call fcn.0045f04c
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rbx + 0x600]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x46f2f1
mov edx, dword [rsp + 0x34]
mov rcx, rax
call fcn.004293f8
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x28]
jmp 0x46f2f6
mov dword [rsp + 0x30], r14d
mov r8, qword [rdi]
lea rcx, [rbp + 0x140]
add r8, 0x94
mov rdx, rax
call fcn.004012e8
mov rdx, qword [rbp + 0x148]
mov rcx, qword [rbx + 0x600]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rdi]
mov rcx, qword [rbx + 0xb8]
add rdx, 0x29c
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rdi]
mov rcx, qword [rbx + 0x338]
add rdx, 0x6ac
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rax, qword [rdi]
xor r9d, r9d
mov rcx, qword [rbx + 0x5b8]
mov edx, 0xf1
mov r8d, dword [rax]
shr r8, 2
and r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0x460]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x46f694
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x560]
sub rsp, 0x660
xor r14d, r14d
mov dword [rsp + 0x54], 0x104
mov r9d, edx
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x58]
mov word [rsp + 0x58], r14w
mov qword [rsp + 0x48], rax
mov esi, edx
lea rax, [0x0048d7e0]
mov qword [rbp + 0x580], r14
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rax, [rbp + 0x580]
mov rbx, rcx
or r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov edi, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46f818
xor edx, edx
mov rcx, qword [rbp + 0x580]
lea r9, [rbp + 0x588]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x160]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x588], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46f80b
cmp dword [rbp + 0x588], r14d
jbe 0x46f80b
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x200
call fcn.00424830
lea r8, [rbp + 0x160]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
lea rcx, [rsp + 0x40]
call fcn.004012e8
mov rdx, qword [rsp + 0x48]
lea r9, [rbp + 0x360]
lea r8, str.InstallLocation
mov dword [rsp + 0x28], esi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], 0x1fe
call fcn.00404704
test al, al
je 0x46f7e3
mov rdx, qword [0x004b9088]
lea rcx, [rbp + 0x360]
call fcn.004373a8
test eax, eax
je 0x46f7ec
inc edi
mov edx, edi
jmp 0x46f723
mov rcx, qword [rbx + 0xa8]
lea r8, [rbp + 0x160]
add rcx, 0x418
mov edx, 0x104
call fcn.0042e77c
mov rcx, qword [rbp + 0x580]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbx + 0xa8]
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
cmp word [rax + 0x418], r14w
setne al
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x46fb58
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x248
mov r8, qword [rcx + 0xa8]
xor ecx, ecx
add r8, 0x418
cmp word [r8], cx
je 0x46fbe3
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
lea rax, [0x0048d7e0]
mov word [rsp + 0x38], cx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x104
call fcn.004012e8
mov rdx, qword [rsp + 0x28]
xor r9d, r9d
mov r8d, 0x20206
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov rdx, qword [rsp + 0x28]
xor r9d, r9d
mov r8d, 0x20106
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x248
ret

Function at 0x46fbf4
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x398]
sub rsp, 0x490
xor r14d, r14d
mov dword [rsp + 0x34], 0x104
mov dword [rsp + 0x30], r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [0x0048d7e0]
mov qword [rsp + 0x20], rax
mov rdi, rdx
mov word [rsp + 0x38], r14w
mov rsi, rcx
test rdx, rdx
je 0x46fce3
mov r8, rdx
lea rcx, [rsp + 0x20]
lea rdx, str._s.
call fcn.004012e8
mov rcx, qword [rsp + 0x28]
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x46fce3
test byte [rbp + 0x140], 0x10
je 0x46fcc6
cmp word [rbp + 0x16c], 0x2e
je 0x46fcc6
lea r9, [rbp + 0x16c]
mov r8, rdi
lea rdx, [0x00491de8]
lea rcx, [rsp + 0x20]
call fcn.004012e8
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.0046fbf4
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, [rbp + 0x140]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46fc80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret