joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029be0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
call fcn.1400021b0
mov rcx, rax
test rax, rax
je 0x140029db9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x29], rax
call fcn.1400021b0
mov rcx, rax
test rax, rax
je 0x140029dc4
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x21], rbx
call fcn.14000a450
cmp al, 1
je 0x140029c9e
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029c66
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140029c81
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140070140
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
lea rdx, str.AMD_Cleanup_Utility_cannot_complete_while_Windows_Update_is_running._Please_finish_or_exit_Windows_Update_and_re_launch_AMD_Cleanup_Utility.
lea rcx, [rbp - 0x29]
call fcn.140041c90
lea rdx, [0x1400bebc0]
lea rcx, [rbp - 0x21]
call fcn.140041c90
lea rcx, [0x1400e0e10]
call fcn.1400024e0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140029d8d
lea rcx, [rbp + 7]
call fcn.1400025a0
nop
lea rcx, [rbp - 0x19]
call fcn.1400025a0
nop
lea r8, [rbp + 7]
mov edx, MsiSetPropertyW
lea rcx, [rbp + 0x27]
call fcn.14002e550
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.140014c20
lea rcx, [rbp + 0x27]
call fcn.1400024f0
lea r8, [rbp - 0x19]
mov edx, 0x7e
lea rcx, [rbp + 0x27]
call fcn.14002e550
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.140014c20
lea rcx, [rbp + 0x27]
call fcn.1400024f0
lea rcx, [rbp - 0x29]
call fcn.14003e9b0
lea rcx, [rbp + 7]
call fcn.1400024e0
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.14003e930
lea rcx, [rbp - 0x21]
call fcn.14003e9b0
lea rcx, [rbp - 0x19]
call fcn.1400024e0
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.14003e930
nop
lea rcx, [rbp - 0x19]
call fcn.1400024f0
nop
lea rcx, [rbp + 7]
call fcn.1400024f0
lea rcx, [rbp - 0x21]
call fcn.14003ea30
mov r8, rax
lea rcx, [rbp - 0x29]
call fcn.14003ea30
mov rdx, rax
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call fcn.1400839e8
nop
mov ecx, 0x80004005
call fcn.1400277b0
nop
mov ecx, 0x80004005
call fcn.1400277b0
int3
Function at 0x14002bac0
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [0x1400e50c0]
lea r9, [0x14003a2d0]
xor r8d, r8d
mov edx, 0x87
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rcx, qword [0x1400e50c0]
mov edx, 0x6b
mov qword [rbx + 0x448], rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov rcx, qword [rbx + 0x448]
mov edx, 0x80
mov r9, rax
lea r8d, [rdx - 0x7f]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x448]
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
jne 0x14002bb4a
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rbx + 0x448]
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_CopyRect]
mov r8d, dword [rsp + 0x54]
lea rcx, [rsp + 0x50]
mov edx, dword [rsp + 0x50]
neg r8d
neg edx
call qword [sym.imp.USER32.dll_OffsetRect]
mov r8d, dword [rsp + 0x44]
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x40]
neg r8d
neg edx
call qword [sym.imp.USER32.dll_OffsetRect]
mov r8d, dword [rsp + 0x5c]
lea rcx, [rsp + 0x40]
mov edx, dword [rsp + 0x58]
neg r8d
neg edx
call qword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [rsp + 0x4c]
mov rcx, qword [rbx + 0x448]
cdq
sub eax, edx
mov dword [rsp + 0x30], 1
sar eax, 1
mov r9d, eax
mov dword [rsp + 0x28], 0
mov eax, dword [rsp + 0x48]
add r9d, dword [rsp + 0x64]
cdq
sub eax, edx
mov dword [rsp + 0x20], 0
sar eax, 1
xor edx, edx
add eax, dword [rsp + 0x60]
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rbx + 0x448]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140070140
add rsp, 0x80
pop rbx
ret
Function at 0x140039d70
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140039dfd
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor eax, eax
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140039dfd
mov edx, 0x80000001
lea ecx, [rax + 6]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140070140
add rsp, 0x58
ret
Function at 0x14003bb60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], r8
xorps xmm0, xmm0
movups xmmword [rcx + 0x10], xmm0
mov byte [rcx + 0x20], 0
mov ecx, 0x18
call fcn.1400703c8
mov qword [rax], rdi
mov qword [rax + 8], rbx
lea rcx, [0x14003b020]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x140046230]
xor edx, edx
xor ecx, ecx
call fcn.140081e60
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003bbfa
cmp dword [rbx + 0x18], edi
jne 0x14003bbf4
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rbx + 0x10], xmm0
jmp 0x14003bbe6
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.1400824f0
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call fcn.14006d898
int3

Function at 0x14003c4f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14003c521
xor eax, eax
jmp 0x14003c66f
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14003c55e
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14003c55e
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14003c66f
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14003c664
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14003c5a5
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14003c5ce
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140084264
cmp ax, di
je 0x14003c664
movzx edi, si
jmp 0x14003c664
lea r8, [rsp + 0x48]
mov word [rsp + 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x42]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x38]
test eax, eax
je 0x14003c624
sub eax, 1
je 0x14003c624
cmp eax, 2
jne 0x14003c664
movzx ecx, word [rsp + 0x40]
jmp 0x14003c5b1
mov rbp, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14003c651
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.140085bbc
cmp rbp, rax
jne 0x14003c664
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x50], rax
movzx eax, si
jne 0x14003c667
movzx eax, di
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140070140
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140040000
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400400d4
cmp byte [rcx + 0x72], 0
je 0x1400400d4
mov rax, qword [rcx]
mov qword [rsp + 0x78], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x1400400d0
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140040096
sub eax, 1
je 0x14004009a
cmp eax, 2
jne 0x1400400d0
mov byte [rbx + 0x72], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140070140
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400400c7
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140085bbc
cmp rdi, rax
jne 0x1400400d0
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14004007e
xor al, al
jmp 0x14004007e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140070140
add rsp, 0x60
pop rbx
ret
Function at 0x1400440b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, r8d
mov rsi, rdx
shr eax, 4
mov edi, r8d
inc ax
mov r14, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
je 0x1400441d3
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400441d3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400441d3
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140044159
nop word [rax + rax]
cmp rbx, rcx
jae 0x1400441d3
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140044140
cmp rbx, rcx
jae 0x1400441d3
movzx edi, word [rbx]
test di, di
je 0x1400441d3
mov r10, qword [r14]
mov ecx, 1
movzx edx, di
mov eax, dword [r10 - 0xc]
sub ecx, dword [r10 - 8]
sub eax, edi
or ecx, eax
jge 0x14004418f
mov edx, edi
mov rcx, r14
call fcn.1400419f0
mov r10, qword [r14]
movzx edx, word [rbx]
movzx r9d, dx
lea r8, [rbx + 2]
mov rdx, rdi
mov rcx, r10
call fcn.140083f34
test eax, eax
je 0x1400441ba
cmp eax, 0xc
je 0x140044206
cmp eax, 0x16
je 0x1400441f0
cmp eax, 0x22
je 0x1400441f0
cmp eax, 0x50
jne 0x1400441fb
mov rcx, qword [r14]
cmp edi, dword [rcx - 0xc]
jg 0x1400441f0
mov dword [rcx - 0x10], edi
xor edx, edx
mov rcx, qword [r14]
lea eax, [rdx + 1]
mov word [rcx + rdi*2], dx
jmp 0x1400441d5
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, 0x80070057
call fcn.1400277b0
int3
mov ecx, 0x80004005
call fcn.1400277b0
int3
mov ecx, 0x8007000e
call fcn.1400277b0
int3
Function at 0x140048f30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov rbx, rdx
mov qword [rsp + 0x20], rdx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x370]
call fcn.140072740
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x160]
call fcn.140072740
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.140072740
xor r9d, r9d
lea r8d, [r9 + 0x25]
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea r8, [rbp + 0x160]
mov edx, 0x104
lea rcx, [rbp + 0x370]
call fcn.140082408
lea r8, str.msiexec.exe
mov edx, 0x104
lea rcx, [rbp + 0x370]
call fcn.140082470
lea r8, [rbp + 0x370]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140082408
lea r8, [0x1400c3608]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140082470
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x140049021
mov r8, qword [rbx]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140082470
lea r8, str.__qn
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140082470
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rax, [rbp + 0x160]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], si
jne 0x140049070
lea rdx, [rbp + 0x160]
lea rcx, [rsp + 0x28]
call fcn.1400027d0
nop
mov r9b, 1
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x50]
call fcn.140049160
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x1400490df
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400490d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049153
call fcn.140070654
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14004911a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140049115
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140049159
mov rcx, r8
call fcn.140070654
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov eax, edi
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.140070140
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14007d0fc
nop
call fcn.14007d0fc
int3
Function at 0x140049160
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp], rax
movzx esi, r9b
mov rdi, r8
mov rbx, rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x2c], eax
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r14w
lea r8d, [rax + 0xc]
lea rdx, str.cmd.exe__C__
lea rcx, [rbp - 0x20]
call fcn.1400027d0
nop
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140049200
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140014b80
mov r8d, 1
lea rdx, [0x1400bf9d8]
mov rcx, rax
call fcn.140014b80
cmp qword [rdi + 0x18], 8
jb 0x140049236
mov rdi, qword [rdi]
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400492c7
test sil, sil
je 0x140049296
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x50], r14d
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x50]
jmp 0x1400492e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov r8d, eax
mov rdx, rbx
lea rcx, str.Failed_Applications_uninstall_:_cmd:__s__error_code_t:_t_d
call fcn.140026280
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14004931e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049319
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049344
call fcn.140070654
mov eax, edi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140070140
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.14007d0fc
int3
Function at 0x140055c80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, r9
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAMD_Catalyst_Install_Manager
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055d63
xor edx, edx
mov dword [rsp + 0x3c], 1
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140072740
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x38], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.InstallDir
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140055d5d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140055d41
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400027d0
mov al, 1
jmp 0x140055d65
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140070140
add rsp, 0x260
pop rbx
ret
Function at 0x140055d80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor r15d, r15d
mov word [rbp - 0x80], r15w
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140055e07
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rbx], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
xor r8d, r8d
lea rdx, [0x1400bc2c0]
mov rcx, rbx
call fcn.1400027d0
jmp 0x140055f76
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r15w
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], 7
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140055e40
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.1400027d0
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140055e9b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055e96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055fa5
call fcn.140070654
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x68], xmm1
lea rcx, [rsp + 0x58]
movq rsi, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
cmp r14, 8
cmovae rcx, rsi
mov qword [rsp + 0x20], 1
lea r9, [0x1400bc204]
movq rdi, xmm1
mov rdx, rdi
call fcn.140017560
cmp rax, 0xffffffffffffffff
je 0x140055f65
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], 7
lea r8, [rax + 1]
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rsp + 0x58]
cmp r14, 8
cmovae rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1400027d0
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140055f65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055f60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055fa5
call fcn.140070654
movups xmm1, xmmword [rsp + 0x38]
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rbx], xmm1
movups xmmword [rbx + 0x10], xmm0
mov rax, rbx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140070140
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14007d0fc
nop
int3
Function at 0x14006ab90
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rsi, rdx
mov qword [rsp + 0x48], rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rdx], r15
mov qword [rdx + 8], r15
lea ecx, [r15 + 0x18]
call fcn.1400703c8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsi], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r15
lea ecx, [r15 + 0x30]
call fcn.1400703c8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x60]
call fcn.140072740
mov edx, 0x104
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14006ac53
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.1400027d0
nop
mov r8d, 4
lea rdx, str.INF
lea rcx, [rbp - 0x80]
call fcn.140014b80
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140009a20
mov rdx, qword [rsp + 0x20]
cmp qword [rsp + 0x28], 0
je 0x14006ad3e
mov rbx, qword [rdx]
cmp rbx, rdx
je 0x14006ad3e
movabs r12, 0xaaaaaaaaaaaaaaa
nop word [rax + rax]
mov ecx, 0xd0
call fcn.1400703c8
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400025c0
mov rdx, rax
mov rcx, rdi
call fcn.140067880
mov r14, rax
mov rdi, qword [rsi]
cmp qword [rsi + 8], r12
je 0x14006add2
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r15
mov ecx, 0x18
call fcn.1400703c8
mov qword [rax + 0x10], r14
inc qword [rsi + 8]
mov rcx, qword [rdi + 8]
mov qword [rax], rdi
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], r15
mov qword [rdi + 8], rax
mov qword [rcx], rax
mov rax, qword [rbx]
mov rbx, rax
mov rdx, qword [rsp + 0x20]
cmp rax, rdx
jne 0x14006acc0
mov rax, qword [rbp - 0x68]
cmp rax, 8
jb 0x14006ad7f
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ad75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006addf
call fcn.140070654
mov rdx, qword [rsp + 0x20]
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
call fcn.140017d10
mov edx, 0x30
mov rcx, qword [rsp + 0x20]
call fcn.140070654
mov rax, rsi
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140070140
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
lea rcx, str.list_too_long
call fcn.14006ca70
nop
call fcn.14007d0fc
int3