joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180036578
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rbp, rcx
lea rdx, [rsp + 0x28]
lea rcx, [0x180162940]
call fcn.1800392a0
nop
lea rdx, str.Extensions
lea rcx, [rsp + 0x30]
call fcn.180007f64
nop
mov rdi, qword [rsp + 0x30]
mov r8, rdi
mov edx, dword [rdi - 8]
lea rcx, [rsp + 0x28]
call fcn.180008324
nop
lea rcx, [rdi - 0xc]
lea r15, [0x18015f758]
or r14d, 0xffffffff
cmp rcx, r15
je 0x180036616
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
test eax, eax
jg 0x180036616
call fcn.1800d1434
lea rcx, str._Addins_
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str._Addins_
mov edx, eax
lea rcx, [rbp + 0x18]
call fcn.180003e28
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
test byte [rsp + 0x50], 0x10
je 0x18003670f
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x38]
call fcn.1800041c0
nop
lea rdi, [0x18010d3c4]
mov rbx, qword [rsp + 0x38]
mov rsi, rbx
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1800366f3
lea rdi, [0x18010d50c]
mov rsi, rbx
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1800366f3
lea rdi, [rbx - 0xc]
cmp dword [rdi], 0
jl 0x1800366a4
mov qword [rsp + 0x20], rbx
lock add dword [rdi], 1
jmp 0x1800366c8
mov rax, qword [0x18015f768]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.180003e28
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.180036798
nop
cmp rdi, r15
je 0x18003670f
mov eax, r14d
lock xadd dword [rdi], eax
add eax, r14d
test eax, eax
jg 0x18003670f
mov rcx, rdi
call fcn.1800d1434
jmp 0x18003670f
lea rcx, [rbx - 0xc]
cmp rcx, r15
je 0x18003670f
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
test eax, eax
jg 0x18003670f
call fcn.1800d1434
lea rdx, [rsp + 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180036648
lea rcx, str.__Addins_
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.__Addins_
mov edx, eax
lea rcx, [rbp + 0x18]
call fcn.180008324
nop
mov rcx, qword [rsp + 0x28]
add rcx, 0xfffffffffffffff4
cmp rcx, r15
je 0x180036766
mov eax, r14d
lock xadd dword [rcx], eax
add eax, r14d
test eax, eax
jg 0x180036766
call fcn.1800d1434
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800447ec
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov edi, 1
mov edx, edi
call qword [rax + reloc.WS2_32.dll_htonl]
mov r11, qword [0x18015f768]
mov qword [rsp + 0x78], r11
lea rdx, [rsp + 0x70]
lea rcx, [0x180162940]
call fcn.18001b638
mov r8, qword [rax]
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsi + 8]
lea rdx, str._s_d:_d:_d
lea rcx, [rsp + 0x78]
call fcn.180008f64
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff4
lea r14, [0x18015f758]
cmp rcx, r14
je 0x180044883
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x180044883
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x78]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [rsi + 0x124], 0xffffffff
jne 0x1800448c3
lea rcx, [rbx - 0xc]
cmp rcx, r14
je 0x1800448bc
or edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
test edx, edx
jg 0x1800448bc
call fcn.1800d1434
mov eax, edi
jmp 0x180044943
lea rax, [rsp + 0x80]
mov qword [rsp + 0x88], rax
lea rdx, str.AutoSearch
lea rcx, [rsp + 0x80]
call fcn.1800041c0
mov rdi, rax
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
lea rcx, [rsp + 0x38]
call fcn.1800041c0
nop
mov ecx, dword [rsi + 0x124]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov r8, rax
mov rdx, 0xffffffff80000001
lea rcx, [0x180163340]
call fcn.180009758
or dword [rsi + 0x124], 0xffffffff
lea rcx, [rbx - 0xc]
cmp rcx, r14
je 0x180044941
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x180044941
call fcn.1800d1434
xor eax, eax
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180045824
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8, qword [rsi + 0x60]
lea rdx, str._t_t_tAccepting_changes_on_entry__s...
lea rcx, [0x18015f578]
call fcn.1800098e8
mov r11, qword [0x18015f768]
mov qword [rsp + 0x88], r11
lea rdx, [rsp + 0x90]
lea rcx, [0x180162940]
call fcn.18001b638
mov r8, qword [rax]
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsi + 8]
lea rdx, str._s_d:_d:_d
lea rcx, [rsp + 0x88]
call fcn.180008f64
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xfffffffffffffff4
lea r12, [0x18015f758]
or ebp, 0xffffffff
cmp rcx, r12
je 0x1800458e2
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x1800458e2
mov rcx, qword [rsp + 0x90]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x88]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rax, qword [rsi + 0x128]
cmp dword [rax - 8], 0
jne 0x18004592b
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x180045921
mov edx, ebp
lock xadd dword [rcx], edx
add edx, ebp
test edx, edx
jg 0x180045921
call fcn.1800d1434
mov eax, 1
jmp 0x180045a3c
lea r8, [rsp + 0x98]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAboutURLs
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x18004596f
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x180045965
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x180045965
call fcn.1800d1434
mov eax, 0x80004005
jmp 0x180045a3c
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rdi, qword [rsi + 0x128]
cmp dword [rdi - 0xc], 0
jl 0x1800459a0
mov qword [rsp + 0x80], rdi
lock add dword [rdi - 0xc], 1
mov rbx, qword [rsp + 0x88]
jmp 0x1800459d4
mov rax, qword [0x18015f768]
mov qword [rsp + 0x80], rax
test rdi, rdi
jne 0x1800459b8
xor eax, eax
jmp 0x1800459c1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.180003e28
nop
lea rdx, str.Tabs
lea rcx, [rsp + 0x40]
call fcn.1800041c0
nop
lea r9, [rsp + 0x80]
mov r8, rax
mov rdx, qword [rsp + 0x98]
lea rcx, [0x180163340]
call fcn.18001b580
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsi + 0x128]
call fcn.18001bf24
nop
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x180045a3a
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x180045a3a
call fcn.1800d1434
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180048fc4
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8, qword [rsi + 0x60]
lea rdx, str._t_t_tAccepting_changes_on_entry__s...
lea rcx, [0x18015f578]
call fcn.1800098e8
mov r11, qword [0x18015f768]
mov qword [rsp + 0x88], r11
lea rdx, [rsp + 0x90]
lea rcx, [0x180162940]
call fcn.18001b638
mov r8, qword [rax]
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsi + 8]
lea rdx, str._s_d:_d:_d
lea rcx, [rsp + 0x88]
call fcn.180008f64
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xfffffffffffffff4
lea r12, [0x18015f758]
or ebp, 0xffffffff
cmp rcx, r12
je 0x180049082
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x180049082
mov rcx, qword [rsp + 0x90]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x88]
mov rdx, rbx
mov rdi, 0xffffffff80000001
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rax, qword [rsi + 0x128]
cmp dword [rax - 8], 0
jne 0x1800490ce
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x1800490c4
mov edx, ebp
lock xadd dword [rcx], edx
add edx, ebp
test edx, edx
jg 0x1800490c4
call fcn.1800d1434
mov eax, 1
jmp 0x1800491db
lea r8, [rsp + 0x98]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerSearchScopes
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x18004910e
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x180049104
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x180049104
call fcn.1800d1434
mov eax, 0x80004005
jmp 0x1800491db
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rdi, qword [rsi + 0x128]
cmp dword [rdi - 0xc], 0
jl 0x18004913f
mov qword [rsp + 0x80], rdi
lock add dword [rdi - 0xc], 1
mov rbx, qword [rsp + 0x88]
jmp 0x180049173
mov rax, qword [0x18015f768]
mov qword [rsp + 0x80], rax
test rdi, rdi
jne 0x180049157
xor eax, eax
jmp 0x180049160
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.180003e28
nop
lea rdx, str.DefaultScope
lea rcx, [rsp + 0x40]
call fcn.1800041c0
nop
lea r9, [rsp + 0x80]
mov r8, rax
mov rdx, qword [rsp + 0x98]
lea rcx, [0x180163340]
call fcn.18001b580
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsi + 0x128]
call fcn.18001bf24
nop
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x1800491d9
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x1800491d9
call fcn.1800d1434
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18004a0f4
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8, qword [rsi + 0x60]
lea rdx, str._t_t_tAccepting_changes_on_entry__s...
lea rcx, [0x18015f578]
call fcn.1800098e8
mov r11, qword [0x18015f768]
mov qword [rsp + 0x88], r11
lea rdx, [rsp + 0x90]
lea rcx, [0x180162940]
call fcn.18001b638
mov r8, qword [rax]
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsi + 8]
lea rdx, str._s_d:_d:_d
lea rcx, [rsp + 0x88]
call fcn.180008f64
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xfffffffffffffff4
lea r12, [0x18015f758]
or ebp, 0xffffffff
cmp rcx, r12
je 0x18004a1b2
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x18004a1b2
mov rcx, qword [rsp + 0x90]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x88]
mov rdx, rbx
mov rdi, 0xffffffff80000001
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov rax, qword [rsi + 0x128]
cmp dword [rax - 8], 0
jne 0x18004a1fe
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x18004a1f4
mov edx, ebp
lock xadd dword [rcx], edx
add edx, ebp
test edx, edx
jg 0x18004a1f4
call fcn.1800d1434
mov eax, 1
jmp 0x18004a30b
lea r8, [rsp + 0x98]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x18004a23e
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x18004a234
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x18004a234
call fcn.1800d1434
mov eax, 0x80004005
jmp 0x18004a30b
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rdi, qword [rsi + 0x128]
cmp dword [rdi - 0xc], 0
jl 0x18004a26f
mov qword [rsp + 0x80], rdi
lock add dword [rdi - 0xc], 1
mov rbx, qword [rsp + 0x88]
jmp 0x18004a2a3
mov rax, qword [0x18015f768]
mov qword [rsp + 0x80], rax
test rdi, rdi
jne 0x18004a287
xor eax, eax
jmp 0x18004a290
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.180003e28
nop
lea rdx, str.Start_Page
lea rcx, [rsp + 0x40]
call fcn.1800041c0
nop
lea r9, [rsp + 0x80]
mov r8, rax
mov rdx, qword [rsp + 0x98]
lea rcx, [0x180163340]
call fcn.18001b580
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsi + 0x128]
call fcn.18001bf24
nop
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x18004a309
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x18004a309
call fcn.1800d1434
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18004ac78
Capabilities:
Delete registry key

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov edi, 1
mov edx, edi
call qword [rax + reloc.WS2_32.dll_htonl]
mov r11, qword [0x18015f768]
mov qword [rsp + 0x78], r11
lea rdx, [rsp + 0x70]
lea rcx, [0x180162940]
call fcn.18001b638
mov r8, qword [rax]
mov eax, dword [rsi + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsi + 8]
lea rdx, str._s_d:_d:_d
lea rcx, [rsp + 0x78]
call fcn.180008f64
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff4
lea r14, [0x18015f758]
cmp rcx, r14
je 0x18004ad0f
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x18004ad0f
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x78]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [rsi + 0x124], 0xffffffff
jne 0x18004ad4f
lea rcx, [rbx - 0xc]
cmp rcx, r14
je 0x18004ad48
or edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
test edx, edx
jg 0x18004ad48
call fcn.1800d1434
mov eax, edi
jmp 0x18004adcf
lea rax, [rsp + 0x80]
mov qword [rsp + 0x88], rax
lea rdx, str.NewTabPageShow
lea rcx, [rsp + 0x80]
call fcn.1800041c0
mov rdi, rax
lea rdx, str.SoftwareMicrosoftInternet_ExplorerTabbedBrowsing
lea rcx, [rsp + 0x38]
call fcn.1800041c0
nop
mov ecx, dword [rsi + 0x124]
mov dword [rsp + 0x20], ecx
mov r9, rdi
mov r8, rax
mov rdx, 0xffffffff80000001
lea rcx, [0x180163340]
call fcn.180009758
or dword [rsi + 0x124], 0xffffffff
lea rcx, [rbx - 0xc]
cmp rcx, r14
je 0x18004adcd
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x18004adcd
call fcn.1800d1434
xor eax, eax
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004b1c0
Capabilities:
Check if file exists
Delete file
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
lea rdx, [rsp + 0x68]
lea rcx, [0x180162940]
call fcn.18002afc4
mov rcx, qword [rsp + 0x68]
xor ebx, ebx
mov rdx, qword [rax]
lea rax, [0x18015f758]
cmp dword [rdx - 8], ebx
sete bl
add rcx, 0xfffffffffffffff4
cmp rcx, rax
je 0x18004b219
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x18004b219
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
test ebx, ebx
je 0x18004b235
lea rdx, str.CDataFFFileXMLEntity::InstallEntry_____Search_URL__FF__is_empty._Not_installing...
lea rcx, [0x18015f578]
call fcn.1800098e8
jmp 0x18004b3bc
lea rcx, [0x180162940]
call fcn.180004aa8
test eax, eax
jne 0x18004b24e
lea rdx, str.CDataFFFileXMLEntity::InstallEntry_____Search_Installed__FF__flag_is_FALSE._Not_installing...
jmp 0x18004b224
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1801620dc]
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x18015f578]
test ebx, ebx
jne 0x18004b282
lea rdx, str.CDataFFFileXMLEntity::InstallEntry_____Firefox_not_enabled._Not_installing...
jmp 0x18004b22b
mov r8, qword [rdi + 0x60]
lea rdx, str._t_t_tInstalling_entry__s...
call fcn.1800098e8
mov r11, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [r11 + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x11b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rdi
call fcn.18004b60c
mov rcx, qword [rdi + 0x1198]
cmp dword [rcx - 8], 0
jne 0x18004b2d2
lea r9, str.Installing_entry__s_FAILED_:_common_path_is_empty
mov r8d, 0x44
jmp 0x18004b3a0
cmp qword [rdi + 0x1190], 0
je 0x18004b393
cmp dword [rdi + 0x1188], 0
je 0x18004b393
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18004b30a
lea r9, str.Installing_entry__s_FAILED_:_Common_path_folder_does_not_exist
mov r8d, 0x50
jmp 0x18004b3a0
and qword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x11a0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18004b355
mov rax, qword [rdi + 0x11a0]
lea r9, str.CDataFFFileXMLEntity_:_cannot_create_XML_file_::__s
lea r8d, [rbx + 0x58]
jmp 0x18004b3a4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rdi + 0x1188]
mov rdx, qword [rdi + 0x1190]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004b3bc
lea r9, str.Installing_entry__s_FAILED_:_m_pXMLBuffer_is_empty
mov r8d, 0x4a
mov rax, qword [rdi + 0x60]
lea rdx, str..DataFFFileMLEntity.cpp
lea rcx, [0x18015f578]
mov qword [rsp + 0x20], rax
call fcn.18000b1e8
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18004b3d8
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
lea rdx, [rsp + 0x60]
lea rcx, [0x180162940]
call fcn.18002afc4
mov rcx, qword [rsp + 0x60]
xor ebx, ebx
mov rdx, qword [rax]
lea rax, [0x18015f758]
cmp dword [rdx - 8], ebx
sete bl
add rcx, 0xfffffffffffffff4
cmp rcx, rax
je 0x18004b431
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x18004b431
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
test ebx, ebx
je 0x18004b44f
lea rdx, str.CDataFFFileXMLEntity::RestoreEntity_____Search_URL__FF__is_empty._Not_restoring...
lea rcx, [0x18015f578]
call fcn.1800098e8
xor eax, eax
jmp 0x18004b5c9
lea rcx, [0x180162940]
call fcn.180004aa8
test eax, eax
jne 0x18004b468
lea rdx, str.CDataFFFileXMLEntity::RestoreEntity_____Search_Installed__FF__flag_is_FALSE._Not_restoring...
jmp 0x18004b43c
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1801620dc]
lea rcx, [0x180162138]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x18004b495
lea rdx, str.CDataFFFileXMLEntity::RestoreEntity_____Firefox_not_enabled._Not_restoring...
jmp 0x18004b43c
mov rcx, qword [rdi + 0x1198]
cmp dword [rcx - 8], 0
jne 0x18004b4d5
mov rax, qword [rdi + 0x60]
lea r9, str.Installing_entry__s_FAILED_:_common_path_is_empty
lea rdx, str..DataFFFileMLEntity.cpp
lea rcx, [0x18015f578]
mov r8d, 0x7c
mov qword [rsp + 0x20], rax
call fcn.18000b1e8
mov eax, 1
jmp 0x18004b5c9
cmp qword [rdi + 0x1190], 0
je 0x18004b59b
cmp dword [rdi + 0x1188], 0
je 0x18004b59b
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x18004b50d
lea r9, str.Installing_entry__s_FAILED_:_Common_path_folder_does_not_exist
mov r8d, 0x88
jmp 0x18004b5a8
and qword [rsp + 0x30], 0
mov rcx, qword [rdi + 0x11a0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18004b55a
mov rax, qword [rdi + 0x11a0]
lea r9, str.CDataFFFileXMLEntity_:_cannot_create_XML_file_::__s
mov r8d, 0x8f
jmp 0x18004b5ac
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rdi + 0x1188]
mov rdx, qword [rdi + 0x1190]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18004b448
lea r9, str.Installing_entry__s_FAILED_:_m_pXMLBuffer_is_empty
mov r8d, 0x82
mov rax, qword [rdi + 0x60]
lea rdx, str..DataFFFileMLEntity.cpp
lea rcx, [0x18015f578]
mov qword [rsp + 0x20], rax
call fcn.18000b1e8
mov eax, 0x80004005
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18004e3f4
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [rcx + 0x1190]
mov rdi, rcx
cmp dword [rbx - 0xc], 0
jl 0x18004e41a
mov qword [rsp + 0x40], rbx
lock add dword [rbx - 0xc], 1
jmp 0x18004e447
mov rax, qword [0x18015f768]
mov qword [rsp + 0x40], rax
test rbx, rbx
jne 0x18004e42f
xor eax, eax
jmp 0x18004e438
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x40]
mov r8, rbx
mov edx, eax
call fcn.180003e28
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18004e4d8
mov rcx, qword [rdi + 0x1258]
mov ebx, eax
test rcx, rcx
je 0x18004e471
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18004e4cb
mov rcx, qword [rdi + 0x1258]
test rcx, rcx
je 0x18004e483
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x28], 0
lea r9, [rdi + 0x1250]
lea r8, [0x180009f74]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xfffffff1
mov rcx, rax
mov qword [rdi + 0x1258], rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rdi + 0x1258]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180054d40
Capabilities:
Delete registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8, qword [rsi + 0x60]
lea rdx, str._t_t_tAccepting_changes_on_entry__s...
lea rcx, [0x18015f578]
call fcn.1800098e8
mov r11, qword [0x18015f768]
mov qword [rsp + 0x70], r11
lea rdx, [rsp + 0x80]
lea rcx, [0x180162940]
call fcn.18001b638
nop
mov ecx, dword [rsi + 0x10]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsi + 8]
mov r8, qword [rax]
lea rdx, str._s_d:_d:_d
lea rcx, [rsp + 0x70]
call fcn.180008f64
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff4
lea r12, [0x18015f758]
or ebp, 0xffffffff
cmp rcx, r12
je 0x180054df9
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x180054df9
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [rsi + 0x119c], ebp
jne 0x180054e37
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x180054e30
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x180054e30
call fcn.1800d1434
xor eax, eax
jmp 0x180054f23
mov rdi, qword [rsi + 0x1188]
cmp dword [rdi - 0xc], 0
jl 0x180054e55
mov qword [rsp + 0x78], rdi
lock add dword [rdi - 0xc], 1
mov rbx, qword [rsp + 0x70]
jmp 0x180054e82
mov rax, qword [0x18015f768]
mov qword [rsp + 0x78], rax
test rdi, rdi
jne 0x180054e6a
xor eax, eax
jmp 0x180054e73
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rdi
mov edx, eax
lea rcx, [rsp + 0x78]
call fcn.180003e28
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsi + 0x11a0]
call fcn.18005d12c
test eax, eax
jne 0x180054ee8
mov rax, qword [rsi + 0x1188]
mov qword [rsp + 0x20], rax
lea r9, str.CDataChromeSearchEntitySQL::InstallEntry_:_Cannot_open_SQL_DB_at_:__s
mov r8d, 0x10b
lea rdx, str..DataChromeSearchEntitySQL.cpp
lea rcx, [0x18015f578]
call fcn.18000b1e8
nop
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x180054ee1
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x180054ee1
call fcn.1800d1434
mov eax, 0x80004005
jmp 0x180054f23
mov edx, dword [rsi + 0x119c]
lea rcx, [rsi + 0x11a0]
call fcn.18005db64
lea rcx, [rsi + 0x11a0]
call fcn.18005d694
nop
lea rcx, [rbx - 0xc]
cmp rcx, r12
je 0x180054f21
mov eax, ebp
lock xadd dword [rcx], eax
add eax, ebp
test eax, eax
jg 0x180054f21
call fcn.1800d1434
xor eax, eax
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret