joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140027d33
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140027d7a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140027d75
nop
cmp rbx, rcx
jae 0x140027d7a
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140027d60
cmp rbx, rcx
jb 0x140027d7e
xor eax, eax
jmp 0x140027d8a
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400332a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x28], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14003335e
add rcx, 8
cmp rcx, rdx
je 0x1400332d0
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.14002ddd0
lea rax, [rdi + 0x30]
mov r9, rdi
mov qword [rsp + 0x28], rax
lea r8, [0x140033600]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call fcn.14029dab0
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x14003330e
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 1
call fcn.1400294e0
test eax, eax
je 0x14003335e
cmp qword [rbx + 0x18], 8
jb 0x140033326
mov rbx, qword [rbx]
mov r9d, 0x1b
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r8, str.CThread::Start
lea rax, str.Thread_Triggered:_s
lea ecx, [r9 - 0x1a]
mov qword [rsp + 0x20], rax
lea rdx, str.Thread.cpp
call fcn.140032190
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400368e0
Capabilities:
Delete directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x228]
sub rsp, 0x320
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov rdi, rcx
mov ebx, 1
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
jne 0x140036948
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
xor ecx, ecx
cmp eax, ebx
setbe cl
mov eax, ecx
jmp 0x140036a09
lea rax, vtable.std::_Func_impl_class__lambda_70c4b9d8ad1dfdfac3b4bfde396c8d3e___class_std::allocator_int___void___.0
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x30]
call qword [vtable.std::_Func_impl_class__lambda_70c4b9d8ad1dfdfac3b4bfde396c8d3e___class_std::allocator_int___void___.0]
mov rcx, rax
mov qword [rbp - 0x48], rax
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x1400369b9
mov rax, qword [r8]
lea rcx, [rsp + 0x30]
cmp r8, rcx
setne dl
mov rcx, r8
call qword [rax + 0x20]
mov rcx, qword [rbp - 0x48]
test dword [rbp - 0x40], 0x400
je 0x1400369e2
mov eax, dword [rbp - 0x1c]
cmp eax, 0xa0000003
je 0x1400369d3
cmp eax, 0xa000000c
jne 0x1400369e2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebx, eax
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400369f1
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x140036a07
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov eax, ebx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.14026d870
lea r11, [rsp + 0x320]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140036be0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rsi, rcx
mov rcx, qword [rcx + 0x68]
mov qword [rax - 0x10], r12
mov r12, rdx
mov qword [rax - 0x18], r13
xor r13d, r13d
mov qword [rax - 0x20], r14
mov ebx, r13d
mov qword [rax - 0x28], r15
mov r14d, r9d
mov qword [rax - 0x30], rbx
mov r15, r8
mov dword [rax + 8], r13d
mov dword [rax - 0x38], r13d
test rcx, rcx
je 0x140036c32
mov edx, 0x1b58
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
mov edi, 0x57
call qword [rsi + 0x98]
test al, al
je 0x140036d32
mov qword [rsp + 0x90], rbp
mov rbp, qword [rsp + 0xa8]
test rbp, rbp
je 0x140036d2a
cmp r13w, word [rbp]
je 0x140036d2a
mov rcx, rsi
call fcn.1400373f0
mov edi, eax
test eax, eax
je 0x140036c85
cmp eax, 0xb7
jne 0x140036d2a
lea rax, [rsp + 0x48]
mov r9d, r14d
mov qword [rsp + 0x38], rax
mov r8, r15
lea rax, [rsp + 0x80]
mov rdx, r12
mov qword [rsp + 0x30], rax
mov rcx, rsi
mov eax, dword [rsp + 0xa0]
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call fcn.1400377e0
mov rbx, qword [rsp + 0x48]
mov edi, eax
test eax, eax
jne 0x140036d2a
test rbx, rbx
jne 0x140036cd2
lea edi, [rax + 0xe]
jmp 0x140036d2a
or rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], r13w
lea rax, [rax + 1]
jne 0x140036ce0
mov rcx, qword [rsi + 0x50]
lea r8d, [rax + rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test byte [rsi + 0x7c], 1
mov ebp, eax
je 0x140036d1e
cmp r13w, word [rbx]
je 0x140036d1e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test ebp, ebp
jne 0x140036d2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsi + 0x50]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x68]
lea rax, [rcx - 1]
mov qword [rsi + 0x50], r13
mov r13, qword [rsp + 0x60]
cmp rax, 0xfffffffffffffffd
ja 0x140036d5e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140036d6b
mov rcx, rbx
call fcn.140290594
mov rcx, qword [rsi + 0x68]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x88]
test rcx, rcx
je 0x140036d8a
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, edi
add rsp, 0x70
pop rdi
ret
Function at 0x1400372e0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov edi, r8d
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400373d6
xor ebp, ebp
cmp bp, word [rdx]
je 0x1400373d6
cmp qword [rcx + 0x50], rbp
je 0x140037318
mov eax, VariantTimeToSystemTime
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x60], rsi
mov edx, 0xc0000000
mov dword [rsp + 0x28], LoadRegTypeLib
mov rcx, rax
mov esi, ebp
mov dword [rsp + 0x20], edi
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rbx + 0x50]
mov qword [rbx + 0x50], rax
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003735d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x50]
cmp rcx, 0xffffffffffffffff
jne 0x140037380
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov qword [rbx + 0x50], rbp
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
cmp edi, 3
jne 0x1400373a3
lea r9d, [rdi - 1]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
cmp edi, 2
jne 0x1400373c7
lea r9, [rsp + 0x78]
mov word [rsp + 0x68], 0xfeff
mov r8d, edi
mov qword [rsp + 0x20], rbp
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
mov eax, 0x57
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret

Function at 0x140037fa0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
test rdx, rdx
jne 0x140037fc3
lea eax, [rdx + 0x57]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea r9, [rsp + 0x38]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov edx, 0x8000
lea rcx, [0x14032b6b8]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rbx, qword [rsp + 0x38]
test eax, eax
jns 0x140037ffb
mov edi, 0x57
jmp 0x14003800f
or r9, 0xffffffffffffffff
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14029deb4
mov edi, eax
test rbx, rbx
je 0x14003801d
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003a950
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, rdx
xor edi, edi
mov qword [rsp + 0x50], rdi
lea r9, [rsp + 0x50]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x14032b6b8]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
jns 0x14003a996
lea eax, [rdi + 0x57]
jmp 0x14003a9db
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x14003a9bc
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14003a9b0
mov edi, eax
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.140028e40
nop
test rbx, rbx
je 0x14003a9d9
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14003b9e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, r9
lea rax, [rsp + 0x38]
mov rbx, r8
mov qword [rsp + 0x20], rax
mov r15, rdx
movzx edi, cl
mov r9d, 0x20219
lea rdx, str.SoftwareMcAfeeSystemCore
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebp, 3
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r12d, r12d
test eax, eax
mov r14d, r12d
cmove r14, qword [rsp + 0x38]
test r14, r14
je 0x14003bb2b
lea eax, [rsi + rsi]
xor r8d, r8d
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rbx
mov rcx, r14
lea rdx, str.szInstallDir32
test dil, dil
jne 0x14003ba81
lea rdx, str.szInstallDir64
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
test eax, eax
jne 0x14003bb22
test rbx, rbx
je 0x14003bb22
or rdi, 0xffffffffffffffff
mov rcx, rdi
inc rcx
cmp word [rbx + rcx*2], r12w
jne 0x14003baa1
mov rax, rsi
sub rax, rcx
cmp rax, 1
je 0x14003bae2
mov word [rbx + rsi*2 - 2], r12w
mov rax, rdi
inc rax
cmp word [rbx + rax*2], r12w
jne 0x14003bac0
mov r8, rsi
lea rdx, [0x140327fbc]
sub r8, rax
mov rcx, rbx
dec r8
call fcn.14029fdf4
test r15, r15
je 0x14003bb22
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp word [rbx + rcx*2], r12w
jne 0x14003baf0
mov rax, rsi
sub rax, rcx
cmp rax, 1
je 0x14003bb22
inc rdi
cmp word [rbx + rdi*2], r12w
jne 0x14003bb06
sub rsi, rdi
mov rdx, r15
mov rcx, rbx
lea r8, [rsi - 1]
call fcn.14029fdf4
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
test ebp, ebp
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
sete al
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14003c1e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
sub rsp, 0x20
mov r10d, r8d
mov r11, rdx
mov rbx, rcx
test rdx, rdx
je 0x14003c35e
cmp r8d, 1
jl 0x14003c35e
lea r9, [rcx + 1]
mov qword [rsp + 0x30], rdi
mov rcx, r9
xor eax, eax
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x100
jl 0x14003c210
mov word [rbx + 0x201], 0
mov r8, r9
mov edi, 0x100
movzx eax, byte [rbx + 0x201]
mov qword [rbx + 0x208], r8
movzx ecx, byte [rax + r11]
add cl, byte [r8]
add byte [rbx + 0x202], cl
lea rcx, [rbx + 1]
movzx eax, byte [rbx + 0x202]
add rcx, rax
mov qword [rbx + 0x210], rcx
movzx eax, byte [r8]
mov byte [rbx + 0x218], al
movzx eax, byte [rcx]
mov byte [r8], al
inc r8
movzx eax, byte [rbx + 0x218]
mov rcx, qword [rbx + 0x210]
mov byte [rcx], al
movzx eax, byte [rbx + 0x201]
inc eax
cdq
idiv r10d
mov byte [rbx + 0x201], dl
sub rdi, 1
jne 0x14003c230
mov rdi, qword [rsp + 0x30]
lea rcx, [rbx + 0x101]
test rcx, rcx
je 0x14003c33a
test r9, r9
je 0x14003c32d
mov eax, 2
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [r9]
lea r9, [r9 + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [r9 - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [r9 - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [r9 - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [r9 - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [r9 - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [r9 - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [r9 - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x14003c2c0
mov word [rbx + 0x201], ax
mov al, 1
mov byte [rbx], 1
add rsp, 0x20
pop rbx
ret
xor edx, edx
mov r8d, 0x100
call fcn.14028e7e0
call fcn.1402946c4
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.1402904fc
mov al, 1
mov word [rbx + 0x201], 0
mov byte [rbx], 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14003c6c0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
test rcx, rcx
je 0x14003c740
cmp edx, 1
jb 0x14003c740
test rbx, rbx
je 0x14003c740
cmp r9d, 0x10
jne 0x14003c740
mov r8d, edx
mov dword [rsp + 0x28], 0x67452301
mov rdx, rcx
mov dword [rsp + 0x2c], 0xefcdab89
xor eax, eax
mov dword [rsp + 0x30], 0x98badcfe
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x10325476
call fcn.14003c760
lea rcx, [rsp + 0x20]
call fcn.14003c860
movups xmm0, xmmword [rsp + 0x78]
xor eax, eax
movups xmmword [rbx], xmm0
jmp 0x14003c743
or eax, 0xffffffff
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14026d870
add rsp, 0xa0
pop rbx
ret
Function at 0x14003d950
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov rax, qword [0x1403ddfb8]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r15, rdx
mov r12, rcx
mov r14, qword [rbp + 0x90]
xor edi, edi
test r14, r14
je 0x14003d99c
mov dword [r14], edi
mov dword [rbp], edi
mov dword [rbp + 4], 0x1f4
mov qword [rbp + 8], rdi
mov eax, dword [rsp]
mov eax, 0x210
sub rsp, rax
lea rbx, [rsp + 0x30]
mov eax, dword [rbx]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14003d9d3
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x10], rbx
mov qword [rbp + 8], rbx
jmp 0x14003d9f3
test rbx, rbx
jne 0x14003da02
mov eax, recv
jmp 0x14003db8b
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp eax, 0xea
jne 0x14003db38
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14003da42
call fcn.140290594
mov qword [rbp + 8], rdi
mov edx, dword [rbp + 4]
lea rax, [rdx + 0x10]
mov rcx, rdi
cmp rax, rdx
cmova rcx, rax
test rcx, rcx
je 0x14003daea
lea rax, [rdx + 0x10]
mov rcx, rdi
cmp rax, rdx
cmova rcx, rax
lea rax, [rdx + 0x10]
cmp rcx, 0x400
ja 0x14003dabf
cmp rax, rdx
cmova rdi, rax
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x14003da95
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14026e690
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x14003daed
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x18], rbx
jmp 0x14003daed
cmp rax, rdx
cmova rdi, rax
mov rcx, rdi
call fcn.14029de2c
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14003daed
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x20], rbx
jmp 0x14003daed
mov rbx, rdi
mov qword [rbp + 8], rbx
jmp 0x14003db0b
test rbx, rbx
je 0x14003d9f8
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x14003db78
cmp dword [rbp], 3
je 0x14003db49
mov esi, reloc.WS2_32.dll_listen
jmp 0x14003db78
mov rax, qword [rbp + 0x88]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x80]
lea r8, [rbp]
mov edx, dword [rbp + 4]
mov rcx, rbx
call fcn.14003d500
mov esi, eax
test r14, r14
je 0x14003db78
mov eax, dword [rbp]
mov dword [r14], eax
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14003db89
call fcn.140290594
mov eax, esi
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.14026d870
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003dbb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov rax, qword [0x1403ddfb8]
xor rax, rbp
mov qword [rbp + 0x20], rax
mov rsi, r9
mov r14, r8
mov r12, rdx
mov r15, rcx
mov dword [rbp + 4], 1
xor ebx, ebx
mov dword [rbp], ebx
mov rdi, qword [rbp + 0x90]
test rdi, rdi
je 0x14003dc09
mov eax, dword [rdi]
mov dword [rbp], eax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 4]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp + 4]
test r14, r14
je 0x14003dc2e
mov dword [r14], ecx
cmp ecx, 1
je 0x14003dc3c
cmp ecx, 7
jne 0x14003ddb0
test rdi, rdi
je 0x14003ddb0
cmp dword [rdi], ebx
je 0x14003ddb0
test eax, eax
je 0x14003dc5c
cmp eax, 0xea
jne 0x14003ddb0
mov ecx, dword [rbp]
mov eax, dword [rdi]
mov dword [rbp], eax
mov dword [rdi], ecx
test rsi, rsi
je 0x14003dc78
mov r8d, ecx
xor edx, edx
mov rcx, rsi
call fcn.14028e7e0
mov qword [rbp + 8], rbx
mov edx, dword [rbp]
lea rax, [rdx + 0x10]
mov rcx, rbx
cmp rax, rdx
cmova rcx, rax
test rcx, rcx
je 0x14003dd1e
lea rax, [rdx + 0x10]
mov rcx, rbx
cmp rax, rdx
cmova rcx, rax
lea rax, [rdx + 0x10]
cmp rcx, 0x400
ja 0x14003dcf5
cmp rax, rdx
cmova rbx, rax
lea rax, [rbx + 0xf]
cmp rax, rbx
ja 0x14003dccb
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14026e690
sub rsp, rax
lea rbx, [rsp + 0x30]
mov qword [rbp + 0x10], rbx
test rbx, rbx
je 0x14003dd1e
mov dword [rbx], 0xcccc
add rbx, 0x10
mov qword [rbp + 0x10], rbx
jmp 0x14003dd1e
cmp rax, rdx
cmova rbx, rax
mov rcx, rbx
call fcn.14029de2c
mov rbx, rax
mov qword [rbp + 0x18], rax
test rax, rax
je 0x14003dd1e
mov dword [rax], 0xdddd
add rbx, 0x10
mov qword [rbp + 0x18], rbx
mov qword [rbp + 8], rbx
jmp 0x14003dd43
test rbx, rbx
jne 0x14003dd4d
lea eax, [rbx + 0xe]
jmp 0x14003ddb0
mov r8d, dword [rbp]
xor edx, edx
mov rcx, rbx
call fcn.14028e7e0
lea rax, [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 4]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [r15]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r14d, eax
test eax, eax
jne 0x14003dd9c
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov r8, rbx
mov edx, dword [rbp + 4]
mov rcx, r15
call fcn.14003d8d0
mov r14d, eax
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x14003ddad
call fcn.140290594
mov eax, r14d
mov rcx, qword [rbp + 0x20]
xor rcx, rbp
call fcn.14026d870
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003f420
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x1e0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x1f0], rbx
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
lea rcx, [0x14032b5d8]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
lea r8d, [rbx + 1]
lea rdx, [0x14032c3c8]
lea rcx, [rsp + 0x40]
call fcn.14002c3d0
nop
mov rdx, qword [rsp + 0x30]
cmp word [rdx], bx
je 0x14003f4ab
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x14003f4a1
mov r8, rbx
lea rcx, [rsp + 0x40]
call fcn.140032770
mov r8d, 0x29
lea rdx, str.McAfeeModuleCoreModuleCoreService.exe_
lea rcx, [rsp + 0x40]
call fcn.140032770
mov r8d, 7
lea rdx, str.__start
lea rcx, [rsp + 0x40]
call fcn.140032770
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call fcn.14029fe3c
mov edi, eax
test eax, eax
je 0x14003f586
mov r8d, eax
lea rdx, str.Manage_Service:_Failed_to_start_ModuleCoreService__error__d_
lea rcx, [rsp + 0x60]
call fcn.140027a80
mov rbx, rax
lea rdx, str.E:BT0d8f5312_643f_43bd_ae61_302563aaaba4UBF_1PEFAppSrcPEFCommonCmcService.h
mov qword [rsp + 0x20], rdx
lea r9, str.ManageMcServices::CMcService::StartModuleCoreService
mov edx, 4
mov r8d, 0x123
lea rcx, [rsp + 0x80]
call fcn.14002c550
nop
mov rdx, rbx
mov rcx, rax
call fcn.14002cda0
nop
lea rcx, [rsp + 0x80]
call fcn.1400298d0
nop
mov r8, qword [rsp + 0x78]
cmp r8, 8
jb 0x14003f5f8
inc r8
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x60]
call fcn.14002e610
jmp 0x14003f5f8
mov eax, dword [0x1403f2658]
mov dword [rsp + 0x20], eax
mov r9, qword [str._no_host]
mov r8, qword [0x1403f2b80]
mov rdx, qword [str._no_group]
mov rcx, qword [0x1403f2660]
call fcn.140033d60
test rax, rax
je 0x14003f5f8
mov rcx, qword [rax]
test rcx, rcx
je 0x14003f5f8
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x50]
test eax, eax
je 0x14003f5f8
lea rax, str.Manage_Service:_ModuleCoreService_stopped_successfully
mov qword [rsp + 0x20], rax
mov r9d, 0x127
lea r8, str.ManageMcServices::CMcService::StartModuleCoreService
lea rdx, str.E:BT0d8f5312_643f_43bd_ae61_302563aaaba4UBF_1PEFAppSrcPEFCommonCmcService.h
mov ecx, 1
call fcn.140029450
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14003f615
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14002e610
mov eax, edi
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14026d870
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
Function at 0x14003f820
Capabilities:
Query service status

Disassembly:
push rbx
sub rsp, 0x1f0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1403ddfb8]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rax, rdx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0x24
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x14003f8f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Manage_Service:_Failed_to_query_service_status__error__d_
lea rcx, [rsp + 0x40]
call fcn.140027a80
mov rbx, rax
lea rax, str.E:BT0d8f5312_643f_43bd_ae61_302563aaaba4UBF_1PEFAppSrcPEFCommonCmcService.h
mov qword [rsp + 0x20], rax
lea r9, str.ManageMcServices::CMcService::GetServiceStatus
mov edx, 4
mov r8d, GetAltMonthNames
lea rcx, [rsp + 0x90]
call fcn.14002c550
nop
mov rdx, rbx
mov rcx, rax
call fcn.14002cda0
nop
lea rcx, [rsp + 0x90]
call fcn.1400298d0
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14003f8ef
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.14002e610
xor eax, eax
jmp 0x14003f8f7
mov eax, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.14026d870
add rsp, 0x1f0
pop rbx
ret