joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400085a0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x248
mov rsi, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
xor edx, edx
call fcn.140015c00
cmp byte [0x140049c78], 0
je 0x1400085fa
lea rcx, [0x140049230]
lea rdx, [0x14003f1d8]
lea r8, [rsp + 0x30]
call fcn.140012110
test eax, eax
jne 0x140008623
jmp 0x14000867c
lea rax, [0x14003f1cc]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea r9, [0x140049230]
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.140004870
lea rdx, [0x14003fb0a]
lea rcx, [rsp + 0x30]
call fcn.14001fa44
test rax, rax
je 0x14000867c
mov rdi, rax
mov rcx, rsi
call fcn.140022150
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov r9, rdi
call fcn.14002176c
cmp rax, 1
jne 0x140008680
cmp byte [0x140049c78], 0
je 0x140008677
lea rcx, [0x140049230]
call fcn.1400121a0
test eax, eax
je 0x140008680
mov sil, 1
jmp 0x140008682
xor esi, esi
jmp 0x14000868a
xor esi, esi
mov rcx, rdi
call fcn.140020ee8
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400246e0
mov eax, esi
add rsp, 0x248
pop rdi
pop rsi
ret

Function at 0x1400086b0
Capabilities:
Copy file

Disassembly:
push rsi
sub rsp, 0x660
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x658], rax
mov eax, dword [0x14004a098]
mov ecx, dword [0x140047e4c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008821
mov rcx, qword [0x140049e88]
test rcx, rcx
je 0x14000870b
call fcn.140020ee8
mov qword [0x140049e88], 0
cmp byte [0x140049a69], 1
jne 0x140008807
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea rcx, [0x140049230]
lea rdx, [0x14003f1d8]
mov r8, rsi
call fcn.140012110
test eax, eax
je 0x140008791
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea r8, str._supdate.status
lea r9, [0x140049230]
mov edx, 0x105
mov rcx, rsi
call fcn.140004870
lea rcx, [rsp + 0x440]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea rcx, [0x140049230]
lea rdx, [0x14003f750]
mov r8, rsi
call fcn.140012110
test eax, eax
je 0x140008807
lea rsi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea r8, str._supdate.log
lea r9, [0x140049230]
mov edx, 0x105
mov rcx, rsi
call fcn.140004870
lea rcx, [rsp + 0x230]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.1400246e0
nop
add rsp, 0x660
pop rsi
ret
lea rcx, [0x14004a098]
call fcn.140013b60
cmp dword [0x14004a098], 0xffffffff
jne 0x1400086ef
mov qword [0x140049e88], 0
lea rcx, [0x14000add0]
call fcn.140013d18
lea rcx, [0x14004a098]
call fcn.140013bc8
jmp 0x1400086ef
Function at 0x14000b1f0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
mov r15, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
lea rsi, [rsp + 0x50]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140015c00
lea rcx, [0x140049230]
lea rdx, [0x14003f1d8]
mov r8, rsi
call fcn.140012110
test eax, eax
je 0x14000b388
lea rdx, [0x14003f9d6]
lea rcx, [rsp + 0x50]
call fcn.14001fa44
test rax, rax
je 0x14000b32c
mov rsi, rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
mov edx, 1
mov r8d, 0x1f
mov r9, rax
call fcn.1400214a8
mov rdi, rax
mov rcx, rsi
call fcn.140020ffc
test eax, eax
sete bl
jne 0x14000b380
mov byte [rsp + rdi + 0x30], 0
test r15, r15
je 0x14000b2be
cmp byte [r15 + 4], 0
je 0x14000b2be
mov byte [r15 + 4], 0
lea r13, [rsp + 0x30]
mov rcx, r13
mov edx, 0x3a
call fcn.140015d90
mov rdi, rax
test rax, rax
jne 0x14000b301
lea rcx, [rsp + 0x30]
mov edx, 0xa
call fcn.140015d90
mov rdi, rax
test rax, rax
jne 0x14000b301
lea rcx, [rsp + 0x30]
call fcn.140022150
lea rdi, [rsp + rax]
add rdi, 0x30
mov rbp, rdi
sub rbp, r13
mov rcx, r12
call fcn.140022150
cmp rbp, rax
jne 0x14000b330
lea rcx, [rsp + 0x30]
mov rdx, r12
mov r8, rbp
call fcn.140022210
test eax, eax
sete bpl
jmp 0x14000b332
xor ebx, ebx
jmp 0x14000b388
xor ebp, ebp
test r15, r15
je 0x14000b37d
cmp byte [rdi], 0x3a
jne 0x14000b37d
inc rdi
lea r12, [rsp + 0x28]
mov qword [r12], 0
mov rcx, rdi
mov rdx, r12
mov r8d, 0xa
call fcn.1400228ec
cmp qword [r12], rdi
je 0x14000b37d
lea ecx, [rax - 0x7fffffff]
cmp ecx, 2
jb 0x14000b37d
cmp byte [r15 + 4], 0
jne 0x14000b3ae
mov dword [r15], eax
mov byte [r15 + 4], 1
mov byte [r14], bpl
mov rcx, rsi
call fcn.140020ee8
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400246e0
mov eax, ebx
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
Function at 0x14000bd00
Capabilities:
Hash data via wincrypt
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x14000bd79
mov rdi, r9
test r9, r9
je 0x14000bd79
mov r14, qword [rsp + 0x88]
test r14, r14
je 0x14000bd79
mov ebp, r8d
mov rsi, rdx
mov r9, rcx
mov edx, r8d
mov r8d, 1
mov rcx, rsi
call fcn.1400214a8
cmp rax, 1
jne 0x14000bd9f
mov r15d, dword [rsp + 0x80]
xor ebx, ebx
mov r12, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rdi + rbx*8]
mov rdx, rsi
mov r8d, ebp
xor r9d, r9d
call r12
test eax, eax
je 0x14000bdcf
inc rbx
cmp r15, rbx
jne 0x14000bd59
xor eax, eax
jmp 0x14000bdc0
mov ecx, 2
call fcn.1400163f8
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.14002176c
jmp 0x14000bdbb
mov ecx, 2
call fcn.1400163f8
lea rdx, str.ERROR:_Could_not_read__s_n
mov rcx, rax
mov r8, r14
call fcn.140001260
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 2
call fcn.1400163f8
lea rdx, str.ERROR:_Could_not_update_verify_context_for__s_n
mov rcx, rax
mov r8, r14
call fcn.140001260
mov eax, 0xfffffffe
jmp 0x14000bdc0
Function at 0x14000c870
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 1
mov r8d, 0x20
mov rcx, rsi
mov r9, rdi
call fcn.1400214a8
mov ebx, 6
cmp rax, 0x20
jne 0x14000c94d
mov ecx, dword [rsi + 8]
mov rbx, qword [sym.imp.WS2_32.dll_ntohl]
call rbx
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rbx
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rbx
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rbx
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rbx
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rbx
mov dword [rsi + 0x1c], eax
mov rcx, rdi
call fcn.14001b830
lea rdx, [rsp + 0x28]
mov ecx, eax
call fcn.14001ba94
mov ebx, 6
test eax, eax
jne 0x14000c94d
movabs rax, 0x303146464944424d
mov ebx, 0x29
cmp qword [rsi], rax
jne 0x14000c94d
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x14000c94d
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x14000c94d
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x14000c94d
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x14000c94d
xor edx, edx
cmp rax, rcx
mov ebx, 0x29
cmove ebx, edx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400246e0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000c970
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], r8
mov rbx, rdx
mov r13, rcx
mov r14d, dword [rcx + 8]
mov esi, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
add ebp, esi
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.140021c30
test rax, rax
je 0x14000ca07
mov r15, rax
test rbp, rbp
je 0x14000c9ed
mov r12d, 0x7fffffff
mov rsi, r15
cmp rbp, r12
mov edi, 0x7fffffff
cmovb rdi, rbp
mov edx, 1
mov rcx, rsi
mov r8, rdi
mov r9, rbx
call fcn.1400214a8
cmp rax, rdi
jne 0x14000ca11
add rsi, rdi
sub rbp, rdi
jne 0x14000c9bd
mov esi, dword [r13 + 0x14]
imul eax, esi, 0xaaaaaaab
ror eax, 2
cmp eax, 0x15555555
jbe 0x14000ca1b
mov ebp, 0x29
jmp 0x14000cb5d
mov ebp, ntohl
jmp 0x14000cb65
mov ebp, 6
jmp 0x14000cb5d
test esi, esi
je 0x14000cb5b
mov rcx, qword [rsp + 0x20]
add r14, rcx
mov eax, esi
mov rdi, r15
add rdi, rax
mov ebx, dword [r13 + 0x18]
mov eax, dword [r13 + 0x1c]
add rbx, rdi
add rax, rbx
mov qword [rsp + 0x38], rax
mov r13, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x30], rdi
mov r12, r15
mov ecx, dword [r12]
mov rsi, qword [sym.imp.WS2_32.dll_ntohl]
call rsi
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r14
sub rcx, r13
cmp rcx, rax
jb 0x14000c9fd
mov rcx, qword [rsp + 0x40]
sub rcx, rdi
cmp rcx, rax
jb 0x14000c9fd
test eax, eax
je 0x14000cabf
xor ecx, ecx
mov al, byte [r13 + rcx]
add byte [rdi + rcx], al
inc rcx
mov eax, dword [r12]
cmp rcx, rax
jb 0x14000caa9
jmp 0x14000cac1
xor eax, eax
mov r8d, eax
mov edx, 1
mov rcx, rdi
mov r9, qword [rsp + 0x28]
call fcn.14002176c
mov rsi, rax
mov ebp, 0x40
cmp dword [r12], esi
jne 0x14000cb5d
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, r8
jb 0x14000c9fd
mov edx, 1
mov rcx, rbx
mov r9, qword [rsp + 0x28]
call fcn.14002176c
cmp dword [r12 + 4], eax
jne 0x14000cb5d
mov edx, esi
add r13, rdx
movsxd rcx, dword [r12 + 8]
mov rbp, qword [rsp + 0x20]
sub rbp, r13
cmp rbp, rcx
jg 0x14000c9fd
mov rbp, r14
sub rbp, r13
cmp rbp, rcx
jl 0x14000c9fd
add rdi, rdx
mov eax, eax
add rbx, rax
add r13, rcx
add r12, 0xc
xor ebp, ebp
cmp r12, qword [rsp + 0x30]
jb 0x14000ca56
jmp 0x14000cb5d
xor ebp, ebp
mov rcx, r15
call fcn.140021758
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000cbf0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea r8, [0x14003f9d6]
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov rdx, rsi
call fcn.14001fa50
mov rdi, qword [rdi]
test rdi, rdi
je 0x14000cc52
mov ecx, 0x818
call fcn.140021c30
test rax, rax
je 0x14000cc80
mov rsi, rax
mov qword [rax], rdi
mov rcx, rax
add rcx, 8
mov r8d, 0x80c
xor edx, edx
call fcn.140015c00
jmp 0x14000cc8a
mov ecx, 2
call fcn.1400163f8
lea rcx, str.ERROR:_could_not_open_file_in_mar_wopen___n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call fcn.14002176c
mov rcx, rsi
call fcn.14001fb9c
jmp 0x14000cc88
mov rcx, rdi
call fcn.140020ee8
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400246e0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14000d3c0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, dword [rdx + 0xc]
xor ebx, ebx
sub ebp, r8d
je 0x14000d414
mov ebx, 0xffffffff
jl 0x14000d414
mov rsi, r9
mov rdi, rcx
add r8d, dword [rdx + 8]
mov rcx, qword [rcx]
mov edx, r8d
xor r8d, r8d
call fcn.14001b858
test eax, eax
jne 0x14000d414
mov eax, dword [rsp + 0x70]
cmp ebp, eax
cmovl eax, ebp
mov r9, qword [rdi]
movsxd r8, eax
mov edx, 1
mov rcx, rsi
call fcn.1400214a8
mov rbx, rax
mov eax, ebx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x14000d420
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
movdqa xmm7, xmmword [0x14003c810]
xor eax, eax
movdqa xmm1, xmmword [0x14003c820]
movdqa xmm8, xmmword [0x14003c830]
movdqa xmm9, xmmword [0x14003c840]
movdqa xmm10, xmmword [0x14003c850]
movdqa xmm11, xmmword [0x14003c860]
movdqa xmm12, xmmword [0x14003c870]
lea rcx, [0x14004a0b0]
movdqa xmm13, xmmword [0x14003c880]
movdqa xmm2, xmm7
psrld xmm2, 1
movdqa xmm0, xmm7
pslld xmm0, 0x1f
psrad xmm0, 0x1f
pand xmm0, xmm1
pxor xmm0, xmm2
movdqa xmm4, xmm0
psrld xmm4, 1
movdqa xmm2, xmm7
pslld xmm2, 0x1e
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm4
movdqa xmm4, xmm2
psrld xmm4, 6
movdqa xmm3, xmm7
pslld xmm3, 0x1d
psrad xmm3, 0x1f
pand xmm3, xmm8
movdqa xmm5, xmm7
pslld xmm5, 0x1c
psrad xmm5, 0x1f
pand xmm5, xmm9
pxor xmm5, xmm3
movdqa xmm3, xmm7
pslld xmm3, 0x1b
psrad xmm3, 0x1f
pand xmm3, xmm10
movdqa xmm6, xmm7
pslld xmm6, 0x1a
psrad xmm6, 0x1f
pand xmm6, xmm11
pxor xmm6, xmm3
pxor xmm6, xmm5
pxor xmm6, xmm4
pslld xmm0, 0x1a
psrad xmm0, 0x1f
pand xmm0, xmm12
pslld xmm2, 0x1a
psrad xmm2, 0x1f
pand xmm2, xmm1
pxor xmm2, xmm6
pxor xmm2, xmm0
movdqa xmmword [rax + rcx], xmm2
paddd xmm7, xmm13
add rax, 0x10
cmp rax, 0x400
jne 0x14000d4a4
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
add rsp, 0x88
ret
Function at 0x14000d5c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqa xmm0, xmmword [0x14003c890]
xor eax, eax
movdqa xmm1, xmmword [0x14003c8a0]
movdqa xmm2, xmmword [0x14003c8b0]
lea rcx, [0x14004a4b0]
movdqa xmm3, xmmword [0x14003c8c0]
movdqa xmm4, xmm0
psrlq xmm4, 1
movdqa xmm5, xmm0
psllq xmm5, 0x3f
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
movdqa xmm6, xmm0
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 1
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 1
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm1
pxor xmm5, xmm4
movdqa xmm4, xmm5
psrlq xmm4, 1
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
movdqa xmm4, xmm6
psrlq xmm4, 2
psllq xmm5, 0x3e
psrad xmm5, 0x1f
pshufd xmm5, xmm5, 0xf5
pand xmm5, xmm2
psllq xmm6, 0x3e
psrad xmm6, 0x1f
pshufd xmm6, xmm6, 0xf5
pand xmm6, xmm1
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqa xmmword [rax + rcx], xmm6
paddq xmm0, xmm3
add rax, 0x10
cmp rax, 0x800
jne 0x14000d5f2
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x14000e1a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov r10, rcx
cmp dword [rcx], 4
jne 0x14000e1c0
mov rax, qword [r8]
sub r9, rax
cmp r9, 5
jae 0x14000e1c7
xor esi, esi
jmp 0x14000e338
add rdx, rax
mov r12d, dword [r10 + 0x10]
add r9, 0xfffffffffffffffc
mov rax, 0xffffffffffffffff
xor esi, esi
lea r15, [0x14003c930]
mov r14d, 0xe8
mov cl, byte [rdx + rsi]
and cl, 0xfe
cmp cl, 0xe8
jne 0x14000e204
mov rcx, rsi
sub rcx, rax
cmp rcx, 3
jbe 0x14000e20c
xor r12d, r12d
jmp 0x14000e246
mov rcx, rsi
jmp 0x14000e30f
dec cl
shl r12d, cl
mov eax, r12d
mov r12d, 0
and eax, 7
je 0x14000e246
bt r14d, eax
jb 0x14000e302
movzx ecx, byte [rax + r15]
mov rdi, rsi
sub rdi, rcx
mov cl, byte [rdi + rdx + 4]
dec cl
cmp cl, 0xfe
jae 0x14000e302
mov r12d, eax
movzx ebx, byte [rdx + rsi + 4]
lea eax, [rbx - 1]
cmp al, 0xfe
jae 0x14000e25d
add r12d, r12d
inc r12d
jmp 0x14000e309
movzx eax, byte [rdx + rsi + 1]
movzx ecx, byte [rdx + rsi + 2]
shl ecx, 8
movzx ebp, byte [rdx + rsi + 3]
shl ebp, 0x10
shl ebx, 0x18
or ebx, eax
or ebx, ecx
or ebx, ebp
mov eax, dword [r10 + 0xc]
add eax, esi
mov r13d, 0xfffffffb
sub r13d, eax
add ebx, r13d
test r12d, r12d
je 0x14000e2d8
mov eax, r12d
movzx r11d, byte [rax + r15]
shl r11d, 3
mov eax, 0x18
sub eax, r11d
mov ebp, ebx
mov ecx, eax
shr ebp, cl
dec bpl
cmp bpl, 0xfe
jb 0x14000e2d8
neg r11b
mov ebp, 0xffffffff
mov ecx, r11d
shl ebp, cl
xor ebx, ebp
not ebx
add ebx, r13d
mov edi, ebx
mov ecx, eax
shr edi, cl
dec dil
cmp dil, 0xfd
ja 0x14000e2c2
lea rcx, [rsi + 4]
mov eax, ebx
and eax, 0x1000000
mov ebp, eax
neg ebp
or ebp, eax
mov byte [rdx + rsi + 1], bl
mov byte [rdx + rsi + 2], bh
shr ebx, 0x10
mov byte [rdx + rsi + 3], bl
shr ebp, 0x18
mov byte [rdx + rsi + 4], bpl
jmp 0x14000e30c
lea r12d, [rax + rax]
inc r12d
mov rcx, rsi
mov rax, rsi
mov rsi, rcx
inc rsi
cmp rsi, r9
jb 0x14000e1e8
mov rdx, rsi
sub rdx, rax
lea ecx, [rdx - 1]
shl r12d, cl
xor eax, eax
cmp rdx, 4
cmovb eax, r12d
mov dword [r10 + 0x10], eax
add qword [r8], rsi
add dword [r10 + 0xc], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400115b0
Capabilities:
Get token privileges

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140011625
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rsi, [rsp + 0x2c]
mov edx, 0x12
mov r8, rsi
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
setne al
cmp dword [rsi], 3
sete sil
and sil, al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140011627
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400246e0
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x1400117c0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp qword [rcx], 0
je 0x14001184f
mov r14, rdx
mov rsi, rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
lea rcx, str._Warning:
mov edx, ntohl
mov r8d, 1
call fcn.14002176c
mov rdi, qword [rsp + 0x28]
mov rbx, qword [rsi]
call fcn.140001080
mov rcx, qword [rax]
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov r8, r14
xor r9d, r9d
call fcn.14001385c
mov r9, qword [rsi]
lea rcx, str._n
mov edx, 4
mov r8d, 1
call fcn.14002176c
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400246e0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140011f50
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140036028]
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140011fa6
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140013730
cmp rax, 0x105
jb 0x140011fbd
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400246e0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.1400138f0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call fcn.140035760
test eax, eax
je 0x140011fa6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001200a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140011fa6
lea rdx, str.UpdateLogs
mov rcx, rdi
call fcn.140035760
test eax, eax
je 0x140011fa6
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14001203f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140011fa6
mov esi, 1
jmp 0x140011fa6
Function at 0x140012740
Capabilities:
Query service status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x140047010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x14001283c
mov r14, rax
mov rcx, rax
mov rdx, rdi
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x140012862
mov rdi, rax
mov dword [rsp + 0x3c], 0xcf
imul ebp, ebx, 0x3e8
test ebp, ebp
je 0x14001288c
xor esi, esi
lea r15, [rsp + 0x34]
lea r12, [rsp + 0x38]
mov rbx, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
mov rcx, rdi
xor edx, edx
mov r8, r12
mov r9d, 0x24
call rbx
test eax, eax
je 0x1400127f3
cmp dword [rsp + 0x3c], 1
jne 0x140012824
jmp 0x1400128ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jle 0x140012810
lea ecx, [rax - 0x425]
cmp ecx, 2
jb 0x140012824
jmp 0x1400128fe
cmp eax, 0x79
jle 0x1400128b4
cmp eax, 0x41c
jne 0x1400128df
mov ecx, 0x32
call r13
add esi, 0x32
cmp esi, ebp
jb 0x1400127ce
mov ebx, dword [rsp + 0x3c]
jmp 0x14001291c
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov ebx, 0xfd
cmovne ebx, ecx
jmp 0x14001292d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x140012896
cmp edi, 5
je 0x1400128ca
cmp edi, 6
jne 0x1400128d8
mov ebx, 0xec
jmp 0x14001292d
mov ebx, 0xcf
jmp 0x14001291c
cmp edi, 0x7b
je 0x1400128d1
cmp edi, 0x424
jne 0x1400128d8
mov ebx, 0xee
jmp 0x14001292d
mov ebx, 1
jmp 0x14001291c
cmp eax, 5
je 0x1400128f0
cmp eax, 6
je 0x1400128f7
cmp eax, 0x57
jne 0x14001290c
mov ebx, 0xdc
jmp 0x140012918
mov ebx, 0xeb
jmp 0x14001292d
mov ebx, 0xed
jmp 0x14001292d
mov ebx, 0xef
jmp 0x14001292d
cmp eax, 0x7a
je 0x140012913
cmp eax, 0x7c
jne 0x14001290c
mov ebx, 0xdd
jmp 0x140012918
mov ebx, 0xda
jmp 0x140012918
mov ebx, 0xd9
jmp 0x140012918
cmp eax, 0x45b
jne 0x14001290c
mov ebx, 0xde
jmp 0x140012918
mov ebx, 0xdf
jmp 0x140012918
mov ebx, 0xdb
mov dword [rsp + 0x3c], ebx
mov rsi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call rsi
mov rcx, r14
call rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400246e0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret