joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bfa0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x14001bfdd
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14001b18c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14001c0dc
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14001b18c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x14001c050
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140003fe0
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14001c11b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14001c11b
call fcn.14001aff8
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x14001c102
mov rcx, r14
call fcn.14001aff8
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x14000f680
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, ecx
mov r14, r8
xor ecx, ecx
mov qword [r8], 0
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx edx, bx
mov r8, rdi
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14000f791
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14000f791
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, ebp
mov rdx, rdi
mov rcx, rax
call fcn.140065be0
lea r8, [rsp + 0x58]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rbp, qword [rsp + 0x58]
mov ecx, 0x18
call qword [sym.imp.gdiplus.dll_GdipAlloc]
mov rbx, rax
test rax, rax
je 0x14000f76b
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rsp + 0x50], 0
lea rdx, [rsp + 0x50]
mov qword [rbx], rax
mov rcx, rbp
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov rcx, qword [rsp + 0x50]
mov qword [rbx + 8], rcx
mov dword [rbx + 0x10], eax
jmp 0x14000f76d
xor ebx, ebx
mov rcx, rsi
mov qword [r14], rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
jmp 0x14000f793
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000fc10
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rdi
sub rsp, 0x270
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x288], rbx
mov rax, qword [0x1400bf080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x14000fc80
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140005230
mov dword [rsp + 0x30], 1
mov r8d, 0xd
lea rdx, str.FLiNGTrainer
mov rcx, rbx
call fcn.140003930
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140047710
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140022e00
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x1400bf080]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor edi, edi
mov qword [r11 - 0x68], rdi
mov dword [rsp + 0x28], 4
mov qword [r11 - 0x78], r8
mov r9, rdx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x80]
call qword [0x1400c46e8]
mov rbx, rax
test rax, rax
jne 0x140022f82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140010680
nop
lea r8, [0x1400c4ad0]
cmp qword [0x1400c4ae8], 8
cmovae r8, qword [0x1400c4ad0]
mov r9, qword [0x1400c4ae0]
mov rcx, rax
call fcn.14000b780
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
lea r8, [0x1400c48b0]
cmp qword [0x1400c48c8], 8
cmovae r8, qword [0x1400c48b0]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140022f2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022f25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022fcb
call fcn.140047734
movdqa xmm0, xmmword [0x1400a94f0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x140022f7e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022f79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022fc5
call fcn.140047734
xor al, al
jmp 0x140022fa4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140047710
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
call fcn.140068c7c
nop
call fcn.140068c7c
nop
int3
Function at 0x140023950
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1400bf080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r12, r9
mov r13, r8
mov r15, rdx
mov qword [rsp + 0x30], rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rbx, qword [rsp + 0xe0]
cmp qword [rcx + 0x18], 8
jb 0x1400239a1
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400239d6
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 7
mov word [r15], ax
lea r8d, [rax + 0x19]
lea rdx, str.Error:_Ini_File_Not_Exist
mov rcx, r15
call fcn.140005230
jmp 0x140023af5
mov ecx, 0x208
mov r15d, 1
call fcn.140047da0
mov rsi, rax
movdqa xmm0, xmmword [0x1400a94f0]
movdqu xmmword [rsp + 0x58], xmm0
xor eax, eax
mov word [rsp + 0x48], ax
mov ebp, 0x104
lea rdi, [rax - 1]
nop word [rax + rax]
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x140023a1d
mov rax, qword [r14]
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x140023a2a
mov r8, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140023a39
mov rdx, qword [r12]
mov rcx, r13
cmp qword [r13 + 0x18], 8
jb 0x140023a47
mov rcx, qword [r13]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [rbp - 1]
cmp eax, ecx
jb 0x140023abb
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x140023a6d
mov r8, qword [rbx]
mov rax, rsi
sub r8, rsi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140023a87
add rax, 2
test ecx, ecx
jne 0x140023a73
test edx, edx
je 0x140023abb
mov rcx, rsi
call fcn.140047734
inc r15d
imul ebp, r15d, 0x104
mov ecx, ebp
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.140047da0
mov rsi, rax
jmp 0x140023a10
mov r15, qword [rsp + 0x30]
inc rdi
cmp word [rsi + rdi*2], 0
jne 0x140023ac0
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140005230
mov rcx, rsi
call fcn.140047734
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [r15 + 0x10], xmm1
mov rax, r15
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140047710
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004b1fc
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14004b20f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14004b81c
lea rdx, [0x1400bcbe8]
lea rcx, [rsp + 0x20]
call fcn.1400661e0
int3

Function at 0x140055a98
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400c35b0]
xor edx, edx
jmp fcn.14004b1fc

Function at 0x140056430
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400c35b0]
jmp fcn.14004b1fc

Function at 0x14006207c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140062138]
mov r9, qword [r9 + 8]
jmp fcn.140053450

Function at 0x140062110
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140062148]
mov r9, qword [r9 + 8]
jmp fcn.140053450

Function at 0x140076a54
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140076878
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14004b0a0]
mov dword [rax], 1
mov rax, qword [0x14004b0b0]
mov dword [rax], 1
mov rax, qword [0x14004b0c0]
mov dword [rax], 1
mov rax, qword [0x14004b020]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14002d700
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call fcn.14003ee90
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call fcn.14003ee90
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop

Function at 0x14002e3d2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400531a8]
test eax, eax
je 0x14002e46a
lea rax, [0x140053180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400531b0]
mov qword [rbp - 8], rax
jmp 0x14002e44e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14002e442
cmp qword [rbp - 0x10], 0
je 0x14002e442
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x14002e408
lea rax, [0x140053180]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14002e46b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14002e570
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14002e598
mov eax, 0
jmp 0x14002e5e6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14002e5c1
mov eax, 0
jmp 0x14002e5e6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x14002e5e1
mov eax, 0
jmp 0x14002e5e6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x14002e5ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14002e66a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x14002e661
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x14002e661
mov rax, qword [rbp - 8]
jmp 0x14002e67f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x14002e634
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001100
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14000a558
test rax, rax
je 0x140001334
mov rbx, rax
movzx eax, word [r14 + rax*2 - 2]
cmp eax, 0x5c
je 0x14000132c
cmp eax, 0x2f
je 0x14000132c
mov rax, rbx
add rax, 2
lea r15, [rbx + rbx + 4]
mov rcx, 0xffffffffffffffff
cmovns rcx, r15
call fcn.14000a498
mov rdi, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000bac0
lea r8, [rbx + 1]
mov rcx, rdi
mov rdx, r14
call fcn.14000a4a8
mov rcx, rdi
call fcn.14000a4f0
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov qword [rcx], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001338
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000136b
add ebx, ebx
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000136b
lea r9, [rsp + 0x34]
mov dword [r9], 4
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000136b
lea r14, [rsp + 0x30]
mov r15d, dword [r14]
mov rcx, r15
call fcn.14000a498
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000bac0
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, rbx
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000136b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001295
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400012a7
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.14000a4a0
lea rdx, str.SOFTWAREMozillaMaintenanceService_
mov r8d, 0x104
mov rcx, rsi
call fcn.14000a4a8
mov ebp, 1
cmp dword [rsp + 0x30], 0
je 0x140001303
add rsi, 0x48
xor r14d, r14d
lea rdi, str._.2x
mov r15, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [rbx + r14]
mov rcx, rsi
mov rdx, rdi
call r15
add rsi, 4
inc r14
mov eax, dword [rsp + 0x30]
cmp r14, rax
jb 0x1400012e5
mov rdi, rbx
mov rcx, rdi
call fcn.14000a4a0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018460
mov eax, ebp
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
dec rbx
jmp 0x14000114c
xor ebp, ebp
jmp 0x14000130e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14000136b
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400011c8
xor ebp, ebp
jmp 0x140001306
Function at 0x140005030
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
mov ecx, eax
call fcn.14000a498
mov rsi, rax
mov rcx, r15
xor edx, edx
mov r8d, ebp
mov r9, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400050cb
lea r8, [rsp + 0x28]
mov qword [r8], rsi
lea rdx, [0x14002faea]
lea r9, [rsp + 0x24]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400050fb
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0xa]
mov dword [r14], edx
movzx edx, word [rcx + 8]
mov dword [rbx], edx
movzx edx, word [rcx + 0xe]
mov dword [rdi], edx
movzx ecx, word [rcx + 0xc]
mov dword [rax], ecx
mov edi, 1
jmp 0x140005133
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005157
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_obtain_file_info_of_old_service.____lu_
jmp 0x140005129
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005194
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_query_file_version_info_of_old_service.____lu_
mov r8d, eax
call fcn.140008f40
xor edi, edi
mov rcx, rsi
call fcn.14000a4a0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140018460
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x140038330]
call fcn.14000a760
cmp dword [0x140038330], 0xffffffff
jne 0x1400050ec
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8f8
lea rcx, [0x140038330]
call fcn.14000a7c8
jmp 0x1400050ec
lea rcx, [0x140038330]
call fcn.14000a760
cmp dword [0x140038330], 0xffffffff
jne 0x14000511c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8f8
lea rcx, [0x140038330]
call fcn.14000a7c8
jmp 0x14000511c
Function at 0x140005e20
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp word [rcx], 0
je 0x140005ee1
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005e9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140005e9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140005e9c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005f6d
lea rdx, str.Could_not_delete_service_updater_path:__ls.
mov r8, rsi
call fcn.140008f40
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
xor edx, edx
call fcn.14000bac0
mov rcx, rsi
call fcn.14000a558
cmp rax, 0x104
ja 0x140005ee1
lea rdi, [rsp + 0x20]
mov r8d, 0x105
mov rcx, rdi
mov rdx, rsi
call fcn.14000a4a8
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140005efc
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140018460
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rdx, str.updater.ini
lea rcx, [rsp + 0x20]
call fcn.140025890
test eax, eax
je 0x140005ee1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005ee1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140005ee1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140005ee1
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005fae
lea rdx, str.Could_not_delete_service_updater_INI_path:__ls.
lea r8, [rsp + 0x20]
call fcn.140008f40
jmp 0x140005ee1
lea rcx, [0x140038330]
call fcn.14000a760
cmp dword [0x140038330], 0xffffffff
jne 0x140005e8d
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8f8
lea rcx, [0x140038330]
call fcn.14000a7c8
jmp 0x140005e8d
lea rcx, [0x140038330]
call fcn.14000a760
cmp dword [0x140038330], 0xffffffff
jne 0x140005f57
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000a8f8
lea rcx, [0x140038330]
call fcn.14000a7c8
jmp 0x140005f57