joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180047864
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800cf4f8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r15d, edx
mov rdi, rcx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
xor edx, edx
mov r14d, r8d
mov esi, ebx
lea ecx, [rbx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180047a00
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800479a2
lea esi, [rbx + 1]
cmp dword [rsp + 0x20], 0x10
jb 0x18004795e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18004795e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18004795e
mov rdx, qword [rdi]
test rdx, rdx
jne 0x180047920
mov dword [rdi + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x1800d0080]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x180047986
jmp 0x180047951
mov eax, dword [rdi + 8]
cmp dword [rdi + 0xc], eax
jb 0x180047951
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rdi + 8], eax
mov rcx, qword [0x1800d0080]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180047986
mov qword [rdi], rax
mov ecx, dword [rdi + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rdi + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800478ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1800479a2
mov esi, ebx
cmp qword [rdi], rbx
je 0x1800479a2
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1800d0080]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x180047a00
cmp qword [rdi], rbx
je 0x180047a05
mov esi, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x180047a05
mov r8, qword [rdi]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0x1800479f7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, r14d
mov edx, r15d
mov rcx, rbp
call fcn.180047c44
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rdi + 0xc]
jb 0x1800479bb
jmp 0x180047a05
mov ebx, 9
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180055cc0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180047dd4
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x180047e38
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x180047e26
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180047e1f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180047df3
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x1800d0080]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800481ac
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x1800481c3
cmp r8b, 0x90
je 0x1800481c3
cmp r8b, 0xcc
jne 0x1800481e5
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x1800481e1
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x1800481e5
add edx, r10d
cmp edx, r9d
jb 0x1800481d1
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x18005169c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
cmp byte [0x1800d0616], bpl
je 0x18005187f
mov rax, qword [0x1800d0d90]
test rax, rax
jne 0x180051767
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18005174c
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18005174c
mov esi, dword [r9 + 0x20]
dec r10d
mov ebx, 0x811c9dc5
lea rax, [rsi + r10*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180051747
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x180051727
cmp ebx, 0x95466b05
je 0x180051861
test r10d, r10d
jne 0x18005170b
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x18005175d
cmp qword [rax + 0x30], rbp
jne 0x1800516e6
mov rax, rbp
mov qword [0x1800d0d90], rax
mov ecx, dword [0x1800d0638]
call rax
test ax, ax
je 0x18005187f
mov rax, qword [0x1800d00c0]
mov rcx, qword [rax]
test rcx, rcx
je 0x18005187f
mov r9, qword [rcx + 8]
test r9, r9
je 0x18005187f
mov rax, qword [0x1800d00c8]
mov rcx, qword [rax]
test rcx, rcx
je 0x18005187f
mov r8, qword [rcx + 0x18]
test r8, r8
je 0x18005187f
movss xmm3, dword [0x180058b18]
mov r10d, ebp
mov r11, rbp
movsxd rax, r10d
cmp rax, qword [r8 + 0x108]
jae 0x18005187f
mov rcx, qword [r8 + 0x100]
test rcx, rcx
je 0x180051855
mov rcx, qword [r11 + rcx]
test rcx, rcx
je 0x180051855
cmp rcx, r9
je 0x180051855
mov eax, dword [0x1800d00ec]
mov edx, dword [rax + rcx]
test edx, edx
je 0x180051855
and edx, 0x1fc000
cmp edx, 0x8000
je 0x180051855
movsd xmm0, qword [r9 + 0x90]
movss xmm1, dword [r9 + 0x98]
movsd qword [rsp + 0x20], xmm0
movss xmm2, dword [rsp + 0x24]
movss xmm0, dword [rsp + 0x20]
addss xmm2, xmm3
movss dword [rcx + 0x90], xmm0
movss dword [rcx + 0x94], xmm2
movss dword [rcx + 0x98], xmm1
mov dword [rcx + 0x280], 0x3dcccccd
inc r10d
add r11, 0x10
jmp 0x1800517c6
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180051760
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800529ac
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1800d00c0]
mov rcx, qword [rax]
test rcx, rcx
je 0x180052b1b
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x180052b1b
mov eax, dword [0x1800d00f8]
mov rdx, qword [rax + rcx]
test rdx, rdx
je 0x180052b1b
cmp qword [rcx + 0x30], 0
je 0x180052b1b
mov rax, qword [0x1800d00c8]
mov r8, qword [rax]
test r8, r8
je 0x180052b1b
cmp qword [r8 + 0x10], 0
je 0x180052b1b
cmp byte [0x1800d0620], 0
je 0x180052a43
cmp byte [0x1800d0121], 0
movss xmm0, dword [0x1800cf464]
je 0x180052a3b
movss dword [rdx + 0xd40], xmm0
jmp 0x180052a43
movss dword [rdx + 0xcf0], xmm0
mov eax, dword [0x1800d0118]
cmp byte [rax + rcx], 0x40
je 0x180052b1b
movss xmm0, dword [0x18005a8a8]
comiss xmm0, dword [rcx + 0x280]
ja 0x180052b1b
mov rax, qword [0x1800d0d90]
test rax, rax
jne 0x180052b0d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180052af2
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x180052af2
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0x811c9dc5
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x180052aee
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x180052ad1
cmp ebx, 0x95466b05
je 0x180052b2b
test ecx, ecx
jne 0x180052ab3
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x180052b04
cmp qword [rax + 0x30], 0
jne 0x180052a8f
xor eax, eax
mov qword [0x1800d0d90], rax
mov ecx, 0xa0
call rax
mov byte [0x1800d0644], 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180052b06
Function at 0x180055674
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1800cf4f8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x1800555dc]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x1800556eb
mov qword [rsp + 0x20], 0xc8
lea rdx, [rsp + 0x30]
lea rcx, [0x1800555dc]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.18004831c
mov rcx, rax
call fcn.180048628
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1800556b8
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180055cc0
add rsp, 0xd8
ret
Function at 0x183b25058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.183b251df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x183b25089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x183b2506f
add dl, dl
jne 0x183b25096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x183b250f6
xor eax, eax
add dl, dl
jne 0x183b250a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x183b251ad
add dl, dl
jne 0x183b250b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x183b250c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x183b250d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x183b250dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x183b250ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x183b2507e
mov eax, 1
add dl, dl
jne 0x183b25106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x183b25113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x183b250fb
sub eax, ebx
mov ebx, 1
jne 0x183b2514c
mov ecx, 1
add dl, dl
jne 0x183b2512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x183b2513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x183b25123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x183b2507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x183b25168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x183b25175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x183b2515d
cmp eax, 0x7d00
jae 0x183b2519b
cmp eax, 0x500
jb 0x183b25196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x183b2507e
cmp eax, 0x7f
ja 0x183b2519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x183b2507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x183b251d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x183b2507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140017170
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rdx
mov qword [rsp + 0x68], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], 7
mov word [rdx], bx
mov dword [rsp + 0x20], 1
nop word [rax + rax]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.140306610
mov ecx, ebx
test ebx, ebx
je 0x14001720e
sub ecx, 1
je 0x1400171f4
cmp ecx, 1
jne 0x140017222
mov edx, 0x104
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x14001721e
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, str.TEMP
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14001721e
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14001722e
inc ebx
cmp ebx, 3
jl 0x1400171c0
jmp 0x1400172bd
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8d, eax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.140030be0
nop
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14002d920
nop
lea rcx, [rsp + 0x28]
call fcn.1400166f0
cmp ebx, 2
jne 0x1400172bd
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea r8d, [rbx + 2]
lea rdx, str.Temp
lea rcx, [rsp + 0x48]
call fcn.140030be0
nop
lea r8, [rsp + 0x48]
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.14009b580
lea rcx, [rsp + 0x28]
call fcn.1400166f0
nop
lea rcx, [rsp + 0x48]
call fcn.1400166f0
mov rax, rdi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1402b5c00
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret

Function at 0x140017520
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
cmp qword [rcx + 0x30], rsi
jbe 0x140017565
add rcx, 0x20
cmp qword [rbx + 0x38], 7
jbe 0x140017549
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rbx + 0x38], 7
lea rax, [rbx + 0x20]
jbe 0x14001755e
mov rax, qword [rbx + 0x20]
mov qword [rbx + 0x30], rsi
mov word [rax], si
cmp qword [rbx + 0x10], rsi
lea rdi, [rbx + 0x10]
jbe 0x140017592
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x14001757c
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp qword [rbx + 0x18], 7
jbe 0x14001758c
mov rbx, qword [rbx]
mov qword [rdi], rsi
mov word [rbx], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400175b0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
call fcn.140017520
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rax
lea rcx, [rbp - 0x20]
call fcn.140134b30
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x20]
call fcn.140134c90
nop
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140135110
nop
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14009c550
nop
lea rcx, [rsp + 0x60]
call fcn.140016400
nop
lea rcx, [rsp + 0x50]
call fcn.140103100
lea rdx, [rbp - 0x60]
call fcn.140017170
nop
cmp qword [rbp - 0x50], 0
je 0x140017730
cmp qword [rbp - 0x30], 0
je 0x140017730
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.14009b580
nop
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140017700
call fcn.14001d6f0
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rcx, qword [rbp - 0x80]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rcx
lea rax, str.Could_not_create_directory__s__u
mov qword [rsp + 0x30], rax
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 0x63
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.88_build_nativeincludeTemporaryResourceFile.inl
lea rdx, [0x140412418]
mov rcx, rdi
call rbx
xor bl, bl
jmp 0x140017725
lea rax, [rbp - 0x80]
cmp rbx, rax
je 0x140017723
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rbx
call fcn.140030940
mov bl, 1
lea rcx, [rbp - 0x80]
call fcn.1400166f0
jmp 0x14001779e
call fcn.14001d6f0
mov rcx, qword [rax]
mov r10, qword [rcx + 0x20]
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rdx, qword [rbp - 0x60]
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rcx, qword [rbp - 0x40]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
lea rcx, str.Invalid_argument__s__s
mov qword [rsp + 0x30], rcx
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 0x5c
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcPackagesSledgehammer.5.1.0.88_build_nativeincludeTemporaryResourceFile.inl
lea rdx, [0x140412418]
mov rcx, rax
call r10
xor bl, bl
lea rcx, [rbp - 0x60]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x40]
call fcn.1400166f0
nop
lea rcx, [rbp - 0x20]
call fcn.140134b70
movzx eax, bl
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1402b5c00
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140019ad0
Capabilities:
Get common file path

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
lea r12, vtable.mb::common::system::ScopedAny_wchar_t____ptr64__void____cdecl___void____ptr64___void___cdecl_CoTaskMemFree_void____ptr64___0__0__4_.0
mov qword [rbp - 0x21], r12
xor r15d, r15d
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x19], r15
lea r9, [rbp - 0x19]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov r14d, eax
test eax, eax
js 0x140019b85
mov rdx, qword [rbp - 0x19]
test rdx, rdx
je 0x140019b85
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140019b53
lea rcx, [rbp - 1]
call fcn.140030be0
nop
lea rdx, [rbp - 1]
mov rcx, rsi
call fcn.14002d920
nop
lea rcx, [rbp - 1]
call fcn.1400166f0
mov bl, 1
jmp 0x140019c86
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
movdqa xmm0, xmmword [0x14043ca90]
movdqu xmmword [rbp + 0xf], xmm0
mov word [rbp - 1], r15w
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
lea rsi, vtable.mb::common::system::ScopedAny_unsigned_short_int____ptr64__void____cdecl___unsigned_short_int____ptr64___void___cdecl_mb::common::system::Internal::RpcStringFreeHelperW_unsigned_short_int____ptr64___0__0__2_.0
mov qword [rbp - 0x11], rsi
mov qword [rbp - 9], r15
mov qword [rbp - 9], r15
lea rdx, [rbp - 9]
mov rcx, rdi
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
test eax, eax
js 0x140019bf5
mov rdx, qword [rbp - 9]
test rdx, rdx
je 0x140019bf5
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140019be1
lea rcx, [rbp - 1]
call fcn.140030940
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140019c5c
mov rax, qword [rcx]
mov r10, qword [rax + 0x20]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rdx, qword [rbp - 1]
lea rax, [rbx + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140019c21
mov rax, qword [rax]
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], rdx
lea rdx, str.Failed_to_get_known_folder_path__ls._0x_08X
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, WSACleanup
lea r8, str.D:JenkinsworkspaceA_MBAM3_UPDATEREXE_srcmbupdatrDUMaintenance.cpp
lea rdx, str.DUMaintenance::GetKnownFolderPath
call r10
nop
mov qword [rbp - 0x11], rsi
mov rax, qword [rbp - 9]
test rax, rax
je 0x140019c77
mov qword [rbp - 0x29], rax
lea rcx, [rbp - 0x29]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov qword [rbp - 9], r15
lea rcx, [rbp - 1]
call fcn.1400166f0
xor bl, bl
mov qword [rbp - 0x21], r12
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140019c99
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movzx eax, bl
mov qword [rbp - 0x19], r15
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1402b5c00
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14001cc80
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
test rbx, rbx
je 0x14001ccea
mov qword [rsp + 0x30], rbx
cmp qword [rbx + 0x10], 0
je 0x14001ccc6
cmp qword [rbx + 0x30], 0
je 0x14001ccc6
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 7
jbe 0x14001ccaf
mov rdx, qword [rdx]
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14001ccbc
mov rcx, qword [rbx]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
lea rcx, [rbx + 0x20]
call fcn.1400166f0
nop
mov rcx, rbx
call fcn.1400166f0
mov edx, 0x40
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1402b5c4c
add rsp, 0x20
pop rbx
ret
Function at 0x140040ca0
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1404953c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx esi, cl
xorps xmm0, xmm0
movups xmmword [r11 - 0x28], xmm0
mov byte [rsp + 0x20], 0
lea rcx, [r11 - 0x28]
call fcn.14006b1f0
nop
mov rdi, qword [rsp + 0x80]
test rdi, rdi
jne 0x140040dbe
lea rcx, [rsp + 0x50]
call fcn.1400098d0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140040d09
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x1404abb40]
call fcn.1400347d0
lea rdx, str.Failed_to_get_MBAMService_instance
mov rcx, rax
call fcn.1400337c0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140034b90
movzx edx, al
mov rcx, rbx
call fcn.140034620
mov rcx, rbx
call fcn.14002ddd0
nop
lea rcx, [rsp + 0x50]
call fcn.140016400
xor dil, dil
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x140040d95
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140040d95
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140040d95
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
movzx eax, dil
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402b5c00
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, qword [rdi]
mov rbx, qword [rax + 0xc0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x24
lea rdx, str.04657AB6_7CE0_4DB8_A183_C82F68264327
lea rcx, [rsp + 0x30]
call fcn.140030be0
nop
movzx r8d, sil
lea rdx, [rsp + 0x30]
mov rcx, rdi
call rbx
movzx ebx, al
lea rcx, [rsp + 0x30]
call fcn.1400166f0
test bl, bl
je 0x140040d59
test sil, sil
je 0x140040e35
lea rdx, str.SystemCurrentControlSetServicesMBAMService630E9C3A_8B00_490E_81C4_DDD5EF234BAA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dil, 1
jmp 0x140040d5c
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
lea rbx, vtable.mb::common::system::ScopedAny_struct_HKEY______ptr64__long_int____cdecl___struct_HKEY______ptr64___long_int___cdecl_RegCloseKey_struct_HKEY______ptr64___0__0__0_.0
mov qword [rsp + 0x70], rbx
xor edi, edi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x78], rdi
lea r8, [rsp + 0x78]
lea rdx, str.SystemCurrentControlSetServicesMBAMService630E9C3A_8B00_490E_81C4_DDD5EF234BAA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop
mov qword [rsp + 0x70], rbx
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140040e84
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rdi
mov dil, 1
jmp 0x140040d5c