joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461280
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x490
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor r12d, r12d
xor edx, edx
mov r8d, 0x208
mov esi, r12d
call fcn.00424830
test rdi, rdi
je 0x4614ba
lea rbx, [0x00491dd8]
mov r9, rdi
lea r8, [0x00491de8]
mov qword [rsp + 0x20], rbx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.0040457c
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
or r14, 0xffffffffffffffff
mov r15, rax
cmp rax, r14
je 0x461457
test byte [rbp + 0x140], 0x10
je 0x46139e
lea rdx, [0x00490974]
lea rcx, [rbp + 0x16c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x461436
lea rdx, [0x00491de0]
lea rcx, [rbp + 0x16c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x461436
lea rax, [rbp + 0x16c]
mov r9, rdi
lea r8, [0x00491de8]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.0040457c
mov r9b, 1
mov byte [rsp + 0x20], 1
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [0x004e1a9c]
call fcn.00461280
add esi, eax
jmp 0x461436
lea rax, [rbp + 0x16c]
mov r9, rdi
lea r8, [0x00491de8]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.0040457c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x461434
lea rcx, [rsp + 0x30]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r12w
jne 0x4613da
cmp eax, dword [0x004b9090]
jae 0x461434
mov rbx, qword [0x004b9088]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
lea rdx, [rsp + 0x30]
add r8, r8
mov rcx, rbx
call fcn.00445ad0
test eax, eax
je 0x46142d
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x004e1a9c], 1
lea rbx, [0x00491dd8]
inc esi
lea rdx, [rbp + 0x140]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x461311
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x461468
inc esi
jmp 0x4614b6
inc r14
cmp word [rdi + r14*2], r12w
jne 0x461468
cmp r14d, dword [0x004b9090]
jae 0x4614b6
mov rbx, qword [0x004b9088]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r8, eax
mov rdx, rdi
add r8, r8
mov rcx, rbx
call fcn.00445ad0
test eax, eax
je 0x4614b6
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov byte [0x004e1a9c], 1
mov eax, esi
jmp 0x4614bc
xor eax, eax
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x4614e4
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
lea rbp, [rax - 0x608]
sub rsp, 0x6f0
mov rdi, r8
lea rcx, [rbp + 0x130]
mov rbx, rdx
mov r14d, 0x2b8
mov r8d, r14d
xor edx, edx
mov rsi, r9
call fcn.00424830
xor r15d, r15d
test rbx, rbx
je 0x46170a
test rdi, rdi
je 0x46170a
test rsi, rsi
je 0x46170a
mov word [rdi], r15w
lea r8, [rbp + 0x130]
or dword [rsi], 0xffffffff
mov r9d, r14d
xor edx, edx
mov dword [rsp + 0x20], 0x1000
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x4615eb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
movsxd rcx, eax
shr rcx, 1
je 0x4615e0
cmp rcx, 0x7fffffff
jbe 0x46159f
mov word [rdi], r15w
jmp 0x4615e0
mov edx, 0x7ffffffe
lea r8, [rbp + 0x140]
sub rdx, rcx
sub r8, rdi
lea rax, [rdx + rcx]
test rax, rax
je 0x4615d1
movzx eax, word [r8 + rdi]
test ax, ax
je 0x4615d1
mov word [rdi], ax
add rdi, 2
sub rcx, 1
jne 0x4615b1
test rcx, rcx
lea rax, [rdi - 2]
cmovne rax, rdi
mov word [rax], r15w
mov eax, dword [rbp + 0x138]
jmp 0x461708
mov r14d, 0x200
mov rcx, rbx
mov dword [rbp + 0x610], r14d
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rbx, 0xffffffff80000000
lea r9, [rbp + 0x610]
mov rdx, rax
lea r8, [rbp + 0x3f0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea r8, str.DefaultIcon
mov edx, r14d
lea rcx, [rbp + 0x3f0]
call fcn.0041b804
lea r9, [rbp + 0x610]
mov dword [rbp + 0x610], 0x104
lea r8, [rsp + 0x30]
mov rcx, rbx
lea rdx, [rbp + 0x3f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea rdx, [0x004903e0]
lea rcx, [rsp + 0x30]
call fcn.00423b70
mov r14, rax
test rax, rax
je 0x46170a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 1
lea rcx, [rsp + 0x30]
sub ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, ebx
mov rcx, rdi
movsxd rbx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov edx, 0x7ffffffe
shr rcx, 1
lea rax, [rcx - 1]
cmp rax, rdx
ja 0x4616ff
shr rbx, 1
cmp rbx, rdx
jbe 0x4616c6
mov word [rdi], r15w
jmp 0x4616ff
sub rbx, rcx
lea rdx, [rsp + 0x30]
sub rdx, rdi
lea rax, [rbx + rcx]
test rax, rax
je 0x4616f0
movzx eax, word [rdx + rdi]
test ax, ax
je 0x4616f0
mov word [rdi], ax
add rdi, 2
sub rcx, 1
jne 0x4616d1
test rcx, rcx
lea rax, [rdi - 2]
cmovne rax, rdi
mov word [rax], r15w
lea rcx, [r14 + 2]
call fcn.00436ec0
mov dword [rsi], eax
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x461920
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x570]
sub rsp, 0x670
and qword [rbp + 0x5a0], 0
mov r14, r9
mov rbx, r8
test r8, r8
je 0x461ad7
test r9, r9
je 0x461ad7
lea r8, [rbp + 0x5a0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x461ad7
cmp qword [rbp + 0x5a0], 0
je 0x461ad7
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.00424830
mov rcx, qword [rbp + 0x5a0]
lea rdx, [rsp + 0x40]
xor dil, dil
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x461ac4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
lea r8, str._s_s.lnk
mov edx, 0x103
lea rcx, [rbp + 0x150]
call fcn.0040457c
and qword [rbp + 0x590], 0
lea rax, [rbp + 0x590]
xor edx, edx
mov qword [rsp + 0x20], rax
lea r9, [0x0047af20]
lea rcx, [0x0047af50]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x461ac4
mov rcx, qword [rbp + 0x590]
test rcx, rcx
je 0x461ac4
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
lea rdx, [0x0047af60]
call qword [rax]
test eax, eax
js 0x461a9e
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x461a9e
mov rax, qword [rcx]
lea rdx, [rbp + 0x150]
xor r8d, r8d
call qword [rax + 0x28]
test eax, eax
js 0x461a93
mov rcx, qword [rbp + 0x590]
lea rdx, [rbp + 0x360]
mov r8d, 0x103
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x461a93
lea rdx, [rbp + 0x360]
sub rdx, rbx
movzx eax, word [rbx]
movzx ecx, word [rbx + rdx]
sub eax, ecx
jne 0x461a8d
add rbx, 2
test ecx, ecx
jne 0x461a7a
test eax, eax
sete dil
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + select]
mov rcx, qword [rbp + 0x590]
mov rax, qword [rcx]
call qword [rax + select]
test dil, dil
je 0x461ac4
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb cl, cl
and dil, cl
mov rcx, qword [rbp + 0x5a0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, dil
jmp 0x461ad9
xor eax, eax
mov rbx, qword [rsp + 0x698]
add rsp, 0x670
pop r14
pop rdi
pop rbp
ret
Function at 0x461af4
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x250
mov r14, r8
lea rcx, [rsp + 0x40]
mov r15d, edx
xor r12d, r12d
xor edx, edx
mov qword [rax + 8], r12
mov r8d, 0x208
mov rbp, r9
call fcn.00424830
test r14, r14
je 0x461c11
test rbp, rbp
je 0x461c11
cmp qword [rsp + 0x298], r12
je 0x461c11
mov esi, dword [rsp + 0x2a0]
test esi, esi
je 0x461c11
mov rbx, qword [rsp + 0x2a8]
test rbx, rbx
je 0x461c11
lea r8, [rsp + 0x270]
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x461c11
mov rcx, qword [rsp + 0x270]
test rcx, rcx
je 0x461c11
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x270]
test eax, eax
je 0x461c0b
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsp + 0x290]
lea edx, [rsi - 1]
mov rcx, qword [rsp + 0x298]
lea r9, [rsp + 0x40]
lea r8, str._s_s.lnk
mov qword [rsp + 0x20], rax
call fcn.0040457c
cmp word [rbx], r12w
mov r8, rbp
mov r9, qword [rsp + 0x298]
mov rdx, r14
cmove rbx, rbp
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], rbx
call fcn.00461730
jmp 0x461c13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x461d50
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x378]
sub rsp, 0x450
mov r15, r8
lea rcx, [rbp + 0x140]
mov r14d, edx
mov r12d, 0x208
mov r8d, r12d
xor edx, edx
mov rdi, r9
call fcn.00424830
xor ebx, ebx
mov qword [rbp + 0x380], rbx
mov sil, bl
test r15, r15
je 0x461ef1
test rdi, rdi
je 0x461ef1
lea r8, [rbp + 0x380]
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x461ef1
mov rcx, qword [rbp + 0x380]
test rcx, rcx
je 0x461ef1
lea rdx, [rbp + 0x140]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x461eda
lea r8, [0x0048d7c4]
mov edx, r12d
lea rcx, [rbp + 0x140]
call fcn.0041b804
mov r8, r15
lea rcx, [rbp + 0x140]
mov edx, r12d
call fcn.0041b804
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x461e7f
lea rax, [0x004837b8]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x140]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x34], 0x104
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov word [rsp + 0x38], bx
call fcn.00403ec4
lea rax, [0x0048d7e0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.00415a54
mov sil, al
jmp 0x461e82
mov sil, 1
mov eax, dword [rbp + 0x3a0]
mov edx, eax
test eax, eax
je 0x461eda
cmp eax, 0x7fffffff
jbe 0x461e9a
mov word [rdi], bx
jmp 0x461eda
mov ecx, 0x7ffffffe
lea r8, [rbp + 0x140]
sub rcx, rax
sub r8, rdi
lea rax, [rcx + rdx]
test rax, rax
je 0x461ecc
movzx eax, word [r8 + rdi]
test ax, ax
je 0x461ecc
mov word [rdi], ax
add rdi, 2
sub rdx, 1
jne 0x461eac
test rdx, rdx
lea rcx, [rdi - 2]
cmovne rcx, rdi
mov word [rcx], bx
mov rcx, qword [rbp + 0x380]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test sil, sil
setne bl
mov eax, ebx
jmp 0x461ef3
xor eax, eax
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x461fe8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rbx, r8
lea rcx, [rsp + 0x30]
mov edi, edx
mov ebp, 0x208
mov r8d, ebp
xor edx, edx
call fcn.00424830
xor esi, esi
test rbx, rbx
je 0x462076
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], si
jne 0x462023
cmp eax, 1
jb 0x462076
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x462076
lea r8, [0x0048d7c4]
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.0041b804
mov r8, rbx
lea rcx, [rsp + 0x30]
mov rdx, rbp
call fcn.0041b804
lea rdx, [rsp + 0x30]
call fcn.00461280
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x462140
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
xor edi, edi
mov rbx, rdx
test rdx, rdx
jne 0x46215e
xor eax, eax
jmp 0x462224
lea rax, [rsp + 0x20]
mov r8, rbx
sub r8, rax
lea rcx, [rsp + 0x20]
mov edx, 0x208
lea rax, [rdx + 0x7ffffdf6]
test rax, rax
je 0x462196
movzx eax, word [r8 + rcx]
test ax, ax
je 0x462196
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x462173
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
lea rcx, [rsp + 0x20]
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rsp + rcx*2 + 0x1e]
jmp 0x4621c3
cmp word [rax], 0x5c
je 0x4621cf
sub rax, 2
lea rcx, [rsp + 0x20]
cmp rax, rcx
ja 0x4621b9
jmp 0x462204
lea rcx, [rsp + 0x20]
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x462204
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x462204
lea rdx, [rsp + 0x20]
lea rcx, [0x004e1a9c]
call fcn.00462140
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x46221f
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x462224
mov eax, 1
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret
Function at 0x46660c
Capabilities:
Compute adler32 checksum

Disassembly:
mov r10d, ecx
movzx r9d, cx
shr r10d, 0x10
mov r11, rdx
cmp r8, 1
jne 0x466650
movzx ecx, byte [rdx]
mov r8d, 0xfff1
add ecx, r9d
cmp ecx, r8d
lea edx, [rcx - 0xfff1]
cmovb edx, ecx
lea eax, [rdx + r10]
cmp eax, r8d
lea ecx, [rax - 0xfff1]
cmovb ecx, eax
shl ecx, 0x10
or ecx, edx
mov eax, ecx
ret
test rdx, rdx
jne 0x466659
lea eax, [rdx + 1]
ret
cmp r8, 0x10
jae 0x4666a2
test r8, r8
je 0x466677
movzx eax, byte [r11]
inc r11
add r9d, eax
add r10d, r9d
sub r8, 1
jne 0x466664
mov r8d, 0xfff1
lea ecx, [r9 - 0xfff1]
cmp r9d, r8d
mov eax, 0x80078071
cmovb ecx, r9d
mul r10d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r10d
shl eax, 0x10
or eax, ecx
ret
cmp r8, 0x15b0
jb 0x46677c
mov rcx, r8
movabs rax, 0x79baa6bb6398b6f7
mul r8
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xc
imul rax, rcx, 0xffffffffffffea50
add r8, rax
mov edx, 0x2b6
movzx eax, byte [r11]
add r9d, eax
movzx eax, byte [r11 + 1]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 2]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 3]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 4]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 5]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 6]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 7]
add r10d, r9d
add r11, 8
add r9d, eax
add r10d, r9d
add edx, 0xffffffff
jne 0x4666db
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul r10d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r10d, eax
sub rcx, 1
jne 0x4666d6
test r8, r8
je 0x46682b
cmp r8, 8
jb 0x4667f0
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
movzx eax, byte [r11]
add r9d, eax
movzx eax, byte [r11 + 1]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 2]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 3]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 4]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 5]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 6]
add r10d, r9d
add r9d, eax
movzx eax, byte [r11 + 7]
add r10d, r9d
add r11, 8
add r9d, eax
add r10d, r9d
sub rcx, 1
jne 0x46678a
test r8, r8
je 0x466803
movzx eax, byte [r11]
inc r11
add r9d, eax
add r10d, r9d
sub r8, 1
jne 0x4667f0
mov eax, 0x80078071
mul r9d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xffff000f
mul r10d
add r9d, ecx
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r10d, ecx
shl r10d, 0x10
or r10d, r9d
mov eax, r10d
ret
Function at 0x469934
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x400]
sub rsp, 0x500
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.00424830
mov r8, qword [rbx + 0xa8]
lea rdx, str.__s_s___install
xor eax, eax
mov dword [rbp - 0xc], 0x200
mov qword [rsp + 0x60], rax
lea rcx, [rbp - 0x20]
lea rax, [rbp - 8]
xorps xmm0, xmm0
mov qword [rbp - 0x18], rax
lea r9, [r8 + 0x4a4]
lea rax, [0x0048e198]
xor edi, edi
add r8, 0x29c
mov qword [rbp - 0x20], rax
movups xmmword [rsp + 0x50], xmm0
mov dword [rbp - 0x10], edi
mov word [rbp - 8], di
call fcn.004012e8
mov rdx, qword [rbp - 0x18]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x469a01
lea rdx, str.Install_Fail_Start_Program
jmp 0x469a3b
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x469a21
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x469a31
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, 1
lea rdx, str.Install_Executed
lea rcx, [0x004dbde0]
call fcn.0044c458
lea r11, [rsp + 0x500]
mov al, dil
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x46a33c
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x360]
sub rsp, 0x460
xor ebx, ebx
lea rax, [rsp + 0x38]
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea rcx, [0x0048d7e0]
mov dword [rsp + 0x30], ebx
mov r8d, 0x104
mov qword [rsp + 0x20], rcx
lea rax, [rbp + 0x158]
mov qword [rbp + 0x140], rcx
xor ecx, ecx
mov qword [rbp + 0x148], rax
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x34], r8d
mov word [rsp + 0x38], bx
mov dword [rbp + 0x150], ebx
mov dword [rbp + 0x154], r8d
mov word [rbp + 0x158], bx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x46a3d4
mov edx, dword [rsp + 0x34]
call fcn.004293f8
mov dword [rsp + 0x30], eax
jmp 0x46a3d8
mov dword [rsp + 0x30], ebx
mov r8, qword [rdi + 0xa8]
lea rdx, str._suninstall.exe
add r8, 0x29c
lea rcx, [rbp + 0x140]
call fcn.004012e8
mov rdx, qword [rbp + 0x148]
xor r8d, r8d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x46a423
lea rdx, [rbp + 0x140]
mov rcx, rdi
mov bl, 1
call fcn.00469eb4
lea r11, [rsp + 0x460]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x46a798
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x480
mov r8, qword [rcx + 0xa8]
mov rsi, rcx
mov eax, dword [r8 + 8]
dec eax
test eax, 0xfffffff6
je 0x46a9f8
lea rax, [rsp + 0x68]
mov dword [rsp + 0x64], 0x104
mov qword [rsp + 0x58], rax
lea rdx, str._sConfig_
lea rax, [0x0048d7e0]
xor r15d, r15d
add r8, 0x29c
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x60], r15d
mov word [rsp + 0x68], r15w
call fcn.004012e8
lea rcx, [rsp + 0x50]
call fcn.00415a54
mov r8, qword [rsi + 0xa8]
lea r13, [0x00486230]
or r12, 0xffffffffffffffff
mov qword [rsp + 0x40], r13
add r8, 0x29c
mov qword [rsp + 0x48], r12
lea rdx, str._sConfig_terminal.lic
mov r14b, r15b
lea rcx, [rsp + 0x50]
call fcn.004012e8
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
cmp rcx, r12
je 0x46a878
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
test rbx, rbx
je 0x46a8af
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov qword [rsp + 0x48], rax
cmp rcx, r12
je 0x46a9cb
mov rbx, qword [rsi + 0xb0]
cmp word [rbx + 0x1e], r15w
je 0x46a99e
movzx eax, word [rbx + 0x1e]
cmp eax, dword [rbx + 0x70]
jne 0x46a99e
lea rdx, [rbx + 8]
mov dword [rbp + 0x3b0], r15d
test rdx, rdx
je 0x46a99e
lea r9, [rbp + 0x3b0]
mov qword [rsp + 0x20], r15
mov r8d, 0x58
call qword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb ecx, ecx
and ecx, dword [rbp + 0x3b0]
mov dword [rbp + 0x3b0], ecx
cmp ecx, 0x58
jne 0x46a99e
mov edi, r15d
cmp dword [rbx + 0x70], r15d
jbe 0x46a944
mov ecx, edi
lea rdx, [rsp + 0x40]
shl rcx, 4
add rcx, qword [rbx + 0x68]
call fcn.0041c430
test al, al
je 0x46a99e
inc edi
cmp edi, dword [rbx + 0x70]
jb 0x46a925
mov r8, qword [rsp + 0x58]
lea rbx, [rsi + 0x8f0]
mov r14b, 1
test r8, r8
je 0x46a96c
mov r9, r12
lea rcx, [rbp + 0x170]
mov edx, 0x104
call fcn.00435528
mov edx, dword [rbx + 0x18]
mov rcx, rbx
inc edx
call fcn.00403cbc
test al, al
je 0x46a9b1
mov eax, dword [rbx + 0x20]
lea rdx, [rbp + 0x170]
mov r8d, eax
imul eax, dword [rbx + 0x18]
mov ecx, eax
add rcx, qword [rbx + 0x10]
call fcn.00424180
inc dword [rbx + 0x18]
jmp 0x46a9b1
lea rdx, str.Install_Fail_License_Extract
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x46a9e3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
mov qword [rsp + 0x48], rcx
jmp 0x46a9e3
lea rdx, str.Install_Fail_License_Open
lea rcx, [0x004dbde0]
call fcn.0044c458
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], r13
cmp rcx, r12
je 0x46a9f3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, r14b
jmp 0x46a9fa
mov al, 1
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret