joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f80e0
Capabilities:
Get disk information

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x1398]
mov eax, 0x1498
call fcn.1402c8f60
sub rsp, rax
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x1380], rax
cmp qword [rcx + 0x3f0], 0
mov r14, rcx
ja 0x1400f82df
mov eax, dword [0x14034d5ec]
lea rdx, [rbp + 0x380]
mov ecx, 0x3ff
mov dword [rsp + 0x70], eax
movzx eax, word [0x14034d5f0]
mov word [rsp + 0x74], ax
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [rbp + 0x380], 0
je 0x1400f82df
mov qword [rsp + 0x14b8], rbx
mov qword [rsp + 0x1490], rdi
lea rdi, [rbp + 0x380]
mov qword [rsp + 0x14c0], rsi
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi]
lea rdx, [rbp + 0xb80]
lea rcx, [rsp + 0x70]
mov r8d, 0x400
mov word [rsp + 0x70], ax
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x1400f82a0
lea r8, [rbp + 0xb80]
lea rdx, [rsp + 0x70]
lea rcx, str._ws___ws_r_n
call fcn.1402b7a88
lea rcx, [rbp + 0xb80]
mov edx, 0x3b
call fcn.1402ba4e4
test rax, rax
je 0x1400f8254
mov edx, 0x3a
mov rcx, rax
call fcn.1402ba4e4
test rax, rax
je 0x1400f82a0
mov edx, 0x5c
mov rcx, rax
call fcn.1402ba4e4
mov rsi, rax
test rax, rax
je 0x1400f82a0
lea r8, [0x140345f98]
lea rcx, [rbp - 0x80]
mov edx, 0x200
call fcn.1402b6e28
lea rcx, [rbp - 0x80]
mov r8, rsi
mov edx, 0x200
call fcn.1402b9308
lea rax, [rbp - 0x80]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movzx eax, word [rdi]
lea rcx, [r14 + 0x3e8]
mov word [rsp + 0x48], ax
call fcn.14011b320
lea rdx, [rsp + 0x50]
jmp 0x1400f827e
lea rax, [rbp + 0xb80]
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 0x3e8]
mov qword [rsp + 0x30], rax
movzx eax, word [rdi]
mov word [rsp + 0x38], ax
call fcn.14011b320
lea rdx, [rsp + 0x60]
lea r9, [rax + 0x20]
lea rcx, [r14 + 0x3e8]
mov qword [rsp + 0x20], rax
call fcn.14011b390
nop dword [rax]
nop word [rax + rax]
inc rbx
cmp word [rbp + rbx*2 + 0x380], 0
jne 0x1400f82a0
inc rbx
lea rdi, [rbp + 0x380]
cmp word [rdi + rbx*2], 0
lea rdi, [rdi + rbx*2]
jne 0x1400f8180
mov rdi, qword [rsp + 0x1490]
mov rsi, qword [rsp + 0x14c0]
mov rbx, qword [rsp + 0x14b8]
mov al, 1
mov rcx, qword [rbp + 0x1380]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0x1498
pop r14
pop rbp
ret
Function at 0x1400fa130
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
sub rsp, 0x38
mov rbp, rcx
xor ecx, ecx
mov dil, 1
call fcn.1400f1cf0
xor esi, esi
mov r14, rax
test rax, rax
je 0x1400fa1cb
mov rcx, qword [r14 + 8]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, str.NoRemnantScan
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x68], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
mov rbx, qword [rsp + 0x30]
jne 0x1400fa1ad
cmp dword [rsp + 0x68], esi
movzx edi, dil
cmovne edi, esi
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
test dil, dil
jne 0x1400fa1cb
xor al, al
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp byte [rbp + 0x22], sil
sete al
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400fb060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rsi
mov rbx, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400fb197
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
movzx ecx, word [0x14041949c]
cmp cx, word [rax]
jne 0x1400fb124
lea rcx, vtable.Core::Text::UnicodeEncoding.0
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140209460
mov rbx, rax
mov edx, dword [rax + 0xc]
mov rcx, rsi
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsi + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsi]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
mov rcx, rsi
call fcn.1401fde50
nop
cmp dword [rsp + 0x40], 0
jle 0x1400fb122
mov rcx, qword [rsp + 0x38]
call fcn.1402b7350
nop
jmp 0x1400fb18c
lea rcx, vtable.Core::Text::ASCIIEncoding.0
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x20], ebp
xor r9d, r9d
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.140201ca0
mov rbx, rax
mov edx, dword [rax + 0xc]
mov rcx, rsi
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsi + 8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsi]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
mov rcx, rsi
call fcn.1401fde50
nop
cmp dword [rsp + 0x40], 0
jle 0x1400fb18c
mov rcx, qword [rsp + 0x38]
call fcn.1402b7350
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400fb220
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov rsi, rcx
mov edx, 0x136
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400fb2f0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
je 0x1400fb2ee
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov r14d, edi
shr rdi, 5
mov ecx, 0x40
call fcn.1402b6dbc
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400fb2af
mov rdx, rdi
mov rcx, rax
call fcn.1401190f0
nop
mov qword [rsi + 0x4e0], rax
lea rdi, [r14 + rbx]
cmp rbx, rdi
jae 0x1400fb2e5
nop
movzx r9d, byte [0x14042918b]
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, qword [rsi + 0x4e0]
call fcn.14011af00
add rbx, 0x20
cmp rbx, rdi
jb 0x1400fb2c0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1400fc540
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x270], 0
mov rdi, rcx
je 0x1400fc55b
mov al, 1
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x40]
mov r9, rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1400fc5a0]
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
test rax, rax
mov qword [rdi + 0x270], rax
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x1400fe460
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x50
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebp, 1
xor edx, edx
xor ecx, ecx
mov r8d, ebp
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400fe4ef
lea r8d, [rbp + 3]
lea rdx, str.hitmanpro37
mov rcx, rax
mov qword [rsp + 0x60], rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400fe4e1
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x1400fe4d8
cmp dword [rsp + 0x24], 4
movzx ebx, bl
cmove ebx, ebp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x60]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400fe510
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp word [0x1404297d0], 0
jne 0x1400fe57a
lea rbx, [0x1404297d0]
mov edx, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str.drivers_
mov edx, 0x104
mov rcx, rbx
call fcn.1402b9308
lea r8, str.hitmanpro37
mov edx, 0x104
mov rcx, rbx
call fcn.1402b9308
lea r8, str..sys
mov edx, 0x104
mov rcx, rbx
call fcn.1402b9308
mov rax, rbx
add rsp, 0x20
pop rbx
ret
lea rax, [0x1404297d0]
add rsp, 0x20
pop rbx
ret

Function at 0x1400fe590
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
xor dil, dil
call fcn.1400fe510
xor ecx, ecx
lea r8d, [rcx + 0xa]
mov edx, 0x12d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400fe5da
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Error__d_while_trying_to_driver__resource__r_n
mov edx, eax
call fcn.1402b7a88
mov al, 1
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r15, rax
test rax, rax
jne 0x1400fe61e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LoadResource___failed___d__r_n
mov edx, eax
call fcn.1402b7a88
jmp 0x1400fe72d
mov qword [rsp + 0x78], rbp
mov rcx, rax
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r13
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r13d, r13d
mov r12, rax
mov ebx, r13d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x80
mov qword [rsp + 0x30], r13
cmp eax, 0xffffffff
mov edx, 0x1f01ff
cmove eax, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x1400fe6af
test ebx, ebx
jne 0x1400fe692
call fcn.1400febd0
jmp 0x1400fe6f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateFile___on___s__failed___d__r_n
mov rdx, rsi
mov r8d, eax
call fcn.1402b9694
mov dil, 1
jmp 0x1400fe6f0
lea r9, [rsp + 0x70]
mov r8d, r14d
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400fe6e9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.WriteFile___on___s__failed___d__r_n
mov rdx, rsi
mov r8d, eax
call fcn.1402b9694
mov dil, 1
jmp 0x1400fe6f0
cmp dword [rsp + 0x70], r14d
je 0x1400fe6fd
inc ebx
cmp ebx, 2
jl 0x1400fe645
jmp 0x1400fe700
xor dil, dil
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
cmp rbp, 0xffffffffffffffff
je 0x1400fe71f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
movzx eax, dil
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400febd0
Capabilities:
Check for time delay via gettickcount
Delete file
Delete service
Query service status
Stop service

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400fed2a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x90], rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, str.hitmanpro37
mov r8d, 0x10024
mov rcx, rdi
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x1400fed11
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x1400fec64
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SERVICE_CONTROL_STOP_failed__d_r_n
mov edx, eax
call fcn.1402b7a88
cmp dword [rsp + 0x3c], 3
jne 0x1400fecff
mov qword [rsp + 0x88], rbp
mov ebp, 0x1388
nop dword [rax]
mov eax, 0xcccccccd
mul dword [rsp + 0x50]
shr edx, 3
cmp edx, 0x3e8
jae 0x1400fec9b
mov edx, 0x3e8
jmp 0x1400feca0
cmp edx, ebp
cmova edx, ebp
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, 0x24
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400fecf7
mov edx, dword [rsp + 0x3c]
cmp edx, 1
je 0x1400fecf7
lea rcx, str.Waiting_for_driver_to_stop__status_08x_..._r_n
call fcn.1402b7a88
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x2710
ja 0x1400fecf7
cmp dword [rsp + 0x3c], 3
je 0x1400fec80
mov rbp, qword [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x80]
call fcn.1400fe510
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0x70
pop rdi
ret
Function at 0x1400feef0
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x760], rax
lea rsi, [0x140346ce0]
mov qword [rsp + 0x30], rsi
xor edi, edi
mov qword [rsp + 0x38], rdi
xor eax, eax
mov qword [rsp + 0x40], rax
mov r8d, 0x400
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x60]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400fef60
mov qword [rsp + 0x28], rdi
test ebx, ebx
jne 0x1400fef7a
mov qword [rsp + 0x20], rsi
jmp 0x1400fefa1
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rsp + 0x28]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.1400d44c0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rsp + 0x38]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rsp + 0x30]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1401fde50
nop
cmp dword [rsp + 0x50], 0
jle 0x1400ff007
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
nop
cmp dword [rsp + 0x28], 0
jle 0x1400ff018
mov rcx, qword [rsp + 0x20]
call fcn.1402b7350
lea rdx, [rsp + 0x30]
lea rcx, [0x1400fed50]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x40]
cmp dword [rsp + 0x38], 0
jle 0x1400ff040
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
mov rax, rbx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140104160
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0xe0
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, r8
mov rbx, rdx
mov rbp, rcx
call fcn.1401130a0
test al, al
je 0x14010419b
mov byte [r14], 1
mov al, 1
jmp 0x1401042c8
mov rdx, rbx
mov rcx, rbp
call fcn.1400f8ca0
test rax, rax
je 0x1401042e6
mov r9, qword [rax]
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0xd0], rdi
call qword [r9 + 0x30]
mov rdi, rax
test rax, rax
je 0x1401042e4
mov ecx, 0x10000
mov qword [rsp + 0xd8], rsi
xor ebx, ebx
call fcn.1402b7390
mov r10, qword [rdi]
lea r9, [rsp + 0x20]
mov rdx, rax
mov r8d, 0x10000
mov rcx, rdi
mov rsi, rax
call qword [r10 + 8]
test al, al
je 0x140104235
nop word [rax + rax]
add ebx, dword [rsp + 0x20]
mov r10, qword [rdi]
mov r8d, 0x10000
mov edx, ebx
lea r9, [rsp + 0x20]
mov rcx, rdi
add rdx, rsi
sub r8d, ebx
call qword [r10 + 8]
test al, al
jne 0x140104210
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
lea r8, [rsp + 0x30]
mov edx, ebx
movups xmm0, xmmword [0x140328970]
movups xmm1, xmmword [0x140328980]
mov rcx, rsi
mov qword [rsp + 0x30], 0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm1
call fcn.14018c2d0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.14018c3c0
mov rcx, rsi
call fcn.1402b7350
mov rbx, qword [rbp + 0x4e0]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140119f60
mov rax, qword [rbx]
mov rsi, qword [rsp + 0xd8]
cmp qword [rsp + 0x28], rax
setne al
mov byte [r14], al
mov al, 1
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0xe0
pop r14
pop rbp
pop rbx
ret
jmp 0x1401042c0
jmp 0x1401042c8
Function at 0x1401042f0
Capabilities:
Hash data using sha256

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0xf0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, rdx
mov rsi, rcx
lea rax, vtable.Core::ByteArray.0
mov qword [rsp + 0x20], rax
xor ebp, ebp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140206130
test al, al
je 0x1401043cd
mov edx, dword [rsp + 0x28]
mov eax, 0x10000
cmp edx, eax
cmovg edx, eax
mov qword [rsp + 0x50], rbp
movups xmm0, xmmword [0x140328970]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [0x140328980]
movups xmmword [rsp + 0x68], xmm1
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
call fcn.14018c2d0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xc0]
call fcn.14018c3c0
mov rbx, qword [rsi + 0x4e0]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140119f60
mov rax, qword [rbx]
cmp qword [rsp + 0x40], rax
je 0x1401043cd
mov bl, 1
jmp 0x1401043cf
xor bl, bl
cmp qword [rsp + 0x30], 0
je 0x1401043e9
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x140105210
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx ecx, word [0x1404295c0]
lea rbx, [0x1404295c0]
test cx, cx
jne 0x140105250
mov r8d, 0x104
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [0x1404295c0]
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140105254
cmp rax, 2
jb 0x1401052d2
cmp word [0x1404295c2], 0x3a
jne 0x1401052d2
movabs rax, 0x5c003a0043
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov word [rsp + 0x48], cx
xor ecx, ecx
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1401052d2
test dword [rsp + 0x40], 0x80000
je 0x1401052d2
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0x60
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0x60
pop rbx
ret
Function at 0x140105db0
Capabilities:
Copy file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp word [0x1404295c0], 0
mov rdi, rcx
jne 0x140105ddc
lea rdx, [0x1404295c0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dl, 1
mov ecx, 0x2af8
call fcn.14010b0b0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x140105e03
mov rcx, qword [rdi]
and eax, 0xfffffffe
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor ebx, ebx
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, [0x1404295c0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140105e6f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x140105e3f
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140105e58
mov r8, qword [rdi]
lea rdx, [0x1404295c0]
lea rcx, str.CopyFileW__ls_____ls_failed__d_r_n
mov r9d, eax
call fcn.1402b7a88
inc ebx
cmp ebx, 0xf0
jl 0x140105e10
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140107690
Capabilities:
Delete file
Set registry value

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rcx
mov eax, dword [0x140429a18]
test al, 1
jne 0x1401076df
or eax, 1
mov dword [0x140429a18], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1404299f0], rax
mov qword [0x1404299f8], 0xffffffff80000002
lea rcx, [0x1402fedc0]
call fcn.1402b8a74
lea rdx, [0x14034ce18]
lea rcx, [0x1404299f0]
call fcn.1400ea630
mov rbx, rax
test rax, rax
je 0x1401077b5
xor eax, eax
mov qword [rsp + 0x40], rax
lea edx, [rax + 0x13]
lea rcx, [rsp + 0x38]
call fcn.1401fcb40
mov ecx, dword [rsp + 0x40]
inc ecx
movsxd rdx, ecx
mov r9d, 0x13
lea r8, str.yyyy_MM_dd_HH:mm:ss
mov rcx, qword [rsp + 0x38]
call fcn.1402ba94c
mov edx, 0x13
lea rcx, [rsp + 0x38]
call fcn.1401fde50
nop
call fcn.140113b80
mov rcx, rax
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
call fcn.1400d6eb0
mov ecx, dword [rax + 0xc]
mov rdx, qword [rax]
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LastCFU
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [rsp + 0x50], 0
jle 0x140107797
mov rcx, qword [rsp + 0x48]
call fcn.1402b7350
nop
cmp dword [rsp + 0x40], 0
jle 0x1401077a8
mov rcx, qword [rsp + 0x38]
call fcn.1402b7350
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
xor edx, edx
mov ecx, 0x2710
call fcn.14010b0b0
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
call fcn.140107840
test al, al
jne 0x1401077e6
call fcn.140108450
test al, al
jne 0x1401077e6
call fcn.140108dc0
test bl, bl
jne 0x1401077fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error__d_while_trying_to_delete_the_downloaded_update_file._r_n
call fcn.1402b9694
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret