joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400261a4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rdi, rcx
mov r9d, 1
mov rax, qword [rsp + 0x70]
mov dword [rax], r9d
xor ebx, ebx
mov qword [r11 + 0x28], rbx
movzx edx, r8w
sub edx, 0x91
je 0x1400262d6
sub edx, r9d
je 0x1400262c5
sub edx, r9d
je 0x1400262b2
sub edx, r9d
je 0x14002625c
cmp edx, r9d
jne 0x140026326
mov dword [rsp + 0x60], ebx
lea rdx, [r11 + 0x18]
add rcx, 0x13b8
call fcn.1400220bc
cmp al, bl
je 0x140026326
cmp dword [rsp + 0x60], ebx
sete bl
mov dword [rsp + 0x60], ebx
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140007ee0]
mov rcx, qword [rdi + 0x13b8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140026326
mov dword [rsp + 0x60], ebx
lea rdx, [rsp + 0x60]
add rcx, 0x13b8
call fcn.140022040
cmp al, bl
je 0x140026326
cmp dword [rsp + 0x60], ebx
sete bl
mov dword [rsp + 0x60], ebx
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140007ea8]
mov rcx, qword [rdi + 0x13b8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140026326
add rcx, 0x13b8
mov edx, 2
call fcn.140021f78
jmp 0x140026326
add rcx, 0x13b8
mov edx, r9d
call fcn.140021f78
jmp 0x140026326
mov dword [rsp + 0x60], ebx
lea rdx, [rsp + 0x60]
add rcx, 0x13b8
call fcn.140021fc4
cmp al, bl
je 0x140026326
cmp dword [rsp + 0x60], ebx
sete bl
mov dword [rsp + 0x60], ebx
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x140007e80]
mov rcx, qword [rdi + 0x13b8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call fcn.14001b2f0
nop
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140026350
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x140110688]
test rcx, rcx
jne 0x140026376
call fcn.140026404
test eax, eax
je 0x14002639d
mov rcx, qword [0x140110688]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x1400263f1
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400263a1
xor eax, eax
jmp 0x1400263f1
mov eax, dword [rax]
mov rcx, qword [0x140110688]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x1400263ce
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x1400263f1
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x140110688]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x1400263d5
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400265c0
Capabilities:
Hide graphical window

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
cmp dword [rcx + 0x88], 0
mov rbx, rcx
jne 0x1400266bd
xor edi, edi
mov dword [rcx + 0x88], 1
cmp dword [rcx + 0x58], edi
jle 0x140026653
xor esi, esi
test rsi, rsi
js 0x1400266da
cmp edi, dword [rbx + 0x58]
jge 0x1400266da
mov rax, qword [rbx + 0x50]
mov rbp, qword [rsi + rax]
test rbp, rbp
je 0x140026648
mov rcx, qword [rbx + 0x118]
xor r12d, r12d
test rcx, rcx
je 0x14002663b
mov edx, dword [rbp + 0x74]
call fcn.140032668
test rax, rax
je 0x14002663b
mov r12d, dword [rax + 0x70]
mov rax, qword [rbp]
mov edx, r12d
mov rcx, rbp
call qword [rax + 0x68]
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x58]
jl 0x1400265fc
mov rcx, qword [rbx + 8]
mov edx, 8
call qword [sym.imp.USER32.dll_ShowWindow]
cmp qword [rbx + 0x70], 0
jne 0x140026671
mov rcx, rbx
call fcn.140029c88
cmp qword [rbx + 0x68], 0
jne 0x14002669d
lea rcx, [rbx + 0x68]
call fcn.1400132ec
test eax, eax
js 0x14002669d
mov rcx, qword [rbx + 0x68]
lea rax, [rbx + 0x60]
cmp qword [rcx + 0x10], 0
je 0x140026699
test rax, rax
jne 0x14002669d
mov qword [rcx + 0x10], rax
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1400266bd
mov rdx, qword [rbx + 0x68]
test rdx, rdx
je 0x1400266bd
xor r9d, r9d
mov r8d, 0x800a
call fcn.14002a500
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r12
ret
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc000008c
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x140038c88
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
mov rax, qword [0x140104138]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.UxTheme.dll_IsThemeActive]
xor ebp, ebp
cmp eax, ebp
mov dil, bpl
lea r12d, [rbp + 1]
setne sil
cmp sil, bpl
jne 0x140038d23
xor eax, eax
lea r8, [rsp + 0x28]
lea edx, [rbp + 0x10]
mov qword [rsp + 0x28], rax
lea ecx, [rbp + 0x42]
xor r9d, r9d
mov dword [rsp + 0x28], 0x10
mov qword [rsp + 0x30], rax
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp eax, ebp
je 0x140038cfd
test byte [rsp + 0x2c], r12b
jne 0x140038d20
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSysColor]
cmp ebx, ebp
je 0x140038d20
mov dil, bpl
cmp eax, ebp
jne 0x140038d23
mov dil, r12b
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], ebp
call sub.dwmapi.dll_DwmIsCompositionEnabled
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 0x58
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0x5a
mov rcx, rbx
mov dword [0x140109c34], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rdx, rbx
xor ecx, ecx
mov dword [0x140109c38], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [rsp + 0x20], ebp
mov byte [0x140110729], sil
setne byte [0x14011072a]
mov byte [0x14011072b], dil
mov bl, bpl
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp ax, bp
je 0x140038dc3
mov r9d, 0x10
lea r8, [rsp + 0x28]
movzx ecx, ax
lea edx, [r9 + 0x48]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp eax, ebp
je 0x140038dc3
mov eax, 0x800
movzx ebx, bl
test word [rsp + 0x36], ax
cmovne ebx, r12d
mov byte [0x140110730], bl
lea rbx, [0x14010b1f0]
mov eax, dword [rbx]
cmp byte [0x140110729], bpl
jne 0x140038de0
test r12b, al
jmp 0x140038de2
test al, 6
je 0x140038e15
cmp byte [0x14011072a], bpl
jne 0x140038df1
test al, 3
jmp 0x140038df3
test al, 4
je 0x140038e15
cmp byte [0x140110729], bpl
jne 0x140038e52
mov rcx, qword [rbx + 0x20]
cmp rcx, rbp
je 0x140038e52
mov rax, qword [rcx]
mov edx, r12d
call qword [rax]
mov qword [rbx + 0x20], rbp
jmp 0x140038e52
mov rcx, qword [rbx + 0x18]
cmp rcx, rbp
je 0x140038e2a
mov rax, qword [rcx]
mov edx, r12d
call qword [rax]
mov qword [rbx + 0x18], rbp
mov rcx, qword [rbx + 0x20]
cmp rcx, rbp
je 0x140038e3f
mov rax, qword [rcx]
mov edx, r12d
call qword [rax]
mov qword [rbx + 0x20], rbp
mov rcx, qword [rbx + 0x48]
cmp rcx, rbp
je 0x140038e52
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rbx + 0x48], rbp
lea rax, [0x14010ed70]
add rbx, 0x70
cmp rbx, rax
jl 0x140038dd0
lea rbx, [0x140109e40]
mov rcx, qword [rbx]
cmp rcx, rbp
je 0x140038e7e
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rbx], rbp
lea rax, [0x140109ed0]
add rbx, 0x18
cmp rbx, rax
jl 0x140038e6d
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ec080
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x14006773c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
mov edi, 2
xor bl, bl
cmp dword [0x14011058c], edi
jne 0x14006775f
cmp dword [0x140110584], 5
jae 0x140067833
mov eax, dword [0x140110588]
and eax, 0x3ff
cmp eax, 4
je 0x1400678ca
cmp eax, 0x10
jle 0x14006778a
cmp eax, 0x12
jle 0x1400678ca
cmp eax, 0x78
je 0x1400678ca
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
mov r11d, eax
call fcn.140069074
test eax, eax
jne 0x140067833
mov eax, 0x459
cmp r11w, ax
je 0x140067833
mov eax, 0x860
cmp r11w, ax
je 0x140067833
and r11d, 0x3ff
cmp r11d, 0x39
je 0x140067833
cmp r11d, 0x44
jle 0x1400677ed
cmp r11d, 0x4f
jle 0x140067833
cmp r11d, 0x56
jle 0x1400677ed
cmp r11d, 0x58
jle 0x140067833
cmp r11d, 0x5b
je 0x140067833
cmp r11d, 0x61
je 0x140067833
cmp r11d, 0x1e
je 0x140067833
cmp r11d, 0x2a
je 0x140067833
cmp r11d, 0x4f
jle 0x1400678ca
cmp r11d, 0x51
jle 0x140067833
cmp r11d, 0x52
jle 0x1400678ca
cmp r11d, 0x55
jle 0x140067833
cmp r11d, 0x5e
je 0x140067833
cmp r11d, 0x71
jle 0x1400678ca
cmp r11d, 0x73
jg 0x1400678ca
lea rax, [rsp + 0x68]
lea rdx, [0x14000ca00]
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400678ca
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x14000ca20]
xor r8d, r8d
mov dword [rsp + 0x58], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400678a7
movzx eax, word [rsp + 0x50]
cmp al, 0x2f
jbe 0x1400678a7
sub al, 0x2f
movzx ebx, al
cmp al, 3
cmova ebx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp bl, dil
je 0x1400678ca
test bl, bl
je 0x1400678ca
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, eax
call fcn.140069824
jmp 0x1400678d5
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
and eax, 0x3ff
mov dword [0x1401103f4], eax
mov al, bl
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x1400678ec
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140104138]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
mov ebx, 1
lea rdx, [0x14000ca30]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov r9d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140067a00
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x14000ca48]
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140067976
cmp dword [rsp + 0x30], 4
cmovbe ebx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x14000ca58]
xor r8d, r8d
mov dword [rsp + 0x30], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400679f5
mov ecx, dword [rsp + 0x30]
cmp ecx, 8
ja 0x1400679f5
xor edx, edx
xor r9d, r9d
test ecx, ecx
je 0x1400679e7
lea r8, [rsp + 0x40]
movzx r10d, byte [r8]
lea eax, [r10 - 0x30]
cmp eax, 9
ja 0x1400679e7
lea eax, [rdx + rdx*4]
inc r9d
inc r8
lea edx, [r10 + rax*2 - 0x30]
cmp r9d, ecx
jb 0x1400679c7
or ecx, 0xffffffff
test edx, edx
cmovne ecx, edx
call qword [sym.imp.USER32.dll_SetCaretBlinkTime]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xff
cmp ebx, eax
cmovl eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ec080
add rsp, 0x50
pop rbx
ret
Function at 0x1400697e4
Capabilities:
Get keyboard layout

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
movzx ecx, ax
mov r11, rax
mov qword [0x1401103f8], rax
call fcn.140068fb4
cmp eax, 0x2e
ja 0x140069817
movsxd rcx, eax
lea rax, [0x140110400]
mov qword [rax + rcx*8], r11
add rsp, 0x28
ret

Function at 0x140069824
Capabilities:
Get geographical location

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140104138]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebx, ecx
and ebx, 0x3ff
cmp dword [0x14011058c], 2
jne 0x140069974
cmp dword [0x140110584], 5
jb 0x140069974
mov r9d, 0x14
lea r8, [rsp + 0x20]
lea edx, [r9 - 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140069974
movzx ecx, word [rsp + 0x22]
mov eax, 0xbe7
cmp ecx, eax
jg 0x140069919
je 0x140069912
cmp ecx, 0x31
je 0x14006990b
cmp ecx, 0x661
je 0x140069904
cmp ecx, 0x6f1
je 0x1400698fd
cmp ecx, 0x967
je 0x1400698f6
cmp ecx, 0x9e7
je 0x1400698ef
cmp ecx, 0xa67
je 0x1400698e5
cmp ecx, 0xae7
je 0x1400698db
cmp ecx, 0xb67
jne 0x140069974
mov ebx, 0x48
jmp 0x140069974
mov ebx, 0x47
jmp 0x140069974
mov ebx, 0x46
jmp 0x140069974
mov ebx, 0x45
jmp 0x140069974
mov ebx, 0x39
jmp 0x140069974
mov ebx, 0x29
jmp 0x140069974
mov ebx, 1
jmp 0x140069974
mov ebx, 9
jmp 0x140069974
mov ebx, 0x49
jmp 0x140069974
sub ecx, 0xc67
je 0x14006996f
mov eax, 0x80
sub ecx, eax
je 0x140069968
sub ecx, eax
je 0x140069961
sub ecx, 0xea
je 0x14006995a
sub ecx, eax
je 0x140069953
sub ecx, 0x50
je 0x14006994c
cmp ecx, 0x8c0
jne 0x140069974
lea ebx, [rax - 0x2d]
jmp 0x140069974
mov ebx, 0x51
jmp 0x140069974
mov ebx, 0x54
jmp 0x140069974
mov ebx, 0x1e
jmp 0x140069974
mov ebx, 0x4c
jmp 0x140069974
mov ebx, 0x4b
jmp 0x140069974
mov ebx, 0x4a
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ec080
add rsp, 0x50
pop rbx
ret
Function at 0x14007f1b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x410
movzx edi, byte [rcx + 0x11]
mov rbp, rcx
mov rcx, qword [0x140110970]
mov rax, qword [rcx]
mov rsi, rdx
movsx edx, word [rdx + 0x12]
mov r12, r8
call qword [rax + 0x20]
mov rcx, qword [0x140110970]
mov r9, qword [rcx]
movsx edx, word [rbp + 0x12]
mov rbx, rax
call qword [r9 + 0x20]
and dword [r12], 0
xor edx, edx
mov r11, rax
test edi, edi
jle 0x14007f243
mov ecx, dword [r11]
xor ecx, dword [rbx]
test ecx, 0xff000000
jne 0x14007f265
mov eax, dword [rbx + 4]
cmp dword [r11 + 4], eax
jne 0x14007f265
mov eax, dword [rbx + 8]
cmp dword [r11 + 8], eax
jne 0x14007f265
mov al, byte [rbx + 0xc]
cmp byte [r11 + 0xc], al
jne 0x14007f265
inc edx
add rbx, 0x10
add r11, 0x10
cmp edx, edi
jl 0x14007f20d
mov ax, word [rsi + 0x12]
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
mov rcx, qword [0x140110970]
movsx edx, word [rbp + 0x12]
mov dword [r12], 1
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ecx, edi
shl ecx, 4
mov rdx, rax
movsxd r8, ecx
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memmove
mov rcx, qword [0x140110970]
movsx edx, word [rsi + 0x12]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov r8, rdi
test edi, edi
jle 0x14007f2ca
lea rdx, [rsp + 0x20]
mov ecx, dword [rdx]
xor ecx, dword [rax]
add rax, 0x10
and ecx, 0xffffff
xor dword [rdx], ecx
add rdx, 0x10
sub r8, 1
jne 0x14007f2b0
mov rcx, qword [0x140110970]
mov r8d, edi
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
shl r8d, 2
call qword [rax + 0x18]
jmp 0x14007f247
Function at 0x1400eb99c
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x140104138]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call sub.msvcrt.dll_memset
and qword [rbx + 0x50], 0
and dword [rbx + 0x58], 0
and dword [rbx + 0x5c], 0
lea rax, [0x140000000]
mov esi, 0x94
lea rcx, [rsp + 0x20]
mov r8, rsi
xor edx, edx
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], rax
mov dword [rbx], 0x60
mov byte [rbx + 0x18], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x30], 2
mov esi, 1
jne 0x1400eba2f
cmp dword [rsp + 0x24], 5
jb 0x1400eba49
jmp 0x1400eba45
cmp dword [rsp + 0x30], esi
jne 0x1400eba49
cmp dword [rsp + 0x24], 4
ja 0x1400eba45
jne 0x1400eba49
cmp dword [rsp + 0x28], 0
jbe 0x1400eba49
mov byte [rbx + 0x18], sil
lea rax, [0x140001fe0]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x1c], 0x800
mov qword [rbx + 0x20], rax
call fcn.140013f64
movzx ecx, byte [0x140110af8]
test eax, eax
mov rax, rbx
cmovs ecx, esi
mov byte [0x140110af8], cl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400ec080
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400ec080
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140104138]
jne 0x1400ec09b
rol rcx, 0x10
test cx, 0xffff
jne 0x1400ec097
ret 0
ror rcx, 0x10
jmp 0x1400ec7b0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14010f9f0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x14010fae8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400ec835
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14010f9f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x1400ec857
mov rax, qword [rsp + 0x88]
mov qword [0x14010fae8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14010fa88], rax
mov rax, qword [0x14010fae8]
mov qword [0x14010f960], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14010fa70], rax
mov dword [0x14010f950], 0xc0000409
mov dword [0x14010f954], 1
mov rax, qword [0x140104138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140104140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400020c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400ec64c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x1400ec699
cmp rcx, 0xffffffffffffffff
je 0x1400ec699
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400ec691
cmp dword [rcx + 0x3c], edx
jl 0x1400ec691
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400ec691
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400ec699
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400ec8e4
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400ec94f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400ec96f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x1400020d8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1400013e0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rdx
mov rbp, rcx
mov rax, qword [0x140033010]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.14000af00
test rax, rax
je 0x140001611
mov rbx, rax
movzx eax, word [rbp + rax*2 - 2]
cmp ax, 0x5c
je 0x140001609
cmp ax, 0x2f
je 0x140001609
lea rax, [rbx + 2]
add rax, rax
mov rcx, 0xffffffffffffffff
cmovae rcx, rax
call fcn.14000ae14
mov rdi, rax
lea r8, [rbx + rbx]
add r8, 4
xor r14d, r14d
mov rcx, rax
xor edx, edx
call fcn.14000cda0
lea r8, [rbx + 1]
mov rcx, rdi
mov rdx, rbp
call fcn.14000b0c8
mov rcx, rdi
call fcn.14000b120
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x38]
mov qword [rcx], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140001616
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001649
add ebx, ebx
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001649
lea r9, [rsp + 0x2c]
mov dword [r9], 4
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001649
lea r14, [rsp + 0x28]
mov ebp, dword [r14]
mov rcx, rbp
call fcn.14000ae14
mov r15, rax
mov rcx, rax
xor edx, edx
mov r8, rbp
call fcn.14000cda0
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, r15
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001649
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140001574
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140001586
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.14000b0c0
lea rdx, str.SOFTWAREMozillaMaintenanceService_
mov r8d, 0x104
mov rcx, rsi
call fcn.14000b0c8
mov r14d, 1
cmp dword [rsp + 0x28], 0
je 0x1400015e1
add rsi, 0x48
xor ebp, ebp
lea rdi, str._.2x
mov rbx, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [r15 + rbp]
mov rcx, rsi
mov rdx, rdi
call rbx
add rsi, 4
inc rbp
mov eax, dword [rsp + 0x28]
cmp rbp, rax
jb 0x1400015c4
mov rdi, r15
mov rcx, rdi
call fcn.14000b0c0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140015cc0
mov eax, r14d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec rbx
jmp 0x14000142b
xor r14d, r14d
jmp 0x1400015ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140001649
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x38]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400014a7
xor r14d, r14d
jmp 0x1400015e4