joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002dcd0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400b0290]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov eax, r8d
mov edi, r8d
xor edi, 8
and al, 8
cmove edi, r8d
test rcx, rcx
jne 0x14002dd09
xor eax, eax
jmp 0x14002ddd3
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140086578]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rbx
test eax, eax
jns 0x14002dd3b
mov edi, ebp
jmp 0x14002ddc2
mov r9, rsi
mov r8, rbx
lea rdx, [0x1400864b8]
lea rcx, [rsp + 0x30]
call fcn.14002db90
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14002ddaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002ddaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddf0
call fcn.140047cd4
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
test rbx, rbx
je 0x14002ddd0
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140047790
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call fcn.14005391c
nop
int3
xor r8d, r8d
xor edx, edx
jmp 0x14002dcd0

Function at 0x14002e600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14002e675
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14002e675
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14002e665
nop
cmp rbx, rcx
jae 0x14002e675
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14002e650
cmp rbx, rcx
jae 0x14002e675
cmp word [rbx], 0
je 0x14002e675
mov rax, rbx
jmp 0x14002e677
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140030820
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
test rdx, rdx
je 0x140030873
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], 0
xor r8d, r8d
lea rcx, [0x140086568]
mov edx, 0x8000
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x38]
test eax, eax
jns 0x140030888
test rbx, rbx
je 0x140030873
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 0x57
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r9, 0xffffffffffffffff
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140053c44
mov edi, eax
test rbx, rbx
je 0x1400308ad
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140031a50
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov edi, r8d
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x140031b53
xor ebp, ebp
cmp bp, word [rdx]
je 0x140031b53
cmp qword [rcx + 0x50], rbp
je 0x140031a88
mov eax, 0xb7
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x60], rsi
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0xa0
mov rcx, rax
mov esi, ebp
mov dword [rsp + 0x20], edi
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov rax, qword [rbx + 0x50]
mov qword [rbx + 0x50], rcx
test rax, rax
je 0x140031ad8
cmp rax, 0xffffffffffffffff
je 0x140031ad8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
cmp rcx, 0xffffffffffffffff
jne 0x140031af7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov qword [rbx + 0x50], rbp
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
cmp edi, 3
jne 0x140031b1a
lea r9d, [rdi - 1]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140031b44
lea r9, [rsp + 0x78]
mov word [rsp + 0x68], 0xfeff
mov r8d, 2
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
mov eax, 0x57
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
Function at 0x140033350
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rsi, rcx
mov rcx, qword [rcx + 0x68]
mov qword [rax - 0x10], r12
mov r12, rdx
mov qword [rax - 0x18], r13
xor r13d, r13d
mov qword [rax - 0x20], r14
mov ebx, r13d
mov qword [rax - 0x28], r15
mov r14d, r9d
mov qword [rax - 0x30], rbx
mov r15, r8
mov dword [rax + 8], r13d
mov dword [rax - 0x38], r13d
test rcx, rcx
je 0x1400333a2
mov edx, 0x1b58
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rsi + 0x98]
mov rcx, rsi
mov edi, 0x57
call qword [case.0x140080788.0]
test al, al
je 0x1400334a2
mov qword [rsp + 0x90], rbp
mov rbp, qword [rsp + 0xa8]
test rbp, rbp
je 0x14003349a
cmp r13w, word [rbp]
je 0x14003349a
mov rcx, rsi
call fcn.140031b60
mov edi, eax
test eax, eax
je 0x1400333fc
cmp eax, 0xb7
jne 0x14003349a
lea rax, [rsp + 0x48]
mov r9d, r14d
mov qword [rsp + 0x38], rax
mov r8, r15
lea rax, [rsp + 0x80]
mov rdx, r12
mov qword [rsp + 0x30], rax
mov rcx, rsi
mov eax, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call fcn.14002fff0
mov rbx, qword [rsp + 0x48]
mov edi, eax
test eax, eax
jne 0x14003349a
test rbx, rbx
jne 0x140033449
lea edi, [rax + 0xe]
jmp 0x14003349a
mov rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], r13w
lea rax, [rax + 1]
jne 0x140033450
mov rcx, qword [rsi + 0x50]
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test byte [rsi + 0x7c], 1
mov ebp, eax
je 0x14003348e
cmp r13w, word [rbx]
je 0x14003348e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebp, ebp
jne 0x14003349a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsi + 0x50]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x68]
lea rax, [rcx - 1]
mov qword [rsi + 0x50], r13
mov r13, qword [rsp + 0x60]
cmp rax, 0xfffffffffffffffd
ja 0x1400334ce
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1400334db
mov rcx, rbx
call fcn.140053564
mov rcx, qword [rsi + 0x68]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x88]
test rcx, rcx
je 0x1400334fa
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
add rsp, 0x70
pop rdi
ret
Function at 0x140036e40
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
xor r15d, r15d
mov qword [rsp + 0x60], r15
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x140086568]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jns 0x140036e8d
lea eax, [r15 + 0x57]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x68], rdi
mov rcx, 0xffffffffffffffff
test rdi, rdi
je 0x140036f8a
mov rbx, rcx
nop word [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140036eb0
test ebx, ebx
je 0x140036f8a
mov r9, qword [rsi]
mov r14d, dword [r9 - 0x10]
mov rbp, rdi
sub rbp, r9
sar rbp, 1
test ebx, ebx
js 0x14003701a
mov ecx, 1
sub ecx, dword [r9 - 8]
mov eax, dword [r9 - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140036efa
mov edx, ebx
mov rcx, rsi
call fcn.14002e390
mov r9, qword [rsi]
movsxd r8, ebx
add r8, r8
cmp rbp, r14
ja 0x140036f36
lea rdx, [r9 + rbp*2]
test r8, r8
je 0x140036f6e
test rdx, rdx
jne 0x140036f20
call fcn.140053a68
mov dword [rax], 0x16
jmp 0x140036f69
movsxd rax, dword [r9 - 0xc]
add rax, rax
cmp rax, r8
jb 0x140036f5e
mov rcx, r9
call fcn.140049a30
jmp 0x140036f6e
movsxd rax, dword [r9 - 0xc]
add rax, rax
test r8, r8
je 0x140036f6e
mov rcx, r9
cmp rax, r8
jb 0x140036f54
mov rdx, rdi
call fcn.140049a30
jmp 0x140036f6e
mov r8, rax
xor edx, edx
call fcn.14004a0e0
call fcn.140053a68
mov dword [rax], 0x22
call fcn.1400538fc
mov rax, qword [rsi]
cmp ebx, dword [rax - 0xc]
jg 0x14003701a
mov dword [rax - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rsi]
mov word [rax + rcx*2], r15w
jmp 0x140036fee
mov r8, qword [rsi]
lea rdx, [r8 - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140036fee
mov eax, dword [rdx + 0x10]
shr eax, 0x1f
test al, al
je 0x140036fb8
cmp dword [r8 - 0xc], 0
jl 0x14003700f
mov dword [r8 - 0x10], r15d
mov rax, qword [rsi]
mov word [rax], r15w
jmp 0x140036fee
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140036fd2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140080788.0]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x140080788.0]
add rax, 0x18
mov qword [rsi], rax
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x140036ffc
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.14002de50
nop
mov ecx, 0x80070057
call fcn.14002de50
int3
Function at 0x140038e58
Capabilities:
Check if file exists

Disassembly:
mov rcx, rdx
jmp 0x140038e58
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x140038ed7
cmp di, word [rcx]
je 0x140038ed7
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140038e80
lea eax, [rdi + 2]
jmp 0x140038edc
xor ecx, ecx
call fcn.140038b88
mov rdx, rbx
mov rcx, rax
call fcn.14003d620
test eax, eax
je 0x140038ed3
mov edx, dword [0x14008720c]
lea rax, [0x1400b33b8]
mov qword [rsp + 0x28], rax
lea r9, [0x1400b0160]
mov eax, dword [0x1400871f4]
lea r8, str.Intel_Corporation
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.14003ad34
test eax, eax
jne 0x140038ed3
mov eax, 5
jmp 0x140038edc
xor eax, eax
jmp 0x140038edc
mov eax, 0x57
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14003b4d8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x14003b820]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14003b532
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14003b532
lea eax, [rbx + 1]
jmp 0x14003b534
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14003c388
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1400b0290]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
test rcx, rcx
je 0x14003c416
cmp edx, 1
jb 0x14003c416
test rbx, rbx
je 0x14003c416
cmp r9d, 0x10
jne 0x14003c416
and dword [rsp + 0x24], 0
mov r8d, edx
and dword [rsp + 0x20], 0
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.14003c540
lea rcx, [rsp + 0x20]
call fcn.14003c434
mov r8d, 0x10
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.140049a30
xor eax, eax
jmp 0x14003c419
or eax, 0xffffffff
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140047790
add rsp, 0xa0
pop rbx
ret
Function at 0x14003d9f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
lea rbp, [rsp + 0x30]
mov rax, qword [0x1400b0290]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r14, rdx
mov r15, rcx
mov rsi, qword [rbp + 0x90]
test rsi, rsi
je 0x14003da3f
and dword [rsi], 0
and dword [rbp], 0
mov dword [rbp + 4], 0x1f4
and qword [rbp + 8], 0
mov eax, dword [rsp]
mov eax, 0x210
sub rsp, rax
lea rbx, [rsp + 0x30]
mov eax, dword [rbx]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14003da78
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x10], rbx
mov qword [rbp + 8], rbx
jmp 0x14003da96
test rbx, rbx
je 0x14003dbfb
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp eax, 0xea
jne 0x14003dba7
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14003dade
call fcn.140053564
and qword [rbp + 8], 0
mov eax, dword [rbp + 4]
lea rcx, [rax + 0x10]
cmp rax, rcx
sbb rdx, rdx
and rdx, rcx
je 0x14003db5f
cmp rdx, 0x400
ja 0x14003db3b
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x14003db11
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400480b0
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14003db61
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x14003db61
mov rcx, rdx
call fcn.140053b5c
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14003db61
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
jmp 0x14003db61
xor ebx, ebx
mov qword [rbp + 8], rbx
jmp 0x14003db7f
test rbx, rbx
je 0x14003dbfb
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x14003dbe6
cmp dword [rbp], 3
je 0x14003dbb8
mov edi, 0xd
jmp 0x14003dbe6
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x80]
lea r8, [rbp]
mov edx, dword [rbp + 4]
mov rcx, rbx
call fcn.14003de44
mov edi, eax
test rsi, rsi
je 0x14003dbe6
mov eax, dword [rbp]
mov dword [rsi], eax
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14003dbf7
call fcn.140053564
mov eax, edi
jmp 0x14003dc00
mov eax, 0xe
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.140047790
lea rsp, [rbp + 0x38]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003dc1c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x70], rbx
mov rax, qword [0x1400b0290]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov r15, rcx
mov dword [rbp], 1
and dword [rbp + 4], 0
mov rdi, qword [rbp + 0x80]
test rdi, rdi
je 0x14003dc75
mov eax, dword [rdi]
mov dword [rbp + 4], eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
lea r9, [rbp]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test rbx, rbx
je 0x14003dc99
mov ecx, dword [rbp]
mov dword [rbx], ecx
cmp dword [rbp], 1
je 0x14003dca9
cmp dword [rbp], 7
jne 0x14003de26
test rdi, rdi
je 0x14003de26
mov ecx, dword [rdi]
test ecx, ecx
je 0x14003de26
test eax, eax
je 0x14003dccb
cmp eax, 0xea
jne 0x14003de26
mov eax, dword [rbp + 4]
mov dword [rbp + 4], ecx
mov dword [rdi], eax
test r14, r14
je 0x14003dce5
mov r8d, eax
xor edx, edx
mov rcx, r14
call fcn.14004a0e0
and qword [rbp + 0x10], 0
mov eax, dword [rbp + 4]
lea rcx, [rax + 0x10]
cmp rax, rcx
sbb rdx, rdx
and rdx, rcx
je 0x14003dd66
cmp rdx, 0x400
ja 0x14003dd42
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x14003dd18
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400480b0
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14003dd68
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x14003dd68
mov rcx, rdx
call fcn.140053b5c
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14003dd68
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
jmp 0x14003dd68
xor ebx, ebx
mov qword [rbp + 0x10], rbx
jmp 0x14003dd8a
test rbx, rbx
jne 0x14003dd97
lea eax, [rbx + 0xe]
jmp 0x14003de26
mov r8d, dword [rbp + 4]
xor edx, edx
mov rcx, rbx
call fcn.14004a0e0
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test eax, eax
jne 0x14003de13
cmp dword [rbp], 1
jne 0x14003ddf6
mov eax, dword [rdi]
shr eax, 1
mov dword [rbp + 8], eax
lea r9, [rbp + 8]
mov r8, r14
mov rdx, rbx
lea ecx, [rsi + 3]
call fcn.14003c2c4
mov esi, eax
mov eax, dword [rbp + 8]
add eax, eax
mov dword [rdi], eax
jmp 0x14003de13
cmp dword [rbp], 7
jne 0x14003de11
mov r9, rdi
mov r8, r14
mov rdx, rbx
mov rcx, r15
call fcn.14003d8d8
mov esi, eax
jmp 0x14003de13
xor esi, esi
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14003de24
call fcn.140053564
mov eax, esi
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.140047790
mov rbx, qword [rbp + 0x70]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003e1bc
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
and qword [rcx + 8], 0
mov rbx, rcx
and qword [rcx + 0x10], 0
xor edx, edx
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
and qword [rcx + 0x28], 0
and qword [rcx + 0x30], 0
and qword [rcx + 0x38], 0
lea rcx, str.mfehida.dll
call fcn.14003ee00
mov qword [rbx], rax
test rax, rax
je 0x14003e28e
lea rdx, str.MPTMappedFileHelperInitialize
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTGetModuleFileName
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTGetModuleFileNameEx
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTGetMappedFileName
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTGetProcessImageFileName
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTQueryFullProcessImageName
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.MPTMappedFileHelperTerminate
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14003e3c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, r9
lea rax, [r11 - 0x20]
mov rdi, r8
mov qword [r11 - 0x38], rax
mov r14, rdx
mov r15b, cl
mov r9d, 0x20219
lea rdx, str.SoftwareMcAfeeSystemCore
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, 3
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
cmove rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x14003e4ad
lea eax, [rbp*2]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rdi
mov rcx, rsi
lea rdx, str.szInstallDir32
test r15b, r15b
jne 0x14003e459
lea rdx, str.szInstallDir64
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14003e4a4
test rdi, rdi
je 0x14003e4a4
lea r8, [0x140086684]
mov rdx, rbp
mov rcx, rdi
call fcn.14003bf30
test eax, eax
js 0x14003e497
test r14, r14
je 0x14003e4a4
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call fcn.14003bf30
test eax, eax
jns 0x14003e4a4
mov ecx, 0x6f
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x68]
test ebx, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
sete al
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14004008c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1400b0290]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor ebp, ebp
mov dword [rcx], ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
lea rbx, [rcx + 0x30]
mov qword [rsp + 0x28], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
lea ecx, [rbp + 0x58]
call fcn.140047a48
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov dword [rdi + 0x40], ebp
lea rbx, [rdi + 0x48]
mov qword [rbx], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
test rsi, rsi
je 0x14004011e
mov rdx, rsi
jmp 0x140040162
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.14004a0e0
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea rdx, str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400026d8
nop
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140047790
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret