joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000698c
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14007e4a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r14, rax
test rax, rax
je 0x140006b0a
mov rdx, qword [rdi + 8]
mov r8d, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbp, rax
test rax, rax
je 0x140006abc
mov rdx, qword [rdi + 0x10]
lea rcx, str.Starting_up__s.
call fcn.140006bc0
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140006a76
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140005cec
cmp qword [rax + 0x18], 8
jb 0x140006a26
mov rax, qword [rax]
mov rdx, qword [rdi + 0x10]
lea rcx, str._n_s_failed_to_start:__s_n
mov r8, rax
call fcn.140006bc0
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140006a56
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
call fcn.140002570
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140006aff
cmp dword [rdi + 0x28], 2
jne 0x140006a92
lea rcx, [0x14005df20]
call fcn.140006bc0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rdi + 0x24]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140006a64
mov ebx, dword [rdi + 0x28]
lea rax, str._n_s_failed_to_start._n
mov rdx, qword [rdi + 0x10]
lea rcx, str._n_s_started._n
cmp ebx, 4
cmovne rcx, rax
call fcn.140006bc0
cmp ebx, 4
sete sil
jmp 0x140006a56
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140005cec
cmp qword [rax + 0x18], 8
jb 0x140006ad3
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.OpenService_failed____s_n
call fcn.140006bc0
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140006aff
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
call fcn.140002570
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140006b4d
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140005cec
cmp qword [rax + 0x18], 8
jb 0x140006b21
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.OpenSCManager_failed____s_n
call fcn.140006bc0
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140006b4d
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
call fcn.140002570
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140020250
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140006d6c
Capabilities:
Query or enumerate registry key

Disassembly:
test r8, r8
je 0x140006fb6
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov rax, qword [0x14007e4a8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov rdx, qword [r8]
mov rcx, r8
call fcn.140003cb0
mov rax, qword [r14]
mov qword [rax], rax
mov rax, qword [r14]
mov qword [rax + 8], rax
mov qword [r14 + 8], r12
mov ebx, r12d
mov qword [rbp - 0x19], rbx
mov dword [rbp - 0x11], r12d
mov qword [rbp - 9], r12
mov qword [rbp - 0x21], r12
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006e0b
mov eax, r12d
mov rbx, qword [rbp - 0x21]
mov qword [rbp - 0x19], rbx
mov dword [rbp - 0x11], r12d
test eax, eax
jne 0x140006f82
mov dword [rbp - 0x29], r12d
mov dword [rbp - 0x25], r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rax, [rbp - 0x25]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140006f71
cmp dword [rbp - 0x29], r12d
jbe 0x140006f71
mov r15d, dword [rbp - 0x25]
inc r15d
mov ecx, r15d
mov eax, 2
mul rcx
mov r13, 0xffffffffffffffff
cmovo rax, r13
lea rdx, [0x140061b68]
mov rcx, rax
call fcn.140020364
mov rsi, rax
test rax, rax
je 0x140006f71
mov edi, r12d
cmp dword [rbp - 0x29], r12d
jbe 0x140006f69
mov dword [rbp - 0x21], r15d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x21]
mov r8, rsi
mov edx, edi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140006f5e
cmp dword [rbp - 0x21], r12d
jbe 0x140006f5e
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r12w
mov r8, r13
inc r8
cmp word [rsi + r8*2], r12w
jne 0x140006efb
mov rdx, rsi
lea rcx, [rbp - 1]
call fcn.140005460
nop
lea r8, [rbp - 1]
mov rdx, qword [r14]
mov rcx, r14
call fcn.140006c7c
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x140006f5e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fb7
call fcn.14001ff30
inc edi
cmp edi, dword [rbp - 0x29]
jb 0x140006eb3
mov rcx, rsi
call fcn.14001ff30
test rbx, rbx
je 0x140006f82
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r12
test rbx, rbx
je 0x140006f90
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.140020250
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002fe4c
nop
int3
Function at 0x140007550
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14007e4a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov eax, r8d
mov edi, r8d
xor edi, 8
and al, 8
cmove edi, r8d
test rcx, rcx
jne 0x140007589
xor eax, eax
jmp 0x14000762f
xor ebp, ebp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140061078]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rbx
test eax, eax
jns 0x1400075b8
mov edi, ebp
jmp 0x14000761e
mov r9, rsi
mov r8, rbx
lea rdx, [0x140060618]
lea rcx, [rsp + 0x30]
call fcn.1400073e0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
mov r8d, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000760b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
call fcn.140002570
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
test rbx, rbx
je 0x14000762c
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140020250
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
xor r8d, r8d
xor edx, edx
jmp 0x140007550

Function at 0x140007cf4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
test rcx, rcx
je 0x140007d73
cmp di, word [rcx]
je 0x140007d73
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140007d1c
lea eax, [rdi + 2]
jmp 0x140007d78
xor ecx, ecx
call fcn.140007a2c
mov rdx, rbx
mov rcx, rax
call fcn.14000caa0
test eax, eax
je 0x140007d6f
mov edx, dword [0x14006086c]
lea rax, [0x140080888]
mov qword [rsp + 0x28], rax
lea r9, [0x14007e230]
mov eax, dword [reloc.OLEAUT32.dll_VariantClear]
lea r8, str.Intel_Corporation
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.14000a064
test eax, eax
jne 0x140007d6f
mov eax, 5
jmp 0x140007d78
xor eax, eax
jmp 0x140007d78
mov eax, 0x57
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14000a800
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8, [0x14000aba0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x14000a85a
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x14000a85a
lea eax, [rbx + 1]
jmp 0x14000a85c
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000b2c8
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor edi, edi
mov r12, rdx
mov r14, rcx
test rcx, rcx
je 0x14000b41c
test rdx, rdx
je 0x14000b41c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebp, 0x8000
mov esi, eax
mov ecx, ebp
call fcn.14001ff64
mov rbx, rax
test rax, rax
jne 0x14000b322
lea edi, [rax + 8]
jmp 0x14000b410
mov r8d, esi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x14000b347
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14000b410
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
jne 0x14000b378
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000b410
mov eax, dword [rsp + 0x70]
mov ebp, edi
shr eax, 3
mov r15b, dil
mov dword [rsp + 0x70], eax
test eax, eax
je 0x14000b3fd
xor eax, eax
mov r13d, ebp
xorps xmm0, xmm0
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x20]
mov rcx, rsi
movups xmmword [rsp + 0x20], xmm0
mov rdx, qword [rbx + r13*8]
lea r9d, [rax + 0x18]
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x14000b3cf
cmp qword [rsp + 0x20], r14
jg 0x14000b3cf
mov eax, dword [rsp + 0x28]
mov rcx, r14
sub rcx, qword [rsp + 0x20]
cmp rcx, rax
jl 0x14000b3d9
inc ebp
cmp ebp, dword [rsp + 0x70]
jae 0x14000b3fd
jmp 0x14000b38c
mov rdx, qword [rbx + r13*8]
mov r9d, 0x104
mov r8, r12
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x14000b3f7
mov r15b, 1
jmp 0x14000b3fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
jne 0x14000b410
mov edi, 5
mov rcx, rbx
call fcn.14001ff30
mov eax, edi
jmp 0x14000b421
mov eax, 0x57
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14000b808
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14007e4a8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
test rcx, rcx
je 0x14000b896
cmp edx, 1
jb 0x14000b896
test rbx, rbx
je 0x14000b896
cmp r9d, 0x10
jne 0x14000b896
and dword [rsp + 0x24], 0
mov r8d, edx
and dword [rsp + 0x20], 0
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.14000b9c0
lea rcx, [rsp + 0x20]
call fcn.14000b8b4
mov r8d, 0x10
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.140022140
xor eax, eax
jmp 0x14000b899
or eax, 0xffffffff
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140020250
add rsp, 0xa0
pop rbx
ret
Function at 0x14000ce98
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
lea rbp, [rsp + 0x30]
mov rax, qword [0x14007e4a8]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r14, rdx
mov r15, rcx
mov rsi, qword [rbp + 0x90]
test rsi, rsi
je 0x14000cedf
and dword [rsi], 0
and dword [rbp], 0
mov dword [rbp + 4], 0x1f4
and qword [rbp + 8], 0
mov eax, dword [rsp]
mov eax, 0x210
sub rsp, rax
lea rbx, [rsp + 0x30]
mov eax, dword [rbx]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14000cf18
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x10], rbx
mov qword [rbp + 8], rbx
jmp 0x14000cf36
test rbx, rbx
je 0x14000d09b
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp eax, 0xea
jne 0x14000d047
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14000cf7e
call fcn.1400304b0
and qword [rbp + 8], 0
mov eax, dword [rbp + 4]
lea rcx, [rax + 0x10]
cmp rax, rcx
sbb rdx, rdx
and rdx, rcx
je 0x14000cfff
cmp rdx, 0x400
ja 0x14000cfdb
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x14000cfb1
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140020310
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14000d001
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x14000d001
mov rcx, rdx
call fcn.140030b18
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14000d001
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
jmp 0x14000d001
xor ebx, ebx
mov qword [rbp + 8], rbx
jmp 0x14000d01f
test rbx, rbx
je 0x14000d09b
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x14000d086
cmp dword [rbp], 3
je 0x14000d058
mov edi, 0xd
jmp 0x14000d086
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x80]
lea r8, [rbp]
mov edx, dword [rbp + 4]
mov rcx, rbx
call fcn.14000d2e4
mov edi, eax
test rsi, rsi
je 0x14000d086
mov eax, dword [rbp]
mov dword [rsi], eax
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14000d097
call fcn.1400304b0
mov eax, edi
jmp 0x14000d0a0
mov eax, 0xe
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.140020250
lea rsp, [rbp + 0x38]
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000d0bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x70], rbx
mov rax, qword [0x14007e4a8]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov r15, rcx
mov dword [rbp], 1
and dword [rbp + 4], 0
mov rdi, qword [rbp + 0x80]
test rdi, rdi
je 0x14000d115
mov eax, dword [rdi]
mov dword [rbp + 4], eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
lea r9, [rbp]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test rbx, rbx
je 0x14000d139
mov ecx, dword [rbp]
mov dword [rbx], ecx
cmp dword [rbp], 1
je 0x14000d149
cmp dword [rbp], 7
jne 0x14000d2c6
test rdi, rdi
je 0x14000d2c6
mov ecx, dword [rdi]
test ecx, ecx
je 0x14000d2c6
test eax, eax
je 0x14000d16b
cmp eax, 0xea
jne 0x14000d2c6
mov eax, dword [rbp + 4]
mov dword [rbp + 4], ecx
mov dword [rdi], eax
test r14, r14
je 0x14000d185
mov r8d, eax
xor edx, edx
mov rcx, r14
call fcn.140021f80
and qword [rbp + 0x10], 0
mov eax, dword [rbp + 4]
lea rcx, [rax + 0x10]
cmp rax, rcx
sbb rdx, rdx
and rdx, rcx
je 0x14000d206
cmp rdx, 0x400
ja 0x14000d1e2
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x14000d1b8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140020310
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14000d208
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x14000d208
mov rcx, rdx
call fcn.140030b18
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14000d208
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
jmp 0x14000d208
xor ebx, ebx
mov qword [rbp + 0x10], rbx
jmp 0x14000d22a
test rbx, rbx
jne 0x14000d237
lea eax, [rbx + 0xe]
jmp 0x14000d2c6
mov r8d, dword [rbp + 4]
xor edx, edx
mov rcx, rbx
call fcn.140021f80
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test eax, eax
jne 0x14000d2b3
cmp dword [rbp], 1
jne 0x14000d296
mov eax, dword [rdi]
shr eax, 1
mov dword [rbp + 8], eax
lea r9, [rbp + 8]
mov r8, r14
mov rdx, rbx
lea ecx, [rsi + 3]
call fcn.14000b744
mov esi, eax
mov eax, dword [rbp + 8]
add eax, eax
mov dword [rdi], eax
jmp 0x14000d2b3
cmp dword [rbp], 7
jne 0x14000d2b1
mov r9, rdi
mov r8, r14
mov rdx, rbx
mov rcx, r15
call fcn.14000cd78
mov esi, eax
jmp 0x14000d2b3
xor esi, esi
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14000d2c4
call fcn.1400304b0
mov eax, esi
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.140020250
mov rbx, qword [rbp + 0x70]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e6b8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14007e4a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor ebp, ebp
mov dword [rcx], ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
lea rbx, [rcx + 0x30]
mov qword [rsp + 0x28], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
lea ecx, [rbp + 0x58]
call fcn.14001fef4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov dword [rdi + 0x40], ebp
lea rbx, [rdi + 0x48]
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
test rsi, rsi
je 0x14000e747
mov rdx, rsi
jmp 0x14000e78b
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.140021f80
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea rdx, str.Program_FilesCommon_FilesMcAfeePlatformCore_trusted.js
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400115c0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140020250
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001099c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14007e4a8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140010a0f
cmp byte [rcx + 0x72], 0
je 0x140010a0f
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140010a63
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140010a29
sub eax, 1
je 0x140010a2d
cmp eax, 2
jne 0x140010a63
mov byte [rbx + 0x72], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140020250
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140010a5a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140032bf8
cmp rdi, rax
jne 0x140010a63
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140010a11
xor al, al
jmp 0x140010a11
Function at 0x14001231c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14007e4a8]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14001235e
movzx eax, r14w
jmp 0x14001248d
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14001239a
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x14001239a
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14001248d
cmp qword [rcx + 0x80], r14
je 0x14001248a
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400123d8
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140012401
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140031e48
cmp ax, di
je 0x14001248a
movzx edi, si
jmp 0x14001248a
lea r8, [rbp - 0x38]
mov word [rbp - 0x40], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x3e]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x40]
call qword [rax + 0x38]
test eax, eax
js 0x14001248a
cmp eax, 1
jle 0x14001244f
cmp eax, 3
jne 0x14001248a
movzx ecx, word [rbp - 0x40]
jmp 0x1400123e4
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x140012479
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.140032bf8
cmp r14, rax
jne 0x14001248a
lea rax, [rbp - 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rbp - 0x30], rax
movzx eax, si
jne 0x14001248d
movzx eax, di
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140020250
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret