joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400052d0
Capabilities:
Create process on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x100
mov rbx, r9
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xf0]
call fcn.140005490
mov rsi, qword [rsp + 0xf0]
test rsi, rsi
je 0x140005404
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x80], 0x68
lea rax, str.winsta0Default
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test eax, eax
je 0x14000541c
mov rcx, qword [rsp + 0x60]
test rbx, rbx
je 0x140005414
mov qword [rbx], rcx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0xf0], 0
mov rcx, rsi
call fcn.140013eac
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.140023fe0
mov eax, edi
add rsp, 0x100
pop rbx
pop rdi
pop rsi
ret
mov qword [rsp + 0xf0], 0
xor edi, edi
jmp 0x1400053e7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400053c8
mov qword [rsp + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov ecx, 0x1300
xor edx, edx
mov r8d, eax
mov r9d, 0x400
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rax, qword [rsp + 0x58]
test rax, rax
lea rdx, [0x14003da10]
cmovne rdx, rax
call fcn.1400057c0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400053d3
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400053d3
Function at 0x140005d90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, r9d
mov rsi, r8
mov ebp, edx
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, str.MOZ_LAUNCHED_CHILD1
call fcn.14001e4d0
mov rcx, rdi
call fcn.14001ec68
test eax, eax
je 0x140005e06
mov eax, dword [0x140048558]
mov ecx, dword [0x140045e44]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005eae
lea rcx, [0x140048348]
lea rdx, str.Warning:_chdir_failed
call fcn.14000ed50
test bl, bl
je 0x140005e25
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140023fe0
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea r9, [rsp + 0x28]
mov edx, ebp
mov r8, rsi
call fcn.1400052d0
test eax, eax
je 0x140005e0a
mov rsi, qword [rsp + 0x28]
mov rbx, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rbx
mov edi, eax
call rbx
sub eax, edi
cmp eax, 0x270f
ja 0x140005e9e
mov rbp, qword [sym.imp.USER32.dll_WaitForInputIdle]
mov r14, qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax + rax]
mov edx, 0x2710
sub edx, eax
mov rcx, rsi
call rbp
cmp eax, 0xffffffff
jne 0x140005e9e
call r14
cmp eax, 0x5bf
jne 0x140005e9e
mov ecx, 0xa
call r15
call rbx
sub eax, edi
cmp eax, 0x2710
jb 0x140005e70
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140005e0a
lea rcx, [0x140048558]
call fcn.140014020
cmp dword [0x140048558], 0xffffffff
jne 0x140005df3
mov qword [0x140048348], 0
lea rcx, [0x14000ac50]
call fcn.1400141d8
lea rcx, [0x140048558]
call fcn.140014088
jmp 0x140005df3
Function at 0x1400084c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x248
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x30]
mov r8d, 0x20a
xor edx, edx
call fcn.140016100
cmp byte [0x140048138], 0
je 0x14000851a
lea rcx, [0x1400476f0]
lea rdx, [0x14003d132]
lea r8, [rsp + 0x30]
call fcn.14000f3d0
test eax, eax
jne 0x140008543
jmp 0x14000859c
lea rax, [0x14003d126]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea r9, [0x1400476f0]
lea rcx, [rsp + 0x30]
mov edx, 0x105
call fcn.1400042e0
lea rdx, [0x14003d9f2]
lea rcx, [rsp + 0x30]
call fcn.14001f530
test rax, rax
je 0x14000859c
mov rdi, rax
mov rcx, rsi
call fcn.140021880
mov r8d, 1
mov rcx, rsi
mov rdx, rax
mov r9, rdi
call fcn.140021258
cmp rax, 1
jne 0x1400085a0
cmp byte [0x140048138], 0
je 0x140008597
lea rcx, [0x1400476f0]
call fcn.14000f460
test eax, eax
je 0x1400085a0
mov sil, 1
jmp 0x1400085a2
xor esi, esi
jmp 0x1400085aa
xor esi, esi
mov rcx, rdi
call fcn.1400209d4
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140023fe0
mov eax, esi
add rsp, 0x248
pop rdi
pop rsi
ret

Function at 0x1400085d0
Capabilities:
Copy file

Disassembly:
push rsi
sub rsp, 0x660
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x658], rax
mov eax, dword [0x140048558]
mov ecx, dword [0x140045e44]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140008741
mov rcx, qword [0x140048348]
test rcx, rcx
je 0x14000862b
call fcn.1400209d4
mov qword [0x140048348], 0
cmp byte [0x140047f29], 1
jne 0x140008727
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140016100
lea rcx, [0x1400476f0]
lea rdx, [0x14003d132]
mov r8, rsi
call fcn.14000f3d0
test eax, eax
je 0x1400086b1
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140016100
lea r8, str._supdate.status
lea r9, [0x1400476f0]
mov edx, 0x105
mov rcx, rsi
call fcn.1400042e0
lea rcx, [rsp + 0x440]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140016100
lea rcx, [0x1400476f0]
lea rdx, [0x14003d618]
mov r8, rsi
call fcn.14000f3d0
test eax, eax
je 0x140008727
lea rsi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.140016100
lea r8, str._supdate.log
lea r9, [0x1400476f0]
mov edx, 0x105
mov rcx, rsi
call fcn.1400042e0
lea rcx, [rsp + 0x230]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.140023fe0
nop
add rsp, 0x660
pop rsi
ret
lea rcx, [0x140048558]
call fcn.140014020
cmp dword [0x140048558], 0xffffffff
jne 0x14000860f
mov qword [0x140048348], 0
lea rcx, [0x14000ac50]
call fcn.1400141d8
lea rcx, [0x140048558]
call fcn.140014088
jmp 0x14000860f
Function at 0x14000bb40
Capabilities:
Hash data via wincrypt
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14000bbd1
mov rsi, rdx
test rdx, rdx
je 0x14000bbd1
mov rdi, r9
test r9, r9
je 0x14000bbd1
mov ebx, dword [rsp + 0x80]
test ebx, ebx
je 0x14000bbd1
mov r14, qword [rsp + 0x88]
test r14, r14
je 0x14000bbd1
mov r15d, r8d
mov r9, rcx
mov edx, r8d
mov r8d, 1
mov rcx, rsi
call fcn.140020f94
cmp rax, 1
jne 0x14000bc2c
mov ebx, ebx
xor ebp, ebp
mov r12, qword [sym.imp.ADVAPI32.dll_CryptHashData]
nop word [rax + rax]
mov rcx, qword [rdi + rbp*8]
mov rdx, rsi
mov r8d, r15d
xor r9d, r9d
call r12
test eax, eax
je 0x14000bbfc
add rbp, 1
cmp rbx, rbp
jne 0x14000bbb0
xor eax, eax
jmp 0x14000bc1d
mov ecx, 2
call fcn.140016988
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140021258
mov eax, 0xffffffff
jmp 0x14000bc1d
mov ecx, 2
call fcn.140016988
lea rdx, str.ERROR:_Could_not_update_verify_context_for__s_n
mov rcx, rax
mov r8, r14
call fcn.140005d20
mov eax, 0xfffffffe
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 2
call fcn.140016988
lea rdx, str.ERROR:_Could_not_read__s_n
mov rcx, rax
mov r8, r14
call fcn.140005d20
mov eax, 0xffffffff
jmp 0x14000bc1d
Function at 0x14000c940
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 1
mov r8d, 0x20
mov rcx, rsi
mov r9, rdi
call fcn.140020f94
mov ebx, 6
cmp rax, 0x20
jne 0x14000ca1d
mov ecx, dword [rsi + 8]
mov rbx, qword [sym.imp.WSOCK32.dll_ntohl]
call rbx
mov dword [rsi + 8], eax
mov ecx, dword [rsi + 0xc]
call rbx
mov dword [rsi + 0xc], eax
mov ecx, dword [rsi + 0x10]
call rbx
mov dword [rsi + 0x10], eax
mov ecx, dword [rsi + 0x14]
call rbx
mov dword [rsi + 0x14], eax
mov ecx, dword [rsi + 0x18]
call rbx
mov dword [rsi + 0x18], eax
mov ecx, dword [rsi + 0x1c]
call rbx
mov dword [rsi + 0x1c], eax
mov rcx, rdi
call fcn.14001be50
lea rdx, [rsp + 0x28]
mov ecx, eax
call fcn.14001c0b4
mov ebx, 6
test eax, eax
jne 0x14000ca1d
movabs rax, 0x303146464944424d
mov ebx, 0x29
cmp qword [rsi], rax
jne 0x14000ca1d
movsxd rax, dword [rsp + 0x3c]
cmp rax, 0x20
jb 0x14000ca1d
add rax, 0xffffffffffffffe0
mov ecx, dword [rsi + 0x14]
sub rax, rcx
jb 0x14000ca1d
mov ecx, dword [rsi + 0x18]
sub rax, rcx
jb 0x14000ca1d
mov ecx, dword [rsi + 0x1c]
cmp rax, rcx
jb 0x14000ca1d
xor edx, edx
cmp rax, rcx
mov ebx, 0x29
cmove ebx, edx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140023fe0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000ca40
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x20], r9
mov r12, r8
mov rbx, rdx
mov r13, rcx
mov r14d, dword [rcx + 8]
mov esi, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
add ebp, esi
add ebp, dword [rcx + 0x1c]
mov rcx, rbp
call fcn.14002171c
test rax, rax
je 0x14000cade
mov r15, rax
test ebp, ebp
je 0x14000cac4
mov rsi, r15
nop word cs:[rax + rax]
nop
cmp rbp, 0x7fffffff
mov edi, 0x7fffffff
cmovb rdi, rbp
mov edx, 1
mov rcx, rsi
mov r8, rdi
mov r9, rbx
call fcn.140020f94
cmp rax, rdi
jne 0x14000cae8
add rsi, rdi
sub rbp, rdi
jne 0x14000ca90
mov esi, dword [r13 + 0x14]
imul eax, esi, 0xaaaaaaab
ror eax, 2
cmp eax, 0x15555555
jbe 0x14000caf2
mov ebp, 0x29
jmp 0x14000cc46
mov ebp, 0xc
jmp 0x14000cc4e
mov ebp, 6
jmp 0x14000cc46
test esi, esi
je 0x14000cc44
add r14, r12
mov eax, esi
mov rdi, r15
add rdi, rax
mov ebx, dword [r13 + 0x18]
add rbx, rdi
mov eax, dword [r13 + 0x1c]
add rax, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov r13, r12
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x28], rdi
mov r12, r15
nop dword [rax]
mov ecx, dword [r12]
mov rax, qword [sym.imp.WSOCK32.dll_ntohl]
mov rsi, rax
call rax
mov dword [r12], eax
mov ecx, dword [r12 + 4]
call rsi
mov dword [r12 + 4], eax
mov ecx, dword [r12 + 8]
call rsi
mov dword [r12 + 8], eax
mov eax, dword [r12]
mov rcx, r14
sub rcx, r13
cmp rcx, rax
jb 0x14000cad4
mov rcx, qword [rsp + 0x40]
sub rcx, rdi
cmp rcx, rax
jb 0x14000cad4
test eax, eax
je 0x14000cba8
xor ecx, ecx
nop word cs:[rax + rax]
movzx eax, byte [r13 + rcx]
add byte [rdi + rcx], al
add rcx, 1
mov eax, dword [r12]
cmp rcx, rax
jb 0x14000cb90
jmp 0x14000cbaa
xor eax, eax
mov r8d, eax
mov edx, 1
mov rcx, rdi
mov r9, qword [rsp + 0x20]
call fcn.140021258
mov rsi, rax
mov ebp, 0x40
cmp dword [r12], esi
jne 0x14000cc46
mov r8d, dword [r12 + 4]
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, r8
jb 0x14000cad4
mov edx, 1
mov rcx, rbx
mov r9, qword [rsp + 0x20]
call fcn.140021258
cmp dword [r12 + 4], eax
jne 0x14000cc46
mov edx, esi
add r13, rdx
movsxd rcx, dword [r12 + 8]
mov rbp, qword [rsp + 0x30]
sub rbp, r13
cmp rbp, rcx
jg 0x14000cad4
mov rbp, r14
sub rbp, r13
cmp rbp, rcx
jl 0x14000cad4
add rdi, rdx
mov eax, eax
add rbx, rax
add r13, rcx
add r12, 0xc
xor ebp, ebp
cmp r12, qword [rsp + 0x28]
jb 0x14000cb30
jmp 0x14000cc46
xor ebp, ebp
mov rcx, r15
call fcn.140021244
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ec60
Capabilities:
Get token privileges

Disassembly:
push rsi
sub rsp, 0x40
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov rcx, rax
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000ecd4
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x2c]
mov edx, 0x12
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
setne al
cmp dword [rsp + 0x2c], 3
sete sil
and sil, al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000ecd6
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140023fe0
mov eax, esi
add rsp, 0x40
pop rsi
ret

Function at 0x14000edd0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp qword [rcx], 0
jne 0x14000ee10
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140023fe0
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
mov rdi, rdx
mov rsi, rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
lea rcx, str._Warning:
mov edx, 0xd
mov r8d, 1
call fcn.140021258
mov rbx, qword [rsp + 0x28]
mov r14, qword [rsi]
call fcn.14000b020
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call fcn.140016d44
mov r9, qword [rsi]
lea rcx, str._n
mov edx, 4
mov r8d, 1
call fcn.140021258
jmp 0x14000edf8
Function at 0x14000f210
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, section..rdata
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x14000f266
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.1400220e8
cmp rax, 0x105
jb 0x14000f27d
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140023fe0
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.1400225b0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call int.140010110
test eax, eax
je 0x14000f266
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000f2ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000f266
lea rdx, str.UpdateLogs
mov rcx, rdi
call int.140010110
test eax, eax
je 0x14000f266
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000f2ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000f266
mov esi, 1
jmp 0x14000f266
Function at 0x14000fa50
Capabilities:
Query service status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x14000fb61
mov r14, rax
mov rcx, rax
mov rdx, rdi
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14000fb84
mov rdi, rax
mov dword [rsp + 0x3c], 0xcf
imul ebp, ebx, 0x3e8
test ebp, ebp
je 0x14000fbab
xor esi, esi
lea r15, [rsp + 0x34]
lea r12, [rsp + 0x38]
mov rbx, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000fafe
cmp dword [rsp + 0x3c], 1
je 0x14000fbcc
mov ecx, 0x32
call r13
add esi, 0x32
cmp esi, ebp
jae 0x14000fbc6
mov qword [rsp + 0x20], r15
mov rcx, rdi
xor edx, edx
mov r8, r12
mov r9d, 0x24
call rbx
test eax, eax
jne 0x14000fae0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jle 0x14000fb34
lea ecx, [rax - 0x425]
cmp ecx, 2
jb 0x14000faeb
jmp 0x14000fc47
cmp eax, 0x79
jle 0x14000fc17
cmp eax, 0x41c
je 0x14000faeb
cmp eax, 0x7a
je 0x14000fc6a
cmp eax, 0x7c
jne 0x14000fc5c
mov ebx, 0xdd
mov dword [rsp + 0x3c], ebx
jmp 0x14000fbd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov ebx, 0xfd
cmovne ebx, ecx
jmp 0x14000fbe2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x14000fbb2
cmp edi, 5
je 0x14000fc02
cmp edi, 6
jne 0x14000fc10
mov ebx, 0xec
jmp 0x14000fbe2
mov ebx, 0xcf
jmp 0x14000fbd1
cmp edi, 0x7b
je 0x14000fc09
cmp edi, 0x424
jne 0x14000fc10
mov ebx, 0xee
jmp 0x14000fbe2
mov ebx, dword [rsp + 0x3c]
jmp 0x14000fbd1
mov ebx, 1
mov rsi, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call rsi
mov rcx, r14
call rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140023fe0
mov eax, ebx
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebx, 0xeb
jmp 0x14000fbe2
mov ebx, 0xed
jmp 0x14000fbe2
mov ebx, 0xef
jmp 0x14000fbe2
cmp eax, 5
je 0x14000fc31
cmp eax, 6
je 0x14000fc3c
cmp eax, 0x57
jne 0x14000fc5c
mov ebx, 0xdc
mov dword [rsp + 0x3c], ebx
jmp 0x14000fbd1
mov ebx, 0xda
mov dword [rsp + 0x3c], ebx
jmp 0x14000fbd1
mov ebx, 0xd9
mov dword [rsp + 0x3c], ebx
jmp 0x14000fbd1
cmp eax, 0x45b
jne 0x14000fc5c
mov ebx, 0xde
mov dword [rsp + 0x3c], ebx
jmp 0x14000fbd1
mov ebx, 0xdf
mov dword [rsp + 0x3c], ebx
jmp 0x14000fbd1
mov ebx, 0xdb
mov dword [rsp + 0x3c], ebx
jmp 0x14000fbd1
Function at 0x14000fc80
Capabilities:
Start service

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
mov ebx, ecx
lea r15d, [rbx + 2]
movsxd rax, r15d
mov ecx, 8
mul rcx
mov rcx, 0xffffffffffffffff
cmovno rcx, rax
call fcn.140013ea4
mov rsi, rax
lea rax, str.software_update
movq xmm0, rax
lea rax, str.MozillaMaintenance
movq xmm1, rax
punpcklqdq xmm1, xmm0
movdqu xmmword [rsi], xmm1
test ebx, ebx
jle 0x14000fcee
mov r8d, ebx
lea rcx, [rsi + 0x10]
shl r8, 3
mov rdx, rdi
call fcn.140027f10
lea rcx, str.MozillaMaintenance
mov edx, 5
call fcn.14000fa50
cmp eax, 1
jne 0x14000fda9
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x14000fdb3
mov rbx, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 0x10
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x14000fdba
mov rdi, rax
mov qword [rsp + 0x20], rbx
xor ebp, ebp
mov r12, qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
xor r13d, r13d
nop
mov rcx, rdi
mov edx, r15d
mov r8, rsi
call r12
test eax, eax
jne 0x14000fd8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov ecx, 0x64
call r14
add r13d, 0x64
cmp r13d, 0x1388
jb 0x14000fd60
mov ebp, ebx
mov rbx, qword [rsp + 0x20]
mov r14, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call r14
mov rcx, rbx
call r14
jmp 0x14000fdc8
mov ebp, eax
add ebp, 0x4e20
jmp 0x14000fdc8
mov ebp, 0x4269
jmp 0x14000fdc8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebp, 0x426a
mov rcx, rsi
call fcn.140013eac
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14000fdf0
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x240
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x238], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
xor edx, edx
call fcn.140016100
mov rcx, rdi
call fcn.1400220e8
cmp rax, 0x104
ja 0x14000fe6d
lea rbx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rbx
mov rdx, rdi
call fcn.1400225b0
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathStripToRootW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
cmp eax, 3
sete cl
mov dword [rsi], ecx
mov ebx, 1
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.140023fe0
mov eax, ebx
add rsp, 0x240
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000fe90
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edi, edi
call fcn.14000ec60
test al, al
je 0x14000ff87
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
xor edi, edi
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ff87
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x44], 4
lea rbx, [rsp + 0x44]
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, str.ConsentPromptBehaviorAdmin
xor edi, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000ff30
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000ff87
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rdx, str.PromptOnSecureDesktop
xor edi, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000ff87
xor eax, eax
cmp dword [rsp + 0x34], 0
jne 0x14000ff80
xor eax, eax
cmp dword [rsp + 0x30], 0
sete al
mov dword [rsi], eax
mov edi, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140023fe0
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret

Function at 0x140010040
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push rsi
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x278], rax
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400100b4
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400100ea
lea rdx, [rsp + 0x54]
lea rsi, [0x140048568]
mov r8d, 0x105
mov rcx, rsi
call fcn.1400225b0
mov word [0x140048770], 0
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140023fe0
mov rax, rsi
add rsp, 0x280
pop rsi
ret
lea rcx, [rsi + 8]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
jne 0x140010075
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.14001ba74
cmp esi, 2
mov ecx, 9
cmove ecx, esi
mov dword [rax], ecx
xor esi, esi
jmp 0x140010098
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400100f9
xor esi, esi
jmp 0x140010098
call fcn.14001ba74
mov dword [rax], 2
xor esi, esi
jmp 0x140010098
Function at 0x1400103c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea r8, [0x14003d8bc]
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.14001f53c
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x140010421
mov ecx, 0x818
call fcn.14002171c
test rax, rax
je 0x14001044f
mov rsi, rax
mov qword [rax], rdi
mov rcx, rax
add rcx, 8
mov r8d, 0x80c
xor edx, edx
call fcn.140016100
jmp 0x140010459
mov ecx, 2
call fcn.140016988
lea rcx, str.ERROR:_could_not_open_file_in_mar_wopen___n
mov edx, 0x2a
mov r8d, 1
mov r9, rax
call fcn.140021258
mov rcx, rsi
call fcn.14001f688
jmp 0x140010457
mov rcx, rdi
call fcn.1400209d4
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140023fe0
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret