joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077a40
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1400b13b0], eax
inc eax
cmp eax, 1
jne 0x140077a8d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1400b13b4], eax
test bl, bl
je 0x140077b31
xor ebx, ebx
lock xadd dword [0x1400b13b4], ebx
test ebx, ebx
je 0x140077b31
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1400af560]
lea rsi, [0x1400af558]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x140077ae6
mov rax, qword [0x1400af558]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x140077ae8
mov al, 1
lea rcx, str.C:Users_ntoskrnlDesktopSDK_boost_asio_182_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.throw_on_error
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x140077b55
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.14007f7f0
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.140067340
int3

Function at 0x1400786c0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov rdi, r9
mov rcx, qword [rcx + 8]
mov rbp, rdx
cmp rcx, 0xffffffffffffffff
jne 0x140078758
movabs rcx, 0x4d54ee85da812030
mov dword [rsp + 0x24], 0
add rcx, qword [0x1400af560]
lea rbx, [0x1400af558]
cmp rcx, 1
jbe 0x140078728
mov rax, qword [0x1400af558]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x14007872a
mov al, 1
movzx eax, al
mov dword [rsp + 0x20], 0x2719
add rax, 2
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
jmp 0x140078787
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, eax
mov rcx, rdi
shr edx, 0x1f
mov ebx, eax
call fcn.140068f00
test ebx, ebx
js 0x140078787
or byte [rsi + 0x10], 2
movups xmm0, xmmword [rdi]
mov rax, rbp
movups xmmword [rbp], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rbp + 0x10], xmm1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14007f7f0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007ab50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1400af040]
xor rax, rsp
mov qword [rbp + 0x47], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xor edi, edi
mov qword [rbp - 0x49], rdi
mov rbx, qword [rcx + 0x18]
mov eax, edi
lock xadd dword [rbx + 0x30], eax
test eax, eax
jne 0x14007ab9e
mov rcx, rbx
call fcn.1400684f0
jmp 0x14007ac81
mov dword [rbp + 0x27], edi
mov qword [rbp + 0x2f], rdi
mov qword [rbp + 0x37], rdi
lea rcx, [rbp + 0x2f]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_]
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
xor eax, eax
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rax
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x29]
mov qword [rbp - 0x39], rax
mov ecx, dword [0x1400b13bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x31], rax
lea rdx, [rbp - 0x41]
mov ecx, dword [0x1400b13bc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x29]
mov rcx, rbx
call fcn.140068760
test rax, rax
je 0x14007ac45
nop dword [rax]
nop word [rax + rax]
lea r9, [rbp - 0x59]
lea r8, [rbp - 0x29]
mov rcx, rbx
call fcn.140068760
test rax, rax
jne 0x14007ac30
mov rdx, qword [rbp - 0x31]
mov ecx, dword [0x1400b13bc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rbp - 0x29]
mov edi, 0xa
nop
mov rcx, qword [rbx]
test rcx, rcx
je 0x14007ac6d
call fcn.14007ff90
add rbx, 8
sub rdi, 1
jne 0x14007ac60
lea rcx, [rbp + 0x2f]
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrDestroy_void____ptr64_]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14007f7f0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14007d3d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14007d431
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14007d3f0
mov ecx, dword [r9]
jmp 0x14007d518
cmp ecx, 0x4e0
jb 0x14007d518
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14007d450
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14007d4a0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14007f270
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14007f29f
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x14007f297
mov rax, qword [rcx]
xor edx, edx
call rax
nop
mov qword [rdi + 0x10], 0
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14007f2e8
mov ecx, dword [0x1400b13bc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007f2d8
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14007f2d8
xor ecx, ecx
xor eax, eax
cmp qword [rdx + rax*8], 0
je 0x14007f2f3
inc ecx
inc rax
cmp rax, 2
jl 0x14007f2c6
mov rcx, rbx
call fcn.14007ff90
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x48]
mov byte [rbx], al
movsxd rax, ecx
mov qword [rdx + rax*8], rbx
mov qword [rdi + 8], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14008058c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400805d6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400805d6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400805d6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400805d6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400805d6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400805d8
xor al, al
add rsp, 0x28
ret
Function at 0x140004dd0
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
mov ecx, eax
call fcn.14000a420
mov rsi, rax
mov rcx, r15
xor edx, edx
mov r8d, ebp
mov r9, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140004e6b
lea r8, [rsp + 0x28]
mov qword [r8], rsi
lea rdx, [0x14002faea]
lea r9, [rsp + 0x24]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140004e9b
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0xa]
mov dword [r14], edx
movzx edx, word [rcx + 8]
mov dword [rbx], edx
movzx edx, word [rcx + 0xe]
mov dword [rdi], edx
movzx ecx, word [rcx + 0xc]
mov dword [rax], ecx
mov edi, 1
jmp 0x140004ed3
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004ef7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_obtain_file_info_of_old_service.____lu_
jmp 0x140004ec9
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140004f34
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_query_file_version_info_of_old_service.____lu_
mov r8d, eax
call fcn.140008c60
xor edi, edi
mov rcx, rsi
call fcn.14000a438
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140018400
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x140038330]
call fcn.14000a550
cmp dword [0x140038330], 0xffffffff
jne 0x140004e8c
mov qword [0x140038120], 0
lea rcx, [fcn.140001d00]
call fcn.14000a6e8
lea rcx, [0x140038330]
call fcn.14000a5b8
jmp 0x140004e8c
lea rcx, [0x140038330]
call fcn.14000a550
cmp dword [0x140038330], 0xffffffff
jne 0x140004ebc
mov qword [0x140038120], 0
lea rcx, [fcn.140001d00]
call fcn.14000a6e8
lea rcx, [0x140038330]
call fcn.14000a5b8
jmp 0x140004ebc
Function at 0x140005bc0
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp word [rcx], 0
je 0x140005c81
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005c3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140005c3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140005c3c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005d0d
lea rdx, str.Could_not_delete_service_updater_path:__ls.
mov r8, rsi
call fcn.140008c60
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
xor edx, edx
call fcn.14000b870
mov rcx, rsi
call fcn.140013abc
cmp rax, 0x104
ja 0x140005c81
lea rdi, [rsp + 0x20]
mov r8d, 0x105
mov rcx, rdi
mov rdx, rsi
call fcn.140013f84
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140005c9c
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140018400
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rdx, str.updater.ini
lea rcx, [rsp + 0x20]
call int.140025930
test eax, eax
je 0x140005c81
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005c81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140005c81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140005c81
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005d4e
lea rdx, str.Could_not_delete_service_updater_INI_path:__ls.
lea r8, [rsp + 0x20]
call fcn.140008c60
jmp 0x140005c81
lea rcx, [0x140038330]
call fcn.14000a550
cmp dword [0x140038330], 0xffffffff
jne 0x140005c2d
mov qword [0x140038120], 0
lea rcx, [fcn.140001d00]
call fcn.14000a6e8
lea rcx, [0x140038330]
call fcn.14000a5b8
jmp 0x140005c2d
lea rcx, [0x140038330]
call fcn.14000a550
cmp dword [0x140038330], 0xffffffff
jne 0x140005cf7
mov qword [0x140038120], 0
lea rcx, [fcn.140001d00]
call fcn.14000a6e8
lea rcx, [0x140038330]
call fcn.14000a5b8
jmp 0x140005cf7
Function at 0x140008840
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140027010]
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140008896
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140013abc
cmp rax, 0x105
jb 0x1400088ad
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140018400
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.140013f84
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call int.140025930
test eax, eax
je 0x140008896
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400088fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140008896
lea rdx, str.UpdateLogs
mov rcx, rdi
call int.140025930
test eax, eax
je 0x140008896
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000892f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140008896
mov esi, 1
jmp 0x140008896

Function at 0x140008a00
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x468
mov esi, edx
mov rbx, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edi, edi
lea r14, [rsp + 0x40]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000b870
mov rcx, r14
call fcn.140008840
test eax, eax
je 0x140008a76
xor edi, edi
lea r14, [rsp + 0x250]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000b870
lea rdx, str..status
mov rcx, rbx
mov r8, r14
call fcn.140008940
test eax, eax
jne 0x140008a95
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140018400
mov eax, edi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x250]
call int.140025930
test eax, eax
je 0x140008a76
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor edi, edi
lea rcx, [rsp + 0x40]
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140008a76
mov rbx, rax
lea rdi, [rsp + 0x250]
mov rcx, rdi
mov r8d, esi
call fcn.140025a90
mov rcx, rdi
call fcn.1400139a0
mov rsi, rax
mov qword [rsp + 0x20], 0
lea r14, [rsp + 0x3c]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
setne al
cmp dword [r14], esi
sete cl
and cl, al
movzx edi, cl
jmp 0x140008a76
Function at 0x140008c60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x140038120], 0
je 0x140008cfa
mov rsi, rdx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov r9, qword [0x140038120]
lea rcx, str._Warning:
mov edx, 0xd
mov r8d, 1
call fcn.140013050
mov rbx, qword [rsp + 0x30]
mov rdi, qword [0x140038120]
call fcn.140001bf0
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov r8, rsi
xor r9d, r9d
call fcn.14000c204
mov r9, qword [0x140038120]
lea rcx, str._n
mov edx, 4
mov r8d, 1
call fcn.140013050
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140018400
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140008d90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x688
mov rdi, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x680], rax
call fcn.140013abc
xor esi, esi
cmp rax, 0x103
ja 0x140008e36
lea rbx, [rsp + 0x260]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.14000b870
mov rcx, rdi
mov edx, 0x104
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x140008e36
xor esi, esi
lea rbx, [rsp + 0x50]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.14000b870
lea rdx, [rsp + 0x260]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
je 0x140008e36
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.140011950
test eax, eax
je 0x140008e60
xor esi, esi
and sil, 1
mov rcx, qword [rsp + 0x680]
invalid
Function at 0x14000a1b0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140013abc
test rax, rax
je 0x14000a3e4
mov rbx, rax
movzx eax, word [r14 + rax*2 - 2]
cmp eax, 0x5c
je 0x14000a3dc
cmp eax, 0x2f
je 0x14000a3dc
mov rax, rbx
add rax, 2
lea r15, [rbx + rbx + 4]
mov rcx, 0xffffffffffffffff
cmovns rcx, r15
call fcn.14000a420
mov rdi, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000b870
lea r8, [rbx + 1]
mov rcx, rdi
mov rdx, r14
call fcn.140013f84
mov rcx, rdi
call fcn.140011b00
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov qword [rcx], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000a3e8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000a41b
add ebx, ebx
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000a41b
lea r9, [rsp + 0x34]
mov dword [r9], 4
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000a41b
lea r14, [rsp + 0x30]
mov r15d, dword [r14]
mov rcx, r15
call fcn.14000a420
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000b870
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, rbx
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000a41b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000a345
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000a357
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.14000a438
lea rdx, str.SOFTWAREMozillaMaintenanceService_
mov r8d, 0x104
mov rcx, rsi
call fcn.140013f84
mov ebp, 1
cmp dword [rsp + 0x30], 0
je 0x14000a3b3
add rsi, 0x48
xor r14d, r14d
lea rdi, str._.2x
mov r15, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [rbx + r14]
mov rcx, rsi
mov rdx, rdi
call r15
add rsi, 4
inc r14
mov eax, dword [rsp + 0x30]
cmp r14, rax
jb 0x14000a395
mov rdi, rbx
mov rcx, rdi
call fcn.14000a438
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018400
mov eax, ebp
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
dec rbx
jmp 0x14000a1fc
xor ebp, ebp
jmp 0x14000a3be
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14000a41b
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14000a278
xor ebp, ebp
jmp 0x14000a3b6
Function at 0x140025b00
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [0x14002fa8c]
call fcn.140011f90
test rax, rax
je 0x140025b77
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8d, 2
call fcn.140012944
mov ebp, 6
test eax, eax
je 0x140025b7e
mov rcx, rsi
call fcn.140012090
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140018400
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 6
jmp 0x140025b57
mov rcx, rsi
call fcn.140012b54
test eax, eax
jle 0x140025b4f
mov r14d, eax
lea rcx, [r14 + 1]
call fcn.14000a420
mov rbx, rax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.140012944
mov ebp, 6
test eax, eax
je 0x140025bb9
mov rcx, rbx
call fcn.14000a438
jmp 0x140025b4f
mov edx, 1
mov rcx, rbx
mov r8, r14
mov r9, rsi
call fcn.1400126b0
cmp rax, r14
jne 0x140025baf
mov byte [rbx + r14], 0
lea r14, [rsp + 0x38]
mov qword [r14], rbx
lea r15, [0x14002cfb0]
xor r12d, r12d
xor r13d, r13d
mov rcx, r15
mov rdx, r14
call fcn.140025830
test rax, rax
je 0x140025cde
mov rbp, rax
movzx eax, byte [rax]
cmp eax, 0x23
je 0x140025beb
cmp eax, 0x3b
je 0x140025beb
jmp 0x140025c17
mov al, byte [rbp + 1]
inc rbp
cmp al, 9
je 0x140025c11
movzx ecx, al
cmp ecx, 0x20
je 0x140025c11
mov qword [rsp + 0x30], rbp
test al, al
je 0x140025beb
cmp ecx, 0x5b
jne 0x140025c57
inc rbp
mov qword [rsp + 0x30], rbp
lea rcx, [0x14002cfb6]
lea r13, [rsp + 0x30]
mov rdx, r13
call fcn.140025830
test rax, rax
je 0x140025be8
jmp 0x140025cef
test r13b, 1
je 0x140025beb
lea rcx, [0x14002cfb8]
lea rdx, [rsp + 0x30]
call fcn.140025830
test rax, rax
je 0x140025beb
mov rcx, rbp
call fcn.140025d30
test eax, eax
jne 0x140025beb
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
call fcn.1400139a0
lea rcx, [rax + 1]
mov qword [rsp + 0x20], rcx
call fcn.14000a420
mov rbp, rax
mov rcx, rax
xor edx, edx
mov r8, qword [rsp + 0x20]
call fcn.14000b870
mov rcx, qword [rdi]
mov qword [rdi], rbp
test rcx, rcx
je 0x140025cc9
call fcn.14000a438
mov rbp, qword [rdi]
mov rcx, rbp
mov rdx, qword [rsp + 0x28]
call fcn.1400134c0
inc r12d
jmp 0x140025beb
xor eax, eax
cmp r12d, 1
setne al
lea ebp, [rax + rax*4]
jmp 0x140025baf
lea rcx, [0x14002cfb3]
mov rdx, r13
call fcn.140025830
test rax, rax
jne 0x140025be8
mov rcx, rbp
lea rdx, str.Strings
call fcn.1400133a0
test eax, eax
sete r13b
jmp 0x140025beb
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400554e0]
mov dword [rax], 1
mov rax, qword [0x1400554f0]
mov dword [rax], 1
mov rax, qword [0x140055500]
mov dword [rax], 1
mov rax, qword [0x140055490]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret