joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004b40
Capabilities:
Load ntoskrnl

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov edx, 5
lea rcx, [0x14002fca8]
call fcn.140005b70
test rax, rax
jne 0x140004b8b
movzx eax, word [0x14002fe20]
test eax, eax
jne 0x140004b8b
cmp qword [0x14002fe18], 0
je 0x140004b90
jmp 0x140004d75
mov r8b, 1
mov rdx, qword [str.NtShutdownSystem]
lea rcx, [0x14001a970]
call fcn.140003d10
mov dword [0x14002fe24], eax
xor edx, edx
mov eax, dword [0x14002fe24]
mov ecx, 0x1000
div ecx
mov eax, edx
mov word [0x14002fe20], ax
mov r8d, 1
xor edx, edx
lea rcx, [0x14001a980]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x14002fe18], rax
mov edx, 0x18
lea rcx, [rsp + 0x98]
call fcn.1400023b0
lea rcx, [rsp + 0x98]
call fcn.140002360
nop
lea rax, [0x14002fe40]
mov qword [rsp + 0x38], rax
mov edx, 8
lea rcx, [rsp + 0x90]
call fcn.1400023b0
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x38]
call fcn.140005f70
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x38]
call fcn.140005f40
nop
jmp 0x140004c53
lea rcx, [rsp + 0x90]
call fcn.140005ec0
nop
movzx edx, byte [rsp + 0x88]
lea rcx, [rsp + 0x90]
call fcn.140005f00
movzx eax, al
test eax, eax
je 0x140004d09
lea rcx, [rsp + 0x90]
call fcn.140005ee0
lea rcx, [rsp + 0xb0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rax, [0x140004dd0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.140008ee0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x98]
call fcn.140004da0
nop
lea rcx, [rsp + 0x78]
call fcn.140003700
nop
jmp 0x140004c45
lea rax, [rsp + 0x98]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x40]
call fcn.140002120
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x40]
call fcn.140005b30
mov qword [rsp + 0x68], rax
jmp 0x140004d44
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x30], rax
je 0x140004d67
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.1400037c0
nop
jmp 0x140004d36
lea rcx, [rsp + 0x98]
call fcn.140005b50
nop
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140017bf0
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x14000b4a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1400023b0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.14000c880
nop
lea rax, [0x14000c920]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.140003250
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x14000b565
lea rcx, [rsp + 0x40]
call fcn.14000bca0
nop
jmp 0x14000b57d
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rcx, [rsp + 0x40]
call fcn.14000bcd0
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140017bf0
add rsp, 0x58
ret
Function at 0x14000e180
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWARERESOURCEMAPSystem_ResourcesPhysical_Memory
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop
mov eax, dword [rsp + 0x78]
mov ecx, eax
call fcn.140017fe0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str..Translated
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x38]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 0
jmp 0x14000e278
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x30], eax
jae 0x14000e2b5
mov rax, qword [rsp + 0x40]
add rax, 8
mov r9, rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [0x14002fe58]
call fcn.140007e80
nop
mov rax, qword [rsp + 0x40]
add rax, 0x14
mov qword [rsp + 0x40], rax
jmp 0x14000e26e
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140017c4c
cmp qword [rsp + 0x50], 0
jne 0x14000e2dc
mov qword [rsp + 0x60], 0
jmp 0x14000e2ef
mov qword [rsp + 0x38], 0x8123
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140017bf0
add rsp, 0xa8
ret
Function at 0x14000f890
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14002ff40], eax
jle 0x14000f908
lea rcx, [0x14002ff40]
call fcn.140017d28
cmp dword [0x14002ff40], 0xffffffff
jne 0x14000f908
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [0x14002ff20]
call fcn.140006350
lea rcx, [0x140019b80]
call fcn.140017fc8
nop
lea rcx, [0x14002ff40]
call fcn.140017cbc
nop
lea rcx, [0x14002ff20]
call fcn.140006190
lea r8, [rsp + 0x38]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x60]
call fcn.140006190
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x14000f973
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14000f973
mov dword [rsp + 0x20], 1
jmp 0x14000f97b
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140017bf0
add rsp, 0x58
ret
Function at 0x14000f9a0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rsp + 0x68]
call fcn.140006350
nop
mov rdx, qword [rsp + 0xa8]
lea rcx, [rsp + 0x68]
call fcn.140012700
lea rcx, [rsp + 0x68]
call fcn.140006190
lea r8, [rsp + 0x58]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000fa2a
mov byte [rsp + 0x34], 0
lea rcx, [rsp + 0x68]
call fcn.140006320
movzx eax, byte [rsp + 0x34]
jmp 0x14000fbe0
mov byte [rsp + 0x60], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000fa80
mov byte [rsp + 0x35], 0
lea rcx, [rsp + 0x68]
call fcn.140006320
movzx eax, byte [rsp + 0x35]
jmp 0x14000fbe0
mov byte [rsp + 0x61], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x61]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000fad6
mov byte [rsp + 0x36], 0
lea rcx, [rsp + 0x68]
call fcn.140006320
movzx eax, byte [rsp + 0x36]
jmp 0x14000fbe0
mov byte [rsp + 0x62], 3
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x62]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000fb2c
mov byte [rsp + 0x37], 0
lea rcx, [rsp + 0x68]
call fcn.140006320
movzx eax, byte [rsp + 0x37]
jmp 0x14000fbe0
mov rcx, qword [rsp + 0xa0]
call fcn.140012370
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0xa0]
call fcn.140006190
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14000fba7
mov byte [rsp + 0x38], 0
lea rcx, [rsp + 0x68]
call fcn.140006320
movzx eax, byte [rsp + 0x38]
jmp 0x14000fbe0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14000fbc0
mov dword [rsp + 0x3c], 1
jmp 0x14000fbc8
mov dword [rsp + 0x3c], 0
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x39], al
lea rcx, [rsp + 0x68]
call fcn.140006320
movzx eax, byte [rsp + 0x39]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140017bf0
add rsp, 0x98
ret
Function at 0x1400114d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140011509
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400115f8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x1400115a0
cmp qword [rsp + 0x20], 0
jle 0x1400115a0
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140011549
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140007100
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x1400115e8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x1400115e8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140011600
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140011634
xor eax, eax
jmp 0x140011831
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140011666
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140011831
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140011718
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140003460
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140007100
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140011821
mov rcx, qword [rsp + 0x80]
call fcn.140012d90
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x1400117ce
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x1400117c9
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140011831
jmp 0x140011744
cmp qword [rsp + 0x50], 0
jbe 0x140011821
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140017bf0
add rsp, 0x78
ret
Function at 0x140012e50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x140012e8d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140012e94
mov al, 1
jmp 0x140012fec
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140013d50
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140013d50
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.140013db0
movzx eax, al
test eax, eax
je 0x140012ee9
xor al, al
jmp 0x140012fec
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140012f59
cmp dword [rsp + 0x30], 1
je 0x140012f65
cmp dword [rsp + 0x30], 3
je 0x140012fda
jmp 0x140012fea
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140012fb1
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140012fb1
xor al, al
jmp 0x140012fec
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140012fcb
mov dword [rsp + 0x34], 1
jmp 0x140012fd3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x140012fec
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140012fec
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140017bf0
add rsp, 0xa8
ret

Function at 0x140017388
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400173c2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400173c7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140017410
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14001a6e0]
cmp byte [rcx + rax], 0
je 0x140017410
dec r8
sub rdx, 1
jne 0x1400173f6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140017780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400174a0
mov ebx, eax
test eax, eax
jne 0x1400177b0
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140017813
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001780a
test al, 0x10
je 0x14001780a
bt eax, 0xa
jae 0x140017803
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140017824
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x1400177ff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1400177ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x14001780a
and dword [rsp + 0x3c], 0
jmp 0x14001780f
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400188fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140018946
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018946
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018946
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018946
cmp dword [rcx + 0x84], 0xe
jbe 0x140018946
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140018948
xor al, al
add rsp, 0x28
ret
Function at 0x14000bb80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsi + 4], eax
mov ecx, eax
shr ecx, 4
and ecx, 1
cmp eax, 0xffffffff
mov ebp, 2
cmovne ebp, ecx
cmp ebp, 2
je 0x14000bccd
cmp ebp, 1
jne 0x14000bc40
mov ecx, 0x20a
call fcn.14000e5dc
mov rbx, rax
mov r8d, 0x20a
mov rcx, rax
xor edx, edx
call fcn.1400101d0
lea rdx, str.mozlock.
mov rcx, rdi
mov r8, rbx
call fcn.14000e470
test eax, eax
je 0x14000bcff
mov rcx, rbx
call fcn.140017708
test rax, rax
je 0x14000bcff
mov rcx, rax
nop dword [rax]
add rcx, 0xffffffffffffffff
movzx edx, word [rbx + rcx*2]
cmp dx, 0x5c
je 0x14000bc28
cmp dx, 0x2f
jne 0x14000bcd8
cmp rax, rcx
jb 0x14000bc10
mov word [rbx + rcx*2], 0
mov rax, rcx
test rcx, rcx
jne 0x14000bc10
jmp 0x14000bcff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x60000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov rcx, qword [rsi + 8]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000bc84
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 8], rbx
cmp rbx, 0xffffffffffffffff
invalid
je 0x14000bccd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsi + 4], eax
mov ecx, eax
shr ecx, 4
and ecx, 1
cmp eax, 0xffffffff
mov eax, 2
cmovne eax, ecx
cmp ebp, eax
je 0x14000bccd
mov rcx, qword [rsi + 8]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14000bcc5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 8], 0xffffffffffffffff
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov rcx, rbx
mov dx, 0x2f
call fcn.1400103f4
mov r14, rax
mov rcx, rbx
mov dx, 0x5c
call fcn.1400103f4
cmp r14, rax
cmova rax, r14
test rax, rax
jne 0x14000bd11
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.14000e5e4
add rax, 2
lea rcx, [rsi + 0x10]
mov rdx, rax
call fcn.140009660
test eax, eax
js 0x14000bcff
cmp qword [rsi + 0x10], 0
je 0x14000bcff
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 4
mov rcx, rbx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
mov rcx, qword [rsi + 8]
lea rax, [rcx + 1]
cmp rax, 2
jae 0x14000bd86
mov qword [rsi + 8], r14
mov rcx, rbx
call fcn.14000e5e4
mov rbx, qword [rsi + 8]
cmp rbx, 0xffffffffffffffff
jne 0x14000bc8e
jmp 0x14000bccd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000bd67
Function at 0x14000d350
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140038010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, section..rdata
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14000d3a6
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140017708
cmp rax, 0x105
jb 0x14000d3bd
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140019600
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.140017bd0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call int.14000e380
test eax, eax
je 0x14000d3a6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000d40a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000d3a6
lea rdx, str.UpdateLogs
mov rcx, rdi
call int.14000e380
test eax, eax
je 0x14000d3a6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000d43f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000d3a6
mov esi, 1
jmp 0x14000d3a6