joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403626a0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
cmp rdi, rsi
jae 0x140362728
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x140362721
mov rdx, rcx
add rdi, rdx
cmp al, 1
jne 0x1403626e2
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140242430
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14036d200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp edx, 0x33ff
jg 0x14036d222
add edx, edx
movzx r8d, dx
movzx edx, word [rcx]
cmp r8d, edx
jbe 0x14036d280
and edx, 1
or edx, 2
lea rcx, [rcx + rdx*2]
jmp 0x14036d20e
mov r8d, edx
shr r8d, 9
add r8d, 0x3400
shl edx, 6
and r8d, 0xfffe
mov eax, 0xffffffff
movzx r9d, word [rcx]
cmp r8d, r9d
jbe 0x14036d259
and r9d, 1
or r9, 2
mov r10, r9
lea rcx, [rcx + r10*2]
jmp 0x14036d23f
mov r10d, r9d
and r10d, 0x7ffe
cmp r8d, r10d
jne 0x14036d27f
movzx r10d, word [rcx + 2]
cmp r10w, dx
jae 0x14036d2ac
mov r10d, 3
test r9w, r9w
jns 0x14036d253
ret
mov r9d, edx
and r9d, 0x7ffe
mov eax, 0xffffffff
cmp r8d, r9d
jne 0x14036d27f
movzx eax, word [rcx + 2]
test dl, 1
je 0x14036d27f
shl eax, 0x10
mov r10d, eax
movzx eax, word [rcx + 4]
or eax, r10d
jmp 0x14036d27f
xor edx, r10d
test edx, 0xffc0
jne 0x14036d27f
and r10d, 0x3f
shl r10d, 0x10
jmp 0x14036d2a3

Function at 0x140374460
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x1403744ae
cmp byte [rcx], 0x4d
jne 0x1403744ae
cmp byte [rcx + 1], 0x5a
jne 0x1403744ae
mov r9d, dword [rcx + 0x3c]
mov r10, rdx
sub r10, r9
xor eax, eax
cmp r10, 0x18
jb 0x1403744b0
cmp r9, rdx
jae 0x1403744b0
cmp r9d, 0x40
jb 0x1403744b0
mov r10d, r9d
and r10d, 7
jne 0x1403744b0
cmp byte [rcx + r9], 0x50
jne 0x1403744ae
cmp byte [rcx + r9 + 1], 0x45
jne 0x1403744ae
cmp byte [rcx + r9 + 2], 0
je 0x1403744b1
xor eax, eax
ret
cmp byte [rcx + r9 + 3], 0
jne 0x1403744ae
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x1403744b0
cmp rdx, 2
jb 0x1403744b0
cmp word [rcx + r9], r8w
sete al
jmp 0x1403744b0
Function at 0x14037a7b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x14037a810
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140242430
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140383540
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x14038355b
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.140194db0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140383609
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x140383609
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x140383634
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x140383551
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x14038354f
mov dword [rsi], 7
jmp 0x14038354f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14038354f
Function at 0x140388300
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1403aa440]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14027e330
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14038d110
test al, al
je 0x1403883c6
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1403883fb
mov rcx, r14
call fcn.14027e330
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14038d110
test al, al
je 0x140388440
cmp dword [rbx], 0x4550
jne 0x14038847c
mov sil, 1
test rdi, rdi
je 0x1403883da
mov qword [rdi], r14
jmp 0x1403883da
mov ecx, 1
call fcn.1401de860
test al, al
jne 0x1403884c2
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140242430
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1401de860
test al, al
je 0x1403883d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400e3550
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1403884f4
mov ecx, 1
call fcn.1401de860
test al, al
je 0x1403883d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400e3550
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1403884ee
mov ecx, 1
call fcn.1401de860
test al, al
je 0x1403883d8
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400e3550
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1403884f4
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400e3550
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14027e630
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14038850c
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
jmp 0x140388510
and r8d, 0x7f
mov rcx, rax
mov rdx, rsi
call fcn.14027e630
mov rcx, rdi
call fcn.1400e3a40
jmp 0x1403883d8
Function at 0x140388530
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140418038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1403aa440]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.14027e330
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14038d110
test al, al
je 0x1403885f6
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14038862b
mov rcx, r14
call fcn.14027e330
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14038d110
test al, al
je 0x140388670
cmp dword [rbx], 0x4550
jne 0x1403886ac
mov sil, 1
test rdi, rdi
je 0x14038860a
mov qword [rdi], r14
jmp 0x14038860a
mov ecx, 1
call fcn.1401de860
test al, al
jne 0x1403886f2
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140242430
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1401de860
test al, al
je 0x140388608
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400e3550
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140388724
mov ecx, 1
call fcn.1401de860
test al, al
je 0x140388608
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400e3550
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14038871e
mov ecx, 1
call fcn.1401de860
test al, al
je 0x140388608
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400e3550
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140388724
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400e3550
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.14027e630
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14038873c
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
jmp 0x140388740
and r8d, 0x7f
mov rcx, rax
mov rdx, rsi
call fcn.14027e630
mov rcx, rdi
call fcn.1400e3a40
jmp 0x140388608
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00404440]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00404450]
mov dword [rax], 1
mov rax, qword [0x00404460]
mov dword [rax], 1
mov rax, qword [0x00404430]
mov dword [rax], 1
mov rax, qword [0x004042f0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00404420]
mov dword [0x00407008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x00404380]
mov qword [rdx], rax
mov rdx, qword [0x00404370]
mov qword [rdx], rax
mov rax, qword [0x004043e0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004042a0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058

Function at 0x401530
Capabilities:
Manipulate console buffer

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x18], edx
mov ecx, 0xfffffff5
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rax
mov qword [rbp - 8], rax
mov eax, dword [rbp + 0x10]
mov word [rbp - 0x10], ax
mov eax, dword [rbp + 0x18]
mov word [rbp - 0xe], ax
mov edx, dword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
call rax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x401578
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov ecx, 0xfffffff5
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
call rax
mov qword [rbp - 0x10], rax
lea rcx, str.color_0
call sym.system
mov dword [rbp - 4], 3
jmp 0x4015e7
mov eax, dword [rbp - 4]
mov edx, eax
mov ecx, 3
call sym.gotoxy_int__int_
mov ecx, 5
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp - 0x10]
mov edx, 7
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call rax
mov ecx, 0xdf
call sym.putchar
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x14
jle 0x4015a7
add rsp, 0x30
pop rbp
ret
Function at 0x401810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00407054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x40192a
mov rax, qword [0x00407058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40185e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401910
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401842
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401962
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00407058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00407058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401945
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401909
sub eax, 0x40
and eax, 0xffffffbf
je 0x401909
mov r9, rbp
add r9, qword [0x00407058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401931
add dword [0x00407054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x40186b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00407058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x402540
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402550
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402560
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4025a1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402598
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x4025a3
add rax, 0x28
cmp rax, r9
jne 0x402584
xor eax, eax
repz ret

Function at 0x402650
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004042f0]
cmp word [rbx], 0x5a4d
je 0x402670
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402664
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x140001100
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14000a844
test rax, rax
je 0x140001334
mov rbx, rax
movzx eax, word [r14 + rax*2 - 2]
cmp eax, 0x5c
je 0x14000132c
cmp eax, 0x2f
je 0x14000132c
mov rax, rbx
add rax, 2
lea r15, [rbx + rbx + 4]
mov rcx, 0xffffffffffffffff
cmovns rcx, r15
call fcn.14000a784
mov rdi, rax
xor r12d, r12d
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000bda0
lea r8, [rbx + 1]
mov rcx, rdi
mov rdx, r14
call fcn.14000a794
mov rcx, rdi
call fcn.14000a7dc
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov qword [rcx], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001338
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x14000136b
add ebx, ebx
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000136b
lea r9, [rsp + 0x34]
mov dword [r9], 4
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000136b
lea r14, [rsp + 0x30]
mov r15d, dword [r14]
mov rcx, r15
call fcn.14000a784
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.14000bda0
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, rbx
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x14000136b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001295
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400012a7
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.14000a78c
lea rdx, str.SOFTWAREMozillaMaintenanceService_
mov r8d, 0x104
mov rcx, rsi
call fcn.14000a794
mov ebp, 1
cmp dword [rsp + 0x30], 0
je 0x140001303
add rsi, 0x48
xor r14d, r14d
lea rdi, str._.2x
mov r15, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [rbx + r14]
mov rcx, rsi
mov rdx, rdi
call r15
add rsi, 4
inc r14
mov eax, dword [rsp + 0x30]
cmp r14, rax
jb 0x1400012e5
mov rdi, rbx
mov rcx, rdi
call fcn.14000a78c
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140018740
mov eax, ebp
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
dec rbx
jmp 0x14000114c
xor ebp, ebp
jmp 0x14000130e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x14000136b
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x40]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400011c8
xor ebp, ebp
jmp 0x140001306
Function at 0x140005330
Capabilities:
Get file version info

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r9
mov rbx, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
mov ecx, eax
call fcn.14000a784
mov rsi, rax
mov rcx, r15
xor edx, edx
mov r8d, ebp
mov r9, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400053cb
lea r8, [rsp + 0x28]
mov qword [r8], rsi
lea rdx, [0x14002fada]
lea r9, [rsp + 0x24]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1400053fb
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
movzx edx, word [rcx + 0xa]
mov dword [r14], edx
movzx edx, word [rcx + 8]
mov dword [rbx], edx
movzx edx, word [rcx + 0xe]
mov dword [rdi], edx
movzx ecx, word [rcx + 0xc]
mov dword [rax], ecx
mov edi, 1
jmp 0x140005433
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005457
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_obtain_file_info_of_old_service.____lu_
jmp 0x140005429
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005494
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Could_not_query_file_version_info_of_old_service.____lu_
mov r8d, eax
call fcn.14000a030
xor edi, edi
mov rcx, rsi
call fcn.14000a78c
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140018740
mov eax, edi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x140038330]
call fcn.14000aa40
cmp dword [0x140038330], 0xffffffff
jne 0x1400053ec
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abd8
lea rcx, [0x140038330]
call fcn.14000aaa8
jmp 0x1400053ec
lea rcx, [0x140038330]
call fcn.14000aa40
cmp dword [0x140038330], 0xffffffff
jne 0x14000541c
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abd8
lea rcx, [0x140038330]
call fcn.14000aaa8
jmp 0x14000541c
Function at 0x140006120
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp word [rcx], 0
je 0x1400061e1
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000619c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x14000619c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000619c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000626d
lea rdx, str.Could_not_delete_service_updater_path:__ls.
mov r8, rsi
call fcn.14000a030
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
xor edx, edx
call fcn.14000bda0
mov rcx, rsi
call fcn.14000a844
cmp rax, 0x104
ja 0x1400061e1
lea rdi, [rsp + 0x20]
mov r8d, 0x105
mov rcx, rdi
mov rdx, rsi
call fcn.14000a794
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1400061fc
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140018740
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rdx, str.updater.ini
lea rcx, [rsp + 0x20]
call fcn.140025c50
test eax, eax
je 0x1400061e1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400061e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1400061e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400061e1
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400062ae
lea rdx, str.Could_not_delete_service_updater_INI_path:__ls.
lea r8, [rsp + 0x20]
call fcn.14000a030
jmp 0x1400061e1
lea rcx, [0x140038330]
call fcn.14000aa40
cmp dword [0x140038330], 0xffffffff
jne 0x14000618d
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abd8
lea rcx, [0x140038330]
call fcn.14000aaa8
jmp 0x14000618d
lea rcx, [0x140038330]
call fcn.14000aa40
cmp dword [0x140038330], 0xffffffff
jne 0x140006257
mov qword [0x140038120], 0
lea rcx, [fcn.140001f60]
call fcn.14000abd8
lea rcx, [0x140038330]
call fcn.14000aaa8
jmp 0x140006257
Function at 0x14000a030
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x140038120], 0
je 0x14000a0ca
mov rsi, rdx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov r9, qword [0x140038120]
lea rcx, str._Warning:
mov edx, 0xd
mov r8d, 1
call fcn.140013508
mov rbx, qword [rsp + 0x30]
mov rdi, qword [0x140038120]
call fcn.140001080
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov r8, rsi
xor r9d, r9d
call fcn.14000c72c
mov r9, qword [0x140038120]
lea rcx, str._n
mov edx, 4
mov r8d, 1
call fcn.140013508
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140018740
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret