joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fc6c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x38
mov rbp, rcx
xor ecx, ecx
mov dil, 1
call fcn.1400f4570
xor esi, esi
mov r14, rax
test rax, rax
je 0x1400fc75b
mov rcx, qword [r14 + 8]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, str.NoRemnantScan
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
jne 0x1400fc73d
cmp dword [rsp + 0x68], esi
movzx edi, dil
cmovne edi, esi
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
test dil, dil
jne 0x1400fc75b
xor al, al
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp byte [rbp + 0x23], sil
sete al
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400fd5f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rsi
mov rbx, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400fd727
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, word [0x14042149c]
cmp cx, word [rax]
jne 0x1400fd6b4
lea rcx, vtable.Core::Text::UnicodeEncoding.0
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.14020fa10
mov rbx, rax
mov edx, dword [rax + 0xc]
mov rcx, rsi
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsi + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsi]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
mov rcx, rsi
call fcn.140203bb0
nop
cmp dword [rsp + 0x40], 0
jle 0x1400fd6b2
mov rcx, qword [rsp + 0x38]
call fcn.1402bd0e0
nop
jmp 0x1400fd71c
lea rcx, vtable.Core::Text::ASCIIEncoding.0
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140207990
mov rbx, rax
mov edx, dword [rax + 0xc]
mov rcx, rsi
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsi + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsi]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
mov rcx, rsi
call fcn.140203bb0
nop
cmp dword [rsp + 0x40], 0
jle 0x1400fd71c
mov rcx, qword [rsp + 0x38]
call fcn.1402bd0e0
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400fd7b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov rsi, rcx
mov edx, 0x136
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400fd880
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400fd87e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov r14d, edi
shr rdi, 5
mov ecx, 0x40
call fcn.1402bcb4c
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400fd83f
mov rdx, rdi
mov rcx, rax
call fcn.14011bd60
nop
mov qword [rsi + 0x4e8], rax
lea rdi, [r14 + rbx]
cmp rbx, rdi
jae 0x1400fd875
nop
movzx r9d, byte [0x14043124b]
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, qword [rsi + 0x4e8]
call fcn.14011db70
add rbx, 0x20
cmp rbx, rdi
jb 0x1400fd850
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1400fead0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x278], 0
mov rdi, rcx
je 0x1400feaeb
mov al, 1
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
mov r9, rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1400feb30]
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
test rax, rax
mov qword [rdi + 0x278], rax
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x140100b80
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebp, 1
xor edx, edx
xor ecx, ecx
mov r8d, ebp
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140100c0f
lea r8d, [rbp + 3]
lea rdx, str.hitmanpro37
mov rcx, rax
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x140100c01
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140100bf8
cmp dword [rsp + 0x24], 4
movzx ebx, bl
cmove ebx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x60]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140100c30
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp word [0x140431890], 0
jne 0x140100c9a
lea rbx, [0x140431890]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.drivers_
mov edx, 0x104
mov rcx, rbx
call fcn.1402bf098
lea r8, str.hitmanpro37
mov edx, 0x104
mov rcx, rbx
call fcn.1402bf098
lea r8, str..sys
mov edx, 0x104
mov rcx, rbx
call fcn.1402bf098
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x140431890]
add rsp, 0x20
pop rbx
ret

Function at 0x140100cb0
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x48
xor dil, dil
call fcn.140100c30
mov edx, 1
lea ecx, [rdx + 5]
mov r8d, edx
mov rsi, rax
call fcn.1400ce2e0
xor r13d, r13d
mov ecx, r13d
test al, al
lea r8d, [r13 + 0xa]
setne cl
add ecx, 0x12d
movzx edx, cx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140100d1d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__d_while_trying_to_driver__resource__r_n
mov edx, eax
call fcn.1402bd818
mov al, 1
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x140100d64
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadResource___failed___d__r_n
mov edx, eax
call fcn.1402bd818
jmp 0x140100e60
mov rcx, rax
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], r12
call qword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, r13d
mov r12, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x80
mov qword [rsp + 0x30], r13
cmp eax, 0xffffffff
mov edx, 0x1f01ff
cmove eax, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x140100dea
test ebx, ebx
jne 0x140100dcd
call fcn.140101300
jmp 0x140100e2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateFile___on___s__failed___d__r_n
mov rdx, rsi
mov r8d, eax
call fcn.1402bf424
mov dil, 1
jmp 0x140100e2b
lea r9, [rsp + 0x70]
mov r8d, r14d
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140100e24
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.WriteFile___on___s__failed___d__r_n
mov rdx, rsi
mov r8d, eax
call fcn.1402bf424
mov dil, 1
jmp 0x140100e2b
cmp dword [rsp + 0x70], r14d
je 0x140100e38
inc ebx
cmp ebx, 2
jl 0x140100d80
jmp 0x140100e3b
xor dil, dil
mov r12, qword [rsp + 0x80]
cmp rbp, 0xffffffffffffffff
je 0x140100e52
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x88]
mov r15, qword [rsp + 0x40]
movzx eax, dil
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x140101300
Capabilities:
Check for time delay via gettickcount
Delete file
Delete service
Query service status
Stop service

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x14010145a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str.hitmanpro37
mov r8d, 0x10024
mov rcx, rdi
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140101441
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140101394
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SERVICE_CONTROL_STOP_failed__d_r_n
mov edx, eax
call fcn.1402bd818
cmp dword [rsp + 0x3c], 3
jne 0x14010142f
mov qword [rsp + 0x88], rbp
mov ebp, 0x1388
nop dword [rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x50]
shr edx, 3
cmp edx, 0x3e8
jae 0x1401013cb
mov edx, 0x3e8
jmp 0x1401013d0
cmp edx, ebp
cmova edx, ebp
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 0x24
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140101427
mov edx, dword [rsp + 0x3c]
cmp edx, 1
je 0x140101427
lea rcx, str.Waiting_for_driver_to_stop__status_08x_..._r_n
call fcn.1402bd818
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x2710
ja 0x140101427
cmp dword [rsp + 0x3c], 3
je 0x1401013b0
mov rbp, qword [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
call fcn.140100c30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0x70
pop rdi
ret
Function at 0x140101620
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x760], rax
lea rsi, [0x14034d1a0]
mov qword [rsp + 0x30], rsi
xor edi, edi
mov qword [rsp + 0x38], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov r8d, 0x400
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140101690
mov qword [rsp + 0x28], rdi
test ebx, ebx
jne 0x1401016aa
mov qword [rsp + 0x20], rsi
jmp 0x1401016d1
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.1400d5970
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1402028a0
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsp + 0x38]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.140203bb0
nop
cmp dword [rsp + 0x50], 0
jle 0x140101737
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x28], 0
jle 0x140101748
mov rcx, qword [rsp + 0x20]
call fcn.1402bd0e0
lea rdx, [rsp + 0x30]
lea rcx, [0x140101480]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x40]
cmp dword [rsp + 0x38], 0
jle 0x140101770
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
mov rax, rbx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1401069a0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0xe0
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, r8
mov rbx, rdx
mov rbp, rcx
call fcn.140115d10
test al, al
je 0x1401069db
mov byte [r14], 1
mov al, 1
jmp 0x140106b08
mov rdx, rbx
mov rcx, rbp
call fcn.1400fb230
test rax, rax
je 0x140106b26
mov r9, qword [rax]
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0xd0], rdi
call qword [r9 + 0x30]
mov rdi, rax
test rax, rax
je 0x140106b24
mov ecx, 0x10000
mov qword [rsp + 0xd8], rsi
xor ebx, ebx
call fcn.1402bd120
mov r10, qword [rdi]
lea r9, [rsp + 0x20]
mov rdx, rax
mov r8d, 0x10000
mov rcx, rdi
mov rsi, rax
call qword [r10 + 8]
test al, al
je 0x140106a75
nop word [rax + rax]
add ebx, dword [rsp + 0x20]
mov r10, qword [rdi]
mov r8d, 0x10000
mov edx, ebx
lea r9, [rsp + 0x20]
mov rcx, rdi
add rdx, rsi
sub r8d, ebx
call qword [r10 + 8]
test al, al
jne 0x140106a50
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
lea r8, [rsp + 0x30]
mov edx, ebx
movups xmm0, xmmword [0x14032eb00]
movups xmm1, xmmword [0x14032eb10]
mov rcx, rsi
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm1
call fcn.14018f300
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.14018f3f0
mov rcx, rsi
call fcn.1402bd0e0
mov rbx, qword [rbp + 0x4e8]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.14011cbd0
mov rax, qword [rbx]
mov rsi, qword [rsp + 0xd8]
cmp qword [rsp + 0x28], rax
setne al
mov byte [r14], al
mov al, 1
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0xe0
pop r14
pop rbp
pop rbx
ret
jmp 0x140106b00
jmp 0x140106b08
Function at 0x140106b30
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0xf0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, rdx
mov rsi, rcx
lea rax, vtable.Core::ByteArray.0
mov qword [rsp + 0x20], rax
xor ebp, ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14020c740
test al, al
je 0x140106c0d
mov edx, dword [rsp + 0x28]
mov eax, 0x10000
cmp edx, eax
cmovg edx, eax
mov qword [rsp + 0x50], rbp
movups xmm0, xmmword [0x14032eb00]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [0x14032eb10]
movups xmmword [rsp + 0x68], xmm1
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.14018f300
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.14018f3f0
mov rbx, qword [rsi + 0x4e8]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14011cbd0
mov rax, qword [rbx]
cmp qword [rsp + 0x40], rax
je 0x140106c0d
mov bl, 1
jmp 0x140106c0f
xor bl, bl
cmp qword [rsp + 0x30], 0
je 0x140106c29
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x140107a50
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx ecx, word [0x140431680]
lea rbx, [0x140431680]
test cx, cx
jne 0x140107a90
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [0x140431680]
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140107a94
cmp rax, 2
jb 0x140107b12
cmp word [0x140431682], 0x3a
jne 0x140107b12
movabs rax, 0x5c003a0043
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov word [rsp + 0x48], cx
xor ecx, ecx
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140107b12
test dword [rsp + 0x40], 0x80000
je 0x140107b12
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0x60
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0x60
pop rbx
ret
Function at 0x140108610
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp word [0x140431680], 0
mov rdi, rcx
jne 0x14010863c
lea rdx, [0x140431680]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dl, 1
mov ecx, 0x2af8
call fcn.14010d910
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x140108663
mov rcx, qword [rdi]
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, [0x140431680]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x1401086cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x14010869f
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401086b8
mov r8, qword [rdi]
lea rdx, [0x140431680]
lea rcx, str.CopyFileW__ls_____ls_failed__d_r_n
mov r9d, eax
call fcn.1402bd818
inc ebx
cmp ebx, 0xf0
jl 0x140108670
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140109ef0
Capabilities:
Delete file
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rcx
mov eax, dword [0x140431ac0]
test al, 1
jne 0x140109f3f
or eax, 1
mov dword [0x140431ac0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x140431ac8], rax
mov qword [0x140431ad0], 0xffffffff80000002
lea rcx, [0x1403050b0]
call fcn.1402be804
lea rdx, [0x140352cb8]
lea rcx, [0x140431ac8]
call fcn.1400ece40
mov rbx, rax
test rax, rax
je 0x14010a015
xor eax, eax
mov qword [rsp + 0x40], rax
lea edx, [rax + 0x13]
lea rcx, [rsp + 0x38]
call fcn.1402028a0
mov ecx, dword [rsp + 0x40]
inc ecx
movsxd rdx, ecx
mov r9d, 0x13
lea r8, str.yyyy_MM_dd_HH:mm:ss
mov rcx, qword [rsp + 0x38]
call fcn.1402c06dc
mov edx, 0x13
lea rcx, [rsp + 0x38]
call fcn.140203bb0
nop
call fcn.1401167f0
mov rcx, rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
call fcn.1400d83a0
mov ecx, dword [rax + 0xc]
mov rdx, qword [rax]
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastCFU
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [rsp + 0x50], 0
jle 0x140109ff7
mov rcx, qword [rsp + 0x48]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x40], 0
jle 0x14010a008
mov rcx, qword [rsp + 0x38]
call fcn.1402bd0e0
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
xor edx, edx
mov ecx, 0x2710
call fcn.14010d910
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
call fcn.14010a0a0
test al, al
jne 0x14010a046
call fcn.14010acb0
test al, al
jne 0x14010a046
call fcn.14010b620
test bl, bl
jne 0x14010a05e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error__d_while_trying_to_delete_the_downloaded_update_file._r_n
call fcn.1402bf424
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14010bd40
Capabilities:
Delete directory
Delete file

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rdi, rcx
xor edx, edx
mov ecx, 0x2710
call fcn.14010d910
mov rdx, qword [rdi]
test rdx, rdx
je 0x14010bedc
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rdx + rax*2], 0
jne 0x14010bd81
test rax, rax
je 0x14010bedc
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.1400d4470
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14010bed1
nop
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x14010bdb0
test rbx, rbx
je 0x14010bed1
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x14010becd
lea rsi, vtable.Core::Array_class_Core::String_.0
mov qword [rbp - 0x20], rsi
xor edi, edi
mov dword [rbp - 0x18], edi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 0x40], rdi
lea edx, [rdi + 1]
lea rcx, [rbp - 0x48]
call fcn.1402028a0
mov eax, dword [rbp - 0x40]
inc eax
movsxd rdx, eax
lea r9d, [rdi + 1]
lea r8, [0x1403526ec]
mov rcx, qword [rbp - 0x48]
call fcn.1402c06dc
lea edx, [rdi + 1]
lea rcx, [rbp - 0x48]
call fcn.140203bb0
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400ee2e0
movzx ebx, al
cmp dword [rbp - 0x40], edi
jle 0x14010be43
mov rcx, qword [rbp - 0x48]
call fcn.1402bd0e0
test bl, bl
je 0x14010bea4
cmp dword [rbp - 0x18], 0
jne 0x14010bea4
mov qword [rbp - 0x48], rsi
mov dword [rbp - 0x40], edi
mov qword [rbp - 0x38], rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400edfe0
test al, al
je 0x14010be7a
cmp dword [rbp - 0x40], 0
jne 0x14010be7a
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14010bea4
lea rbx, [rcx - 8]
lea r9, [fcn.140005eb0]
mov r8d, dword [rbx]
mov edx, 0x10
call fcn.1402bda84
mov rcx, rbx
call fcn.1402bcebc
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14010becd
lea rbx, [rcx - 8]
lea r9, [fcn.140005eb0]
mov r8d, dword [rbx]
mov edx, 0x10
call fcn.1402bda84
mov rcx, rbx
call fcn.1402bcebc
mov rcx, qword [rbp - 0x30]
cmp dword [rbp - 0x28], 0
jle 0x14010bedc
call fcn.1402bd0e0
mov al, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret