joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46be1c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x430
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rcx, qword [rbx + 0xa8]
mov esi, 0x29c
add rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46be62
mov rdx, qword [rbx + 0xa8]
add rdx, rsi
call fcn.004792dc
mov rdx, qword [rbx + 0xa8]
add rdx, rsi
call fcn.00462140
xor edi, edi
test eax, eax
je 0x46be8a
mov rcx, qword [rbx + 0xa8]
add rcx, rsi
call fcn.00413960
test al, al
jne 0x46bed6
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x46bed6
mov rcx, qword [rbx + 0xa8]
lea r9, [rsp + 0x30]
lea r8, [0x00491de8]
mov edx, 0x103
lea rax, [rcx + 0x94]
add rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.0041c82c
mov rdx, qword [rbx + 0xa8]
add rdx, rsi
call fcn.00462140
test eax, eax
je 0x46bfb1
mov rdx, qword [rbx + 0xb8]
mov rcx, rbx
call fcn.0046b0dc
test al, al
jne 0x46bf24
lea rdx, str.Install_Fail_Extract_Core
lea rcx, [0x004dbde0]
call fcn.0044c458
lea rcx, [rbx + 0x4778]
call fcn.00478304
jmp 0x46bfc4
mov rcx, rbx
call fcn.0046a798
test al, al
je 0x46bfc4
mov rcx, rbx
call fcn.0046b2b0
mov byte [rbx + 0x84a2], al
test al, al
je 0x46bfc4
mov rcx, rbx
call fcn.0046b240
test al, al
je 0x46bfc4
mov rcx, rbx
call fcn.0046a440
test al, al
jne 0x46bf71
lea rdx, str.Install_Fail_Create_Shortcut
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, rbx
call fcn.0046a33c
test al, al
jne 0x46bf90
lea rdx, str.Install_Fail_Create_Uninstall
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, rbx
call fcn.00469a68
mov rcx, rbx
call fcn.00469934
test al, al
je 0x46bfc4
mov rcx, rbx
call fcn.0046b9cc
mov dil, 1
jmp 0x46bfda
lea rdx, str.Install_Fail_Create_Folder
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov edx, 0x464
lea r8d, [r9 + 7]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r11, [rsp + 0x430]
mov al, dil
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x46c044
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov bl, dl
mov rdi, rcx
add rcx, 0x4778
mov dl, 1
call fcn.00477f98
mov rcx, rdi
call fcn.0046c104
test bl, bl
je 0x46c0c4
mov byte [rdi + 0x84a0], 1
mov dword [rdi + 0x818c], 3
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 2
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov r9d, 4
xor r8d, r8d
mov rcx, rax
mov edx, 0x470
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x46c0f0
mov rcx, qword [rdi + 0x8560]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.0046d0cc
and dword [rdi + 0x818c], 0
mov word [rdi + 0x84a0], 0x100
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x46cde8
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov edx, 0x3023
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x3024
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
and dword [rdi + 0x8188], 0
cmp qword [rdi + 0x8180], 0
mov dword [rdi + 0x818c], 1
jne 0x46ce6c
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov edx, 0x5ba0
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rdi + 0x8180], rax
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x46dfec
Capabilities:
Check for software breakpoints
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r13, rcx
movzx edx, dx
mov rcx, qword [0x004b9cd0]
lea r8, [0x004983e0]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x46dfc4
mov rcx, qword [0x004b9cc8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp eax, 0x32
jbe 0x46dfc4
mov rcx, qword [0x004b9cc8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x46dfc4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
test rax, rax
je 0x46dfc4
mov r14d, esi
lea eax, [rbx + 2]
shr r14, 1
mov r15d, esi
lea rcx, [r14 + 1]
mul rcx
lea rcx, [rbx - 1]
lea rdx, [0x0047b0a0]
cmovo rax, rcx
mov rcx, rax
call fcn.0042267c
mov rsi, rax
test rax, rax
je 0x46dfb7
lea r8, [r15 - 2]
mov rcx, rax
lea rdx, [rbp + 2]
call fcn.00424180
mov word [rsi + r14*2 - 4], bx
mov rdx, rsi
mov rcx, qword [r13 + 0xb8]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rsi
call fcn.00422660
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, bl
jmp 0x46dfc6
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.0045f394
mov rdx, qword [rbx + 0xa8]
lea r11, [0x004b9a10]
xor r8d, r8d
mov r10d, eax
mov r9d, 0x68
mov ecx, dword [rdx + 8]
xor edx, edx
cmp dword [rdx + r11], ecx
jne 0x46e02d
mov eax, dword [rdx + r11 + 4]
cmp eax, r10d
je 0x46e03f
test eax, eax
je 0x46e03f
inc r8
add rdx, 0xc
cmp rdx, 0xcc
jae 0x46e048
jmp 0x46e019
lea rax, [r8 + r8*2]
mov r9d, dword [r11 + rax*4 + 8]
mov edx, r9d
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x46dec8
Function at 0x46ea18
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0xb80]
sub rsp, 0xc80
xor r14d, r14d
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rbp + 0xbb8], r14
lea rcx, [rsp + 0x40]
mov qword [rbp + 0xbb0], r14
mov r8d, 0x208
call fcn.00424830
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.00424830
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x820
call fcn.00424830
test rdi, rdi
je 0x46eaa1
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov r8, rdi
mov edx, 0x103
call fcn.00435528
lea rdx, [0x00498428]
lea rcx, [rsp + 0x40]
call fcn.00423b70
test rax, rax
je 0x46eb81
lea rcx, [rsp + 0x40]
sub rax, rcx
sar rax, 1
cmp eax, 1
jne 0x46eb81
lea r9, [rbp + 0xbb0]
mov word [rsp + 0x44], r14w
lea r8, [rbp + 0xbb8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x46eb32
mov r9d, 0x104
lea r8, [rbp + 0x150]
lea edx, [rax + 0x23]
call fcn.0045f868
lea r9, [rsp + 0x40]
mov edx, 0x40f
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0x360]
call fcn.0041c82c
lea rdx, [rbp + 0x360]
jmp 0x46eb9f
cmp qword [rbp + 0xbb0], 0x3200000
jae 0x46eb7d
mov r9d, 0x104
lea r8, [rbp + 0x150]
mov edx, select
call fcn.0045f868
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 0x32
lea r8, [rbp + 0x150]
mov edx, 0x40f
lea rcx, [rbp + 0x360]
call fcn.0041c82c
jmp 0x46eb29
mov al, 1
jmp 0x46ebbf
mov r9d, 0x104
lea r8, [rbp + 0x150]
mov edx, 0x1e
call fcn.0045f868
lea rdx, [rbp + 0x150]
mov r8, qword [rbx + 0xa8]
mov r9d, 0x30
mov rcx, qword [rbx + 8]
add r8, 0x94
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
mov rbx, qword [rsp + 0xca0]
add rsp, 0xc80
pop r14
pop rdi
pop rbp
ret
Function at 0x46edd4
Capabilities:
Get common file path
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x20], r9
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
and qword [rsp + 0x30], 0
mov rdi, rcx
and dword [rsp + 0x44], 0
lea rcx, [rsp + 0x60]
and qword [rsp + 0x58], 0
mov ebx, 0x208
and qword [rbp + 0x3a8], 0
mov r8d, ebx
xor edx, edx
call fcn.00424830
mov r8d, ebx
lea rcx, [rbp + 0x170]
xor edx, edx
call fcn.00424830
mov rcx, qword [rdi + 8]
lea r8, [rbp + 0x3a8]
mov edx, select
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x46ef1d
cmp qword [rbp + 0x3a8], 0
je 0x46ef1d
mov r9d, 0x103
lea r8, [rbp + 0x170]
mov edx, 0x39
call fcn.0045f868
mov rcx, qword [rdi + 0xb8]
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rax, [rbp + 0x170]
mov dword [rsp + 0x40], 0x8047
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
lea rax, [0x0046e980]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x3a8]
mov qword [rsp + 0x28], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov rbx, rax
test rax, rax
je 0x46ef09
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rdi + 0xb8]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0x3a8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 1
jmp 0x46ef1f
xor eax, eax
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x46ef3c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xb60]
sub rsp, 0xc60
mov rbx, rcx
mov edi, 0x208
mov r8d, edi
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.00424830
mov r8d, edi
lea rcx, [rbp + 0x130]
xor edx, edx
call fcn.00424830
xor edx, edx
lea rcx, [rbp + 0x340]
mov r8d, 0x820
call fcn.00424830
mov rcx, qword [rbx + 0x338]
lea rdx, [rbp + 0x340]
mov r8d, 0x410
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rbp + 0x130]
mov rcx, rbx
lea rdx, [rbp + 0x340]
call fcn.0046ebdc
mov rcx, qword [rbx + 0x338]
test al, al
jne 0x46efda
call qword [sym.imp.USER32.dll_SetFocus]
xor al, al
jmp 0x46f0bf
lea rdx, [rbp + 0x130]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0xa8]
or rdi, 0xffffffffffffffff
add rcx, 0x6ac
je 0x46f00f
mov r9, rdi
lea r8, [rbp + 0x130]
mov edx, 0x104
call fcn.00435528
mov rcx, qword [rbx + 0xb8]
lea rdx, [rbp + 0x340]
mov r8d, 0x410
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rbp + 0x340]
call fcn.0046ebdc
mov rcx, qword [rbx + 0xb8]
test al, al
je 0x46efcd
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetWindowTextW]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.0046ea18
test al, al
jne 0x46f070
mov rcx, qword [rbx + 0xb8]
jmp 0x46efcd
mov rcx, qword [rbx + 0xa8]
add rcx, 0x29c
je 0x46f092
mov r9, rdi
lea r8, [rsp + 0x20]
mov edx, 0x104
call fcn.00435528
mov rcx, qword [rbx + 0x5b8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0xa8]
test eax, eax
je 0x46f0ba
or dword [rcx], 4
jmp 0x46f0bd
and dword [rcx], 0xfffffffb
mov al, 1
lea r11, [rsp + 0xc60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x46f234
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x368]
sub rsp, 0x460
xor r14d, r14d
lea rax, [rsp + 0x38]
mov rbx, rcx
mov qword [rsp + 0x28], rax
mov edx, 0x104
mov dword [rsp + 0x30], r14d
lea rcx, [0x0048d7e0]
mov dword [rsp + 0x34], edx
lea rax, [rbp + 0x158]
mov word [rsp + 0x38], r14w
lea rsi, [rbx + 0xb0]
mov qword [rsp + 0x20], rcx
lea rdi, [rbx + 0xa8]
mov qword [rbp + 0x148], rax
mov dword [rbp + 0x150], r14d
mov dword [rbp + 0x154], edx
mov word [rbp + 0x158], r14w
mov qword [rbp + 0x140], rcx
cmp qword [rsi + 8], r14
jne 0x46f2e5
mov rax, rdi
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0045d950
lea rsi, [rbx + 0x330]
cmp qword [rsi + 8], r14
jne 0x46f318
mov rax, rdi
mov edx, 0x106
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0045d950
lea rsi, [rbx + 0x5b0]
cmp qword [rsi + 8], r14
jne 0x46f34b
mov rax, rdi
mov edx, VarUI4FromDisp
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0041abb8
lea rsi, [rbx + 0x5f8]
cmp qword [rsi + 8], r14
jne 0x46f37e
mov rax, rdi
mov edx, VarUI4FromDisp
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0041abb8
mov rdx, qword [rbx + 8]
mov r8d, 7
call fcn.0045f120
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rbx + 0x600]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x46f3c5
mov edx, dword [rsp + 0x34]
mov rcx, rax
call fcn.004293f8
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x28]
jmp 0x46f3ca
mov dword [rsp + 0x30], r14d
mov r8, qword [rdi]
lea rcx, [rbp + 0x140]
add r8, 0x94
mov rdx, rax
call fcn.004012e8
mov rdx, qword [rbp + 0x148]
mov rcx, qword [rbx + 0x600]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rdi]
mov rcx, qword [rbx + 0xb8]
add rdx, 0x29c
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rdi]
mov rcx, qword [rbx + 0x338]
add rdx, 0x6ac
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rax, qword [rdi]
xor r9d, r9d
mov rcx, qword [rbx + 0x5b8]
mov edx, 0xf1
mov r8d, dword [rax]
shr r8, 2
and r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0x460]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x46f768
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x560]
sub rsp, 0x660
xor r14d, r14d
mov dword [rsp + 0x54], 0x104
mov r9d, edx
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x58]
mov word [rsp + 0x58], r14w
mov qword [rsp + 0x48], rax
mov esi, edx
lea rax, [0x0048d7e0]
mov qword [rbp + 0x580], r14
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rax, [rbp + 0x580]
mov rbx, rcx
or r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov edi, r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46f8ec
xor edx, edx
mov rcx, qword [rbp + 0x580]
lea r9, [rbp + 0x588]
mov qword [rsp + 0x38], r14
lea r8, [rbp + 0x160]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x588], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46f8df
cmp dword [rbp + 0x588], r14d
jbe 0x46f8df
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x200
call fcn.00424830
lea r8, [rbp + 0x160]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
lea rcx, [rsp + 0x40]
call fcn.004012e8
mov rdx, qword [rsp + 0x48]
lea r9, [rbp + 0x360]
lea r8, str.InstallLocation
mov dword [rsp + 0x28], esi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], 0x1fe
call fcn.00404704
test al, al
je 0x46f8b7
mov rdx, qword [0x004b9088]
lea rcx, [rbp + 0x360]
call fcn.004373a8
test eax, eax
je 0x46f8c0
inc edi
mov edx, edi
jmp 0x46f7f7
mov rcx, qword [rbx + 0xa8]
lea r8, [rbp + 0x160]
add rcx, 0x418
mov edx, 0x104
call fcn.0042e77c
mov rcx, qword [rbp + 0x580]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbx + 0xa8]
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
cmp word [rax + 0x418], r14w
setne al
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x46fc2c
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x248
mov r8, qword [rcx + 0xa8]
xor ecx, ecx
add r8, 0x418
cmp word [r8], cx
je 0x46fcb7
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
lea rax, [0x0048d7e0]
mov word [rsp + 0x38], cx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x104
call fcn.004012e8
mov rdx, qword [rsp + 0x28]
xor r9d, r9d
mov r8d, 0x20206
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov rdx, qword [rsp + 0x28]
xor r9d, r9d
mov r8d, 0x20106
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x248
ret

Function at 0x46fcc8
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x398]
sub rsp, 0x490
xor r14d, r14d
mov dword [rsp + 0x34], 0x104
mov dword [rsp + 0x30], r14d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [0x0048d7e0]
mov qword [rsp + 0x20], rax
mov rdi, rdx
mov word [rsp + 0x38], r14w
mov rsi, rcx
test rdx, rdx
je 0x46fdb7
mov r8, rdx
lea rcx, [rsp + 0x20]
lea rdx, str._s.
call fcn.004012e8
mov rcx, qword [rsp + 0x28]
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x46fdb7
test byte [rbp + 0x140], 0x10
je 0x46fd9a
cmp word [rbp + 0x16c], 0x2e
je 0x46fd9a
lea r9, [rbp + 0x16c]
mov r8, rdi
lea rdx, [0x00491de8]
lea rcx, [rsp + 0x20]
call fcn.004012e8
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.0046fcc8
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, [rbp + 0x140]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46fd54
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x46fddc
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
test rdx, rdx
je 0x46ff7d
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x398]
sub rsp, 0x490
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
mov qword [rsp + 0x28], rax
mov rbx, rdx
lea rax, [0x0048d7e0]
mov rsi, rcx
xor r14d, r14d
mov qword [rsp + 0x20], rax
mov r8, rdx
mov dword [rsp + 0x30], r14d
lea rdx, str._s.
mov word [rsp + 0x38], r14w
lea rcx, [rsp + 0x20]
call fcn.004012e8
mov rcx, qword [rsp + 0x28]
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x46ff61
lea r9, [rbp + 0x16c]
mov r8, rbx
lea rdx, [0x00491de8]
lea rcx, [rsp + 0x20]
call fcn.004012e8
test byte [rbp + 0x140], 0x10
je 0x46ff35
cmp word [rbp + 0x16c], 0x2e
movzx eax, word [rbp + 0x16e]
jne 0x46fec8
test ax, ax
je 0x46ff40
cmp word [rbp + 0x16c], 0x2e
jne 0x46fec8
cmp ax, 0x2e
jne 0x46fec8
cmp word [rbp + 0x170], r14w
je 0x46ff40
mov rax, qword [rsi + 0xa8]
test byte [rax + 0x850], 1
jne 0x46ff1d
lea rdx, [0x00498488]
lea rcx, [rbp + 0x16c]
call fcn.004373a8
test eax, eax
je 0x46ff40
lea rdx, [0x00498498]
lea rcx, [rbp + 0x16c]
call fcn.004373a8
test eax, eax
je 0x46ff40
lea rdx, str.config
lea rcx, [rbp + 0x16c]
call fcn.004373a8
test eax, eax
je 0x46ff40
mov rdx, qword [rsp + 0x28]
mov rcx, rsi
call fcn.0046fddc
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46fe6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x470f14
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r9
push rbp
lea rbp, [rax - 0x728]
sub rsp, 0x820
mov rbx, rcx
mov edi, 0x400
mov r8d, edi
lea rcx, [rbp + 0x320]
xor edx, edx
call fcn.00424830
mov r8d, edi
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.00424830
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetParent]
xor edx, edx
lea rcx, [rbp + 0x748]
mov qword [rbp + 0x748], rax
call fcn.0041db0c
lea rsi, [rbx + 0xb0]
cmp qword [rsi + 8], 0
lea rdi, [rbx + 0xa8]
jne 0x470fb8
mov rax, rdi
mov edx, 0x10b
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0041abb8
lea rsi, [rbx + 0xf8]
cmp qword [rsi + 8], 0
jne 0x470fec
mov rax, rdi
mov edx, 0x10c
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0041abb8
lea rsi, [rbx + 0x140]
cmp qword [rsi + 8], 0
jne 0x471020
mov rax, rdi
mov edx, reloc.OLEAUT32.dll_VarUI4FromDisp
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0041abb8
lea rsi, [rbx + 0x188]
cmp qword [rsi + 8], 0
jne 0x471054
mov rax, rdi
mov edx, 0x116
neg rax
sbb rcx, rcx
and rcx, rbx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
mov rcx, rsi
call fcn.0041abb8
mov rdx, qword [rbx + 8]
mov r8d, 5
call fcn.0045f120
mov rcx, qword [rbx + 0xb8]
lea rdx, [rsp + 0x20]
mov r8d, 0x200
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r9, qword [rdi]
lea r8, [rsp + 0x20]
mov esi, 0x85c
lea rcx, [rbp + 0x320]
add r9, rsi
mov edx, 0x200
call fcn.0041c82c
mov rcx, qword [rbx + 0xb8]
lea rdx, [rbp + 0x320]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x100]
lea rdx, [rsp + 0x20]
mov r8d, 0x200
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r9, qword [rdi]
lea r8, [rsp + 0x20]
add r9, rsi
lea rcx, [rbp + 0x320]
mov edx, 0x200
call fcn.0041c82c
mov rcx, qword [rbx + 0x100]
lea rdx, [rbp + 0x320]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [0x004b9088]
mov rcx, qword [rbx + 0x148]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x190]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf1
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0x820]
mov eax, 1
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret