joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c700
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
xor edi, edi
cmp rsi, 0xffffffffffffffff
mov rbp, r9
mov r12d, r8d
mov qword [rsp + 0x40], r14
mov r13, rdx
je 0x41c7d8
lea rbx, [rcx + 0x10]
call fcn.00413910
mov dword [rsp + 0x30], 0xf003f
mov r14d, 1
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov r9d, r14d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
call fcn.004131d0
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x41c7ae
mov ecx, dword [rsp + 0xa0]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, rax
mov rdx, r13
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
test eax, eax
cmove edi, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov eax, edi
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x78
ret
mov eax, edi
jmp 0x41c7ba

Function at 0x41c7e0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x70], rsi
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
xor edi, edi
cmp rsi, 0xffffffffffffffff
mov r12d, r9d
mov rbp, rdx
mov qword [rsp + 0x50], r14
mov r13, r8
je 0x41c8ee
lea rbx, [rcx + 0x10]
call fcn.00413910
mov dword [rsp + 0x30], 0x20019
mov r14d, 1
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov r9d, r14d
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
call fcn.004131d0
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x41c8be
lea r8, [rsp + 0x40]
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41c8b5
mov eax, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0x40]
mov r9d, r12d
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x40]
test eax, eax
cmove edi, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov eax, edi
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x88
ret
mov eax, edi
jmp 0x41c8cd
Function at 0x41fff0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x3c8
mov qword [rsp + 0x3c0], rbx
mov qword [rsp + 0x3b8], rsi
mov qword [rsp + 0x3b0], rdi
mov rbx, rdx
mov qword [rsp + 0x50], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x4200a1
mov r8, rbx
lea rdx, str.CDIFxUninstall_::_DeleteMatchingOEMInf_:_pszEnumFileName___s_n
lea rcx, [rsp + 0x1a0]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0xa0], rdx
lea rdi, [rsp + 0xa0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x420070
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.004548a0
xor esi, esi
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rax
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, str.INFOEM.INF
lea rcx, [rsp + 0x38]
call fcn.0049b290
mov rdi, rax
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x48]
call fcn.0049b290
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
mov edx, 0xa
lea rcx, [rsp + 0x60]
call fcn.0049a7a0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.00401340
nop
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x4201fe
nop
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.004012d0
nop
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
mov r8, qword [rsp + 0x28]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.00422290
test eax, eax
jne 0x4201bd
cmp qword [rsp + 0x30], 0
jne 0x420170
jmp 0x4201fe
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.004230e0
lea r8, str..PNF
lea rdx, [0x004a9e10]
lea rcx, [rsp + 0x28]
call fcn.004999f4
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.004230e0
mov esi, 1
call fcn.004545a0
test eax, eax
je 0x420282
mov r8d, esi
lea rdx, str.CDIFxUninstall_::_DeleteMatchingOEMIn_:_bRetVal___d_n
lea rcx, [rsp + 0x1a0]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0xa0], rdx
lea rdi, [rsp + 0xa0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x420250
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x60]
call fcn.0049a80c
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
mov eax, esi
mov rbx, qword [rsp + 0x3c0]
mov rsi, qword [rsp + 0x3b8]
mov rdi, qword [rsp + 0x3b0]
add rsp, 0x3c8
ret
Function at 0x421930
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x2b8
mov qword [rsp + 0x2b0], rbx
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x298], rdi
mov edi, r8d
mov rbp, rdx
mov qword [rsp + 0x28], 0xfffffffffffffffe
xor ebx, ebx
movsxd rcx, r8d
add rcx, rdx
lea rdx, [0x004a9dfc]
call fcn.00486ac0
mov rsi, rax
test rax, rax
je 0x421a9a
test edi, edi
jne 0x4219ae
lea rcx, [rax + 1]
lea rdx, [0x004a9dfc]
call fcn.00486ac0
test rax, rax
jne 0x4219ae
mov eax, 1
jmp 0x421a9c
mov rdi, rsi
sub rdi, rbp
mov r8, rdi
mov rdx, rbp
lea rcx, [rsp + 0x70]
call fcn.00487090
mov byte [rsp + rdi + 0x70], bl
mov dword [rsp + 0x20], ebx
lea rcx, [rsp + 0x30]
call fcn.004855f8
nop
xor ecx, ecx
nop
nop
movzx eax, byte [rsp + rcx + 0x70]
mov byte [rsp + rcx + 0x180], al
inc rcx
test al, al
jne 0x4219e0
lea rdi, [rsp + 0x180]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..]
mov dword [rdi - 1], eax
movzx eax, byte [0x004ad8c8]
mov byte [rdi + 3], al
xor r8d, r8d
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.00485680
test eax, eax
je 0x421a44
lea rcx, [rsp + 0x30]
call fcn.004853ec
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call fcn.00485624
cmp dword [rsp + 0x20], 0
jne 0x421a76
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x421a76
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 1
sub esi, ebp
inc esi
mov r8d, esi
mov rdx, rbp
mov rcx, qword [rsp + 0x2c0]
call fcn.00421930
test eax, eax
jne 0x421a95
test ebx, ebx
je 0x421a9a
mov ebx, 1
mov eax, ebx
mov rbx, qword [rsp + 0x2b0]
mov rbp, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rsi, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x298]
add rsp, 0x2b8
ret

Function at 0x421c30
Capabilities:
Get file version info

Disassembly:
sub rsp, 0x858
mov qword [rsp + 0x850], rbx
mov qword [rsp + 0x848], rbp
mov rbp, rdx
lea rdx, [rsp + 0x24]
mov rcx, rbp
mov qword [rsp + 0x840], rsi
mov qword [rsp + 0x838], rdi
mov rbx, r8
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov edi, eax
je 0x421d4b
cmp eax, 0x7d00
jae 0x421d4b
mov ecx, eax
call fcn.00487350
test rax, rax
mov rsi, rax
jne 0x421cb8
xor eax, eax
mov rsi, qword [rsp + 0x840]
mov rdi, qword [rsp + 0x838]
mov rbp, qword [rsp + 0x848]
mov rbx, qword [rsp + 0x850]
add rsp, 0x858
ret
mov edx, dword [rsp + 0x24]
mov r9, rax
mov r8d, edi
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x421c8e
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, str.StringFileInfo040904b0FileVersion
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x421d39
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x421c8e
mov eax, dword [rsp + 0x20]
cmp eax, 0x100
jae 0x421c8e
test eax, eax
je 0x421c8e
lea rcx, [rsp + 0x30]
mov r8d, eax
mov edi, eax
call fcn.00486d40
lea rax, [rsp + 0x30]
lea r11, [rsp + 0x30]
sub rbx, rax
movzx eax, byte [r11]
inc r11
test al, al
mov byte [rbx + r11 - 1], al
jne 0x421d20
mov qword [rsp + rdi*8 + 0x30], 0
mov rcx, rsi
call fcn.00487200
mov eax, 1
jmp 0x421c90
xor eax, eax
jmp 0x421c98
Function at 0x421d60
Capabilities:
Get file version info

Disassembly:
sub rsp, 0x298
mov qword [rsp + 0x290], rbx
mov qword [rsp + 0x288], rbp
mov qword [rsp + 0x280], rsi
mov qword [rsp + 0x278], rdi
mov qword [rsp + 0x270], r12
mov rdi, rdx
mov qword [rsp + 0x40], 0xfffffffffffffffe
xor r12d, r12d
mov dword [rsp + 0x28], r12d
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test eax, eax
je 0x421f5a
cmp eax, 0x7d00
jae 0x421f5a
mov ecx, eax
call fcn.00487350
mov rbp, rax
test rax, rax
jne 0x421df1
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
xor eax, eax
jmp 0x421f66
mov r9, rax
mov r8d, ebx
mov edx, dword [rsp + 0x30]
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x421e21
mov rcx, rbp
call fcn.00487200
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
xor eax, eax
jmp 0x421f66
lea r9, [rsp + 0x28]
lea r8, [0x004e17a8]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueA
mov edi, r12d
test dword [rsp + 0x28], 0xfffffffc
jbe 0x421f42
mov rsi, r12
mov rax, qword [0x004e17a8]
movzx r9d, word [rsi + rax + 2]
movzx r8d, word [rsi + rax]
lea rdx, str.StringFileInfo_04x_04xCompanyName
lea rcx, [rsp + 0x160]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x2c]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x160]
mov rcx, rbp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x421f25
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x421f25
mov eax, dword [rsp + 0x2c]
cmp eax, 0x100
jae 0x421f25
test eax, eax
je 0x421f25
mov ebx, eax
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.00486d40
mov byte [rsp + rbx + 0x50], 0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.0049b398
lea rcx, [rsp + 0x20]
call fcn.0049b664
lea rdx, str.CONEXANT
lea rcx, [rsp + 0x20]
call fcn.0049a400
cmp eax, 0xffffffff
jne 0x421f3c
lea rdx, str.CNXT
lea rcx, [rsp + 0x20]
call fcn.0049a400
cmp eax, 0xffffffff
jne 0x421f3c
lea rdx, [0x004adc98]
lea rcx, [rsp + 0x20]
call fcn.0049a400
cmp eax, 0xffffffff
jne 0x421f3c
inc edi
add rsi, 4
mov eax, dword [rsp + 0x28]
shr eax, 2
cmp edi, eax
jb 0x421e50
jmp 0x421f42
mov r12d, 1
mov rcx, rbp
call fcn.00487200
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
mov eax, r12d
jmp 0x421f66
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
xor eax, eax
mov rbx, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov rdi, qword [rsp + 0x278]
mov r12, qword [rsp + 0x270]
add rsp, 0x298
ret
Function at 0x421fc0
Capabilities:
Get file version info

Disassembly:
sub rsp, 0x188
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x178], rbp
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x168], rdi
mov rdi, rdx
mov qword [rsp + 0x160], r12
lea rdx, [rsp + 0x28]
xor ebp, ebp
mov rcx, rdi
mov qword [rsp + 0x158], r13
mov r12d, r9d
mov r13, r8
mov dword [rsp + 0x20], ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov ebx, eax
je 0x42215f
cmp eax, 0x7d00
jae 0x42215f
mov ecx, eax
call fcn.00487350
test rax, rax
mov rsi, rax
je 0x422055
mov edx, dword [rsp + 0x28]
mov r9, rax
mov r8d, ebx
mov rcx, rdi
call sub.VERSION.dll_GetFileVersionInfoA
mov rcx, rsi
test eax, eax
jne 0x42208f
call fcn.00487200
xor eax, eax
mov rsi, qword [rsp + 0x170]
mov r13, qword [rsp + 0x158]
mov r12, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x168]
mov rbp, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x180]
add rsp, 0x188
ret
lea r9, [rsp + 0x20]
lea r8, [0x004e17a8]
lea rdx, str.VarFileInfoTranslation
call sub.VERSION.dll_VerQueryValueA
test dword [rsp + 0x20], 0xfffffffc
mov ebx, ebp
jbe 0x422150
mov rdi, rbp
nop
nop
mov rax, qword [0x004e17a8]
lea rdx, str.StringFileInfo_04x_04xComments
lea rcx, [rsp + 0x40]
movzx r9d, word [rdi + rax + 2]
movzx r8d, word [rdi + rax]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x422118
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x422118
mov eax, dword [rsp + 0x24]
cmp eax, 0x100
jae 0x422118
test eax, eax
jne 0x422138
mov eax, dword [rsp + 0x20]
inc ebx
add rdi, 4
shr eax, 2
cmp ebx, eax
jb 0x4220c0
mov rcx, rsi
call fcn.00487200
mov eax, ebp
jmp 0x422057
cmp r12d, eax
mov rcx, r13
mov r8d, r12d
jb 0x422146
mov r8d, eax
call fcn.00486d40
mov ebp, 1
mov rcx, rsi
call fcn.00487200
mov eax, ebp
jmp 0x422057
xor eax, eax
jmp 0x42205f
Function at 0x422170
Capabilities:
Get common file path
Move file
Read .ini file

Disassembly:
sub rsp, 0x638
mov qword [rsp + 0x630], rbx
mov qword [rsp + 0x628], rdi
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4221b8
mov r8d, 4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov rbx, qword [rsp + 0x630]
add rsp, 0x638
ret
lea rcx, [rsp + 0x20]
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x120]
mov r8d, pe_nt_image_headers64
repne scasb al, byte [rdi]
mov rax, qword [str.wininit.ini]
mov rcx, rbx
mov qword [rdi - 1], rax
mov eax, dword [0x004add48]
mov dword [rdi + 7], eax
movzx eax, byte [0x004add4c]
mov byte [rdi + 0xb], al
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x220]
lea rcx, str.Rename
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea r8, [rsp + 0x120]
xor r9d, r9d
movsxd rdx, eax
lea rcx, [rsp + rdx + 0x220]
lea rdx, str.NUL_s_c
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x220]
lea rcx, str.Rename
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
mov rdi, qword [rsp + 0x628]
mov rbx, qword [rsp + 0x630]
add rsp, 0x638
ret
Function at 0x422f30
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x2b8
mov qword [rsp + 0x2b0], rbx
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x298], rdi
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x28], 0xfffffffffffffffe
movsxd rcx, r8d
add rcx, rdx
lea rdx, [0x004a9dfc]
call fcn.00486ac0
mov rbx, rax
test rax, rax
je 0x422fad
mov rdi, rax
sub rdi, rsi
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.00487090
mov byte [rsp + rdi + 0x70], 0
sub ebx, esi
inc ebx
mov r8d, ebx
mov rdx, rsi
mov rcx, rbp
call fcn.00422f30
xor ebx, ebx
mov rcx, rbx
jmp 0x422fc0
movzx eax, byte [rsp + rcx + 0x70]
mov byte [rsp + rcx + 0x180], al
inc rcx
test al, al
jne 0x422fc0
lea rdi, [rsp + 0x180]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..]
mov dword [rdi - 1], eax
movzx eax, byte [0x004ad8c8]
mov byte [rdi + 3], al
mov edx, 0xa
lea rcx, [rsp + 0x30]
call fcn.0049a7a0
nop
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x20]
call fcn.0049b290
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.00401340
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
nop
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov ecx, 1
test rax, rax
cmove ebx, ecx
lea rcx, [rsp + 0x30]
call fcn.0049a80c
test ebx, ebx
je 0x423070
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov rbx, qword [rsp + 0x2b0]
mov rbp, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rsi, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x298]
add rsp, 0x2b8
ret
Function at 0x4230e0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
sub rsp, 0x98
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r12
mov ebp, r8d
mov rbx, rdx
mov r12, rcx
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor edi, edi
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x20], rax
mov esi, edi
lea rcx, [rsp + 0x38]
call fcn.004855f8
nop
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.00485680
test eax, eax
je 0x423170
lea rcx, [rsp + 0x38]
call fcn.004854d0
mov edx, InitCommonControls
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
call qword [rax + 0x70]
mov ecx, 1
test eax, eax
cmove esi, ecx
lea rcx, [rsp + 0x38]
call fcn.004853ec
nop
lea rcx, [rsp + 0x38]
call fcn.00485624
test esi, esi
je 0x42323f
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, eax
cmp eax, 1
jne 0x4231bc
mov rdx, rbx
lea rcx, [0x004e17b0]
call fcn.0049aaa4
jmp 0x4231c0
test eax, eax
je 0x42323f
test bpl, 2
je 0x4231d9
mov r8d, 2
mov rdx, rbx
mov rcx, r12
call fcn.00422f30
jmp 0x42323f
test bpl, 1
je 0x42323f
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.0049b398
mov dl, 0x5c
lea rcx, [rsp + 0x20]
call fcn.00499914
cmp eax, 0xffffffff
je 0x42323f
mov r8d, eax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.00499e24
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
mov eax, edi
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
add rsp, 0x98
ret
Function at 0x4232e0
Capabilities:
Copy file
Create directory
Set file attributes

Disassembly:
sub rsp, 0x2b8
mov qword [rsp + 0x2b0], rbx
mov qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin], rbp
mov qword [rsp + 0x2a0], rsi
mov qword [rsp + 0x298], rdi
mov qword [rsp + 0x290], r12
mov qword [rsp + 0x288], r13
mov qword [rsp + 0x280], r14
mov esi, r9d
mov rbx, r8
mov r13, rdx
mov rbp, rcx
mov qword [rsp + 0x58], 0xfffffffffffffffe
xor edi, edi
lea rcx, [rsp + 0x20]
call fcn.004855f8
nop
xor r8d, r8d
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.00485680
mov r14d, 1
test eax, eax
je 0x42337d
lea rcx, [rsp + 0x20]
call fcn.004854d0
mov edx, InitCommonControls
lea rcx, [rsp + 0x20]
mov rax, qword [rsp + 0x20]
call qword [rax + 0x70]
test eax, eax
cmove edi, r14d
lea rcx, [rsp + 0x20]
call fcn.004853ec
nop
lea rcx, [rsp + 0x20]
call fcn.00485624
test edi, edi
je 0x423523
test sil, 0x20
je 0x4233b6
mov r8, rbx
mov rdx, r13
mov rcx, rbp
call fcn.00421af0
test eax, eax
je 0x423527
test sil, 0x40
je 0x4233e0
lea r8, [rsp + 0x60]
mov rdx, r13
mov rcx, rbp
call fcn.00421c30
test eax, eax
je 0x4233e0
lea r8, [rsp + 0x60]
mov rdx, rbx
mov rcx, rbp
call fcn.00421c30
xor r8d, r8d
mov rdx, rbx
mov rcx, rbp
call fcn.004230e0
lea rdx, [0x004a9dfc]
mov rcx, rbx
call fcn.00486ac0
mov rsi, rax
test rax, rax
je 0x4234f9
lea rcx, [rax + 1]
lea rdx, [0x004a9dfc]
call fcn.00486ac0
test rax, rax
je 0x4234f9
mov rdi, rsi
sub rdi, rbx
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x170]
call fcn.00487090
mov byte [rsp + rdi + 0x170], 0
xor r12d, r12d
lea rcx, [rsp + 0x20]
call fcn.004855f8
nop
xor ecx, ecx
jmp 0x423460
movzx eax, byte [rsp + rcx + 0x170]
mov byte [rsp + rcx + 0x60], al
inc rcx
test al, al
jne 0x423460
lea rdi, [rsp + 0x60]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str..]
mov dword [rdi - 1], eax
movzx eax, byte [0x004ad8c8]
mov byte [rdi + 3], al
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.00485680
test eax, eax
je 0x4234b9
lea rcx, [rsp + 0x20]
call fcn.004853ec
mov r12d, r14d
lea rcx, [rsp + 0x20]
call fcn.00485624
test r12d, r12d
jne 0x4234e7
xor edx, edx
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4234e7
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
sub esi, ebx
inc esi
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call fcn.00421930
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x42351f
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, r14d
jmp 0x423529
xor eax, eax
jmp 0x423529
xor eax, eax
jmp 0x423529
xor eax, eax
mov rbx, qword [rsp + 0x2b0]
mov rbp, qword [rsp + reloc.SHELL32.dll_IsUserAnAdmin]
mov rsi, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x298]
mov r12, qword [rsp + 0x290]
mov r13, qword [rsp + 0x288]
mov r14, qword [rsp + 0x280]
add rsp, 0x2b8
ret
Function at 0x424870
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x268
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x258], rsi
mov qword [rsp + 0x250], rdi
mov rsi, rdx
call fcn.004545a0
test eax, eax
je 0x42490e
lea rdx, str.CInf_::_GetArchitectureTag_n
lea rcx, [rsp + 0x150]
xor r8d, r8d
call fcn.00486850
movabs rdx, 0x203a5952544e45
xor eax, eax
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x150]
nop
nop
movzx eax, byte [rdx + rcx]
inc rcx
test al, al
mov byte [rdi + rcx - 2], al
jne 0x4248e0
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.004548a0
lea rcx, str.Kernel32.dll
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x424981
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x424974
lea rcx, [rsp + 0x20]
call rax
movzx r11d, word [rsp + 0x20]
cmp r11w, 9
jne 0x424963
mov eax, dword [str.AMD64]
mov dword [rsi], eax
movzx eax, word [0x004ae1c8]
mov word [rsi + 4], ax
jmp 0x42496f
test r11w, r11w
jne 0x424974
mov dword [rsi], 0x363858
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x4249bc
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [rsp + 0x20]
cmp dx, 9
jne 0x4249ac
mov eax, dword [str.AMD64]
mov dword [rsi], eax
movzx eax, word [0x004ae1c8]
mov word [rsi + 4], ax
jmp 0x4249b7
test dx, dx
jne 0x4249bc
mov dword [rsi], 0x363858
mov ebx, 1
call fcn.004545a0
mov rsi, qword [rsp + 0x258]
test eax, eax
je 0x424a3e
lea rdx, str.CInf_::_GetArchitectureTag_:_bRetVal__d_n
lea rcx, [rsp + 0x150]
mov r8d, ebx
call fcn.00486850
xor eax, eax
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x50], rdx
lea rdi, [rsp + 0x50]
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rax, [rsp + 0x150]
xor edx, edx
nop
movzx ecx, byte [rax + rdx]
inc rdx
test cl, cl
mov byte [rdi + rdx - 2], cl
jne 0x424a10
call fcn.004546e0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
mov rdi, qword [rsp + 0x250]
mov eax, ebx
mov rbx, qword [rsp + 0x260]
add rsp, 0x268
ret
Function at 0x431450
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x138
lea rdx, [rsp + 0x20]
call fcn.00401000
lea rdx, [rsp + 0x20]
lea rcx, [0x00401160]
call qword [sym.imp.USER32.dll_EnumWindows]
add rsp, 0x138
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x44cae0
add rcx, 0x1588
jmp 0x4012a0