joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010370
Capabilities:
Create pipe

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbx, rcx
call fcn.140024740
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.WS2_32.dll_recv]
mov dword [rbx + 4], eax
lea rdi, [rbx + 0x14]
mov rcx, rdi
call qword [sym.imp.RPCRT4.dll_UuidCreate]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbx + 0x24], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x98], xmm0
movdqa xmm1, xmmword [0x1403e1a30]
movdqu xmmword [rsp + 0x98], xmm1
xor ebx, ebx
mov word [rsp + 0x88], bx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, qword [rdi]
cmp rcx, qword [0x1403a1788]
jne 0x14001041a
mov rcx, qword [rdi + 8]
cmp rcx, qword [0x1403a1790]
je 0x1400104ff
cmp dword [rdi + 0x18], 0
je 0x1400104ff
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
jb 0x1400104ff
add rax, 0x7530
cmp rcx, rax
ja 0x1400104ff
lea r8, [rsp + 0x88]
mov edx, 0x1c
mov rcx, rdi
call fcn.1400e3e50
test al, al
je 0x1400104ff
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1403e1a30]
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x40], bx
mov r8d, 9
lea rdx, str..pipe_
lea rcx, [rsp + 0x40]
call fcn.14000d3a0
nop
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140082ed0
nop
cmp qword [rax + 0x18], 8
jb 0x1400104b3
mov rax, qword [rax]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x1388
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
mov edx, 3
lea r9d, [rdx - 2]
lea r8d, [rdx + 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rbx, rax
lea rcx, [rsp + 0x68]
call fcn.14000c340
nop
lea rcx, [rsp + 0x40]
call fcn.14000c340
nop
lea rcx, [rsp + 0x88]
call fcn.14000c340
mov rax, rbx
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140282c10
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret

Function at 0x140010820
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
cmp qword [rcx + 0x30], rsi
jbe 0x140010867
cmp qword [rcx + 0x38], 8
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0x20]
mov rcx, rdi
jb 0x14001084b
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rdi + 0x18], 8
mov qword [rdi + 0x10], rsi
jb 0x14001085f
mov rdi, qword [rdi]
mov word [rdi], si
mov rdi, qword [rsp + 0x30]
cmp qword [rbx + 0x10], rsi
jbe 0x140010891
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14001087a
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp qword [rbx + 0x18], 8
mov qword [rbx + 0x10], rsi
jb 0x14001088e
mov rbx, qword [rbx]
mov word [rbx], si
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x1400108a0
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov rbx, rcx
call fcn.140010820
xor edx, edx
lea r8d, [rdx + 0x78]
lea rcx, [rbp - 0x10]
call fcn.140286140
lea rcx, [rbp - 0x10]
call fcn.140116010
nop
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x10]
call fcn.1401161a0
nop
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.1401166b0
nop
mov rdx, rax
lea rcx, [rbp - 0x38]
call fcn.14007f000
nop
lea rcx, [rsp + 0x68]
call fcn.14000bc00
nop
lea rcx, [rsp + 0x58]
call fcn.1400e6c20
lea rdx, [rbp - 0x58]
call fcn.1400101a0
nop
cmp qword [rbp - 0x48], 0
je 0x140010a15
cmp qword [rbp - 0x28], 0
je 0x140010a15
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x78]
call fcn.140082ed0
nop
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400109e5
call fcn.140024740
mov rsi, rax
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rbx, qword [rbp - 0x78]
mov rdi, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], rbx
lea rax, str.Could_not_create_directory__s__u
mov qword [rsp + 0x30], rax
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 0x63
lea r8, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcpackages_sledgehammer.5.0.0.70_build_nativeinclude_temporaryresourcefile.inl
lea rdx, [0x1403b8fe8]
mov rcx, rsi
call qword [rdi + 0x20]
xor bl, bl
jmp 0x140010a0a
lea rax, [rbp - 0x78]
cmp rbx, rax
je 0x140010a08
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
mov r8, qword [rbp - 0x68]
mov rcx, rbx
call fcn.14000d3a0
mov bl, 1
lea rcx, [rbp - 0x78]
call fcn.14000c340
jmp 0x140010a80
call fcn.140024740
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
mov r10, qword [rax]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rcx
lea rcx, str.Invalid_argument__s__s
mov qword [rsp + 0x30], rcx
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 0x5c
lea r8, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcpackages_sledgehammer.5.0.0.70_build_nativeinclude_temporaryresourcefile.inl
lea rdx, [0x1403b8fe8]
mov rcx, rax
call qword [r10 + 0x20]
xor bl, bl
lea rcx, [rbp - 0x58]
call fcn.14000c340
nop
lea rcx, [rbp - 0x38]
call fcn.14000c340
nop
lea rcx, [rbp - 0x10]
call fcn.140116060
movzx eax, bl
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140282c10
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140010ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, r9
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
lea rcx, [0x14047a970]
mov qword [rsp + 0x50], rcx
call fcn.14000ed80
nop
mov rsi, qword [0x14047a9b8]
lea rcx, [rsp + 0x50]
call fcn.140025120
test rsi, rsi
jne 0x140010b3c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
mov r8, rbx
cmp qword [rbx + 0x18], 8
jb 0x140010b49
mov r8, qword [rbx]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140010b56
mov rdx, qword [rdi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov r15, rax
test rax, rax
je 0x140010c6d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
test eax, eax
je 0x140010c6d
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140010c6d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x140010c6d
mov rcx, rbp
call fcn.1400108a0
test al, al
jne 0x140010c00
call fcn.140024740
mov r10, qword [rax]
lea rcx, str.Could_not_create_extract_directory
mov qword [rsp + 0x30], rcx
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, 0x78
lea r8, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcpackages_sledgehammer.5.0.0.70_build_nativeinclude_temporaryresourcefile.inl
lea rdx, [0x1403b8fe8]
mov rcx, rax
call qword [r10 + 0x18]
jmp 0x140010cdf
mov r8, r14
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.140082ed0
nop
call fcn.140024740
mov qword [rsp + 0x20], rax
mov r8d, r12d
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140083ae0
test al, al
jne 0x140010c33
xor bl, bl
jmp 0x140010c5e
lea rcx, [rbp + 0x20]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x140010c5c
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.14000d3a0
mov bl, 1
lea rcx, [rsp + 0x60]
call fcn.14000c340
movzx eax, bl
jmp 0x140010ce1
call fcn.140024740
mov r10, rax
cmp qword [r14 + 0x18], 8
jb 0x140010c7f
mov r14, qword [r14]
cmp qword [rbx + 0x18], 8
jb 0x140010c89
mov rbx, qword [rbx]
cmp qword [rdi + 0x18], 8
jb 0x140010c93
mov rdi, qword [rdi]
mov rax, qword [rax]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rdi
lea rcx, str.Could_not_unpack__s__s__s
mov qword [rsp + 0x30], rcx
lea rcx, str.Sledgehammer
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
mov r9d, WSACleanup
lea r8, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcpackages_sledgehammer.5.0.0.70_build_nativeinclude_temporaryresourcefile.inl
lea rdx, [0x1403b8fe8]
mov rcx, r10
call qword [rax + 0x20]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140282c10
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14001b710
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movzx edi, cl
xor eax, eax
mov qword [rbp + 0x3f], rax
mov qword [rbp + 0x47], rax
mov byte [rsp + 0x20], al
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3f]
call fcn.140053d10
nop
cmp qword [rbp + 0x3f], 0
jne 0x14001b827
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x2f], rax
lea rcx, [rbp + 0x1f]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.Failed_to_get_MBAMService_instance
call fcn.140036d30
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
xor dil, dil
mov rbx, qword [rbp + 0x47]
test rbx, rbx
je 0x14001b7fe
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
sub eax, 1
jne 0x14001b7fe
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14001b7fe
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
movzx eax, dil
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140282c10
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [0x1403e1a30]
movdqu xmmword [rbp + 7], xmm1
xor esi, esi
mov word [rbp - 9], si
lea r8d, [rsi + 0x24]
lea rdx, str.04657AB6_7CE0_4DB8_A183_C82F68264327
lea rcx, [rbp - 9]
call fcn.14000d3a0
nop
mov rcx, qword [rbp + 0x3f]
mov rax, qword [rcx]
movzx r8d, dil
lea rdx, [rbp - 9]
call qword [rax + 0xc0]
movzx ebx, al
lea rcx, [rbp - 9]
call fcn.14000c340
test bl, bl
je 0x14001b7c6
test dil, dil
je 0x14001b8a1
lea rdx, str.SystemCurrentControlSetServicesMBAMService630E9C3A_8B00_490E_81C4_DDD5EF234BAA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dil, 1
jmp 0x14001b7c9
xor eax, eax
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x37], rax
lea rbx, vtable.mb::common::system::ScopedAny_struct_HKEY______ptr64__long_int____cdecl___struct_HKEY______ptr64___long_int___cdecl_RegCloseKey_struct_HKEY______ptr64___0__0__0_.0
mov qword [rbp + 0x2f], rbx
mov qword [rbp + 0x37], rsi
mov qword [rbp + 0x37], rsi
lea r8, [rbp + 0x37]
lea rdx, str.SystemCurrentControlSetServicesMBAMService630E9C3A_8B00_490E_81C4_DDD5EF234BAA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop
mov qword [rbp + 0x2f], rbx
mov rcx, qword [rbp + 0x37]
test rcx, rcx
je 0x14001b8ea
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x37], rsi
mov dil, 1
jmp 0x14001b7c9
Function at 0x140021e70
Capabilities:
Copy file
Get common file path
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov byte [rax + 0x20], 0
lea r8, [rax + 0x20]
call fcn.140022240
test al, al
je 0x140021f66
cmp byte [rsp + 0x88], 0
je 0x140021f66
lea rax, [rsp + 0x28]
mov qword [rsp + 0x88], rax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.14007ed70
mov rbx, rax
lea rcx, [rsp + 0x28]
call fcn.14000b590
nop
mov rdx, rax
lea rcx, [0x14047aa00]
call fcn.14000b740
mov rcx, rax
lea rdx, str.No_changes_to_file:
call fcn.140036d30
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140021f08
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.1400421f0
lea rdx, str.__no_need_to_copy_
mov rcx, rax
call fcn.140036d30
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.14002c400
movzx edx, al
mov rcx, rbx
call fcn.14003af60
mov rcx, rbx
call fcn.14000bf70
nop
lea rcx, [rsp + 0x38]
call fcn.14000bc00
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov r9, rsi
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
jmp fcn.140092af0
Function at 0x1400262f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x14002632b
xor eax, eax
cmp dx, si
cmove di, ax
movzx eax, di
jmp 0x140026478
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140026367
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140026367
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, di
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x140026478
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x14002646d
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400263ae
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400263d7
movzx ecx, di
mov rdx, qword [rbx + 0x80]
call fcn.140290840
cmp ax, si
je 0x14002646d
movzx esi, di
jmp 0x14002646d
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], di
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x14002646d
cmp eax, 1
jle 0x14002642d
cmp eax, 3
jne 0x14002646d
movzx ecx, word [rsp + 0x50]
jmp 0x1400263ba
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x14002645a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.140291ae0
cmp rbp, rax
jne 0x14002646d
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, di
jne 0x140026470
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140282c10
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140027f30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140027f5d
xor eax, eax
jmp 0x1400280a3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140027f97
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140027f97
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400280a3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140028096
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140027fda
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140027fe9
movsx ecx, dil
jmp 0x14002803d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140028096
cmp eax, 1
jle 0x140028057
cmp eax, 3
jne 0x140028096
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1402905b4
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002809b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140028084
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140291ae0
cmp rsi, rax
jne 0x140028096
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14002809b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140282c10
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x14002b870
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14002b921
cmp byte [rcx + 0x72], 0
je 0x14002b921
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x14002b8e3
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x14002b8e7
sub eax, 1
je 0x14002b8eb
sub eax, 2
je 0x14002b921
xor al, al
jmp 0x14002b923
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14002b918
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140291ae0
cmp rdi, rax
jne 0x14002b8e3
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14002b923
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140282c10
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140044260
Capabilities:
Delete service

Disassembly:
push rdi
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400442fb
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
call fcn.140024740
mov rdi, qword [rdi + 8]
mov rsi, rax
cmp qword [rdi + 0x18], 8
jb 0x14004429a
mov rdi, qword [rdi]
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov r9d, 0x111
mov qword [rsp + 0x38], rdi
lea r8, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcpackages_sledgehammer.5.0.0.70_build_nativeinclude_sledgehammerimpl.inl
lea rax, str.Failed_to_delete_service__ls__u
mov rcx, rsi
mov qword [rsp + 0x30], rax
lea rdx, [0x1403b8fe8]
lea rax, str.Sledgehammer
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call qword [rbx + 0x20]
mov rsi, qword [rsp + 0x68]
mov eax, 0xe0002004
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
xor eax, eax
add rsp, 0x50
pop rdi
ret

Function at 0x140044420
Capabilities:
Modify service

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x10]
lea r8, [rsp + 0x50]
mov r9, rdx
mov dword [rsp + 0x50], eax
mov rdi, rcx
mov edx, ntohl
mov rcx, qword [r9]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
test eax, eax
jne 0x1400444f7
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rsi
call fcn.140024740
mov rdi, qword [rdi + 8]
mov rsi, rax
cmp qword [rdi + 0x18], 8
jb 0x140044483
mov rdi, qword [rdi]
mov rbx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov r9d, 0x135
mov qword [rsp + 0x38], rdi
lea r8, str.d:jenkinsworkspace_a_mbam3_updaterexe_srcpackages_sledgehammer.5.0.0.70_build_nativeinclude_sledgehammerimpl.inl
lea rax, str.Failed_to_set_protection_for_service__ls__u
mov rcx, rsi
mov qword [rsp + 0x30], rax
lea rdx, [0x1403b8fe8]
lea rax, str.Sledgehammer
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call qword [rbx + 0x20]
mov rsi, qword [rsp + 0x88]
mov eax, 0xe0002006
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140282c10
add rsp, 0x60
pop rdi
ret
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140282c10
add rsp, 0x60
pop rdi
ret
Function at 0x1400524f0
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x428]
sub rsp, 0x520
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x1404680d8]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rdi, r8
mov rbx, rdx
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x10]
call fcn.140286140
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x5c]
call fcn.140286140
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x60], 0x68
cmp qword [rbx + 0x18], 8
jb 0x140052569
mov rbx, qword [rbx]
mov r8, rbx
mov edx, 0x200
lea rcx, [rbp + 0x10]
call fcn.140290cf4
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140052644
mov dword [rbp - 0x68], ebx
mov edx, 0xea60
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [rbx + 0xa]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x68]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400525ee
mov eax, dword [rbp - 0x68]
mov dword [rdi], eax
jmp 0x14005262c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], bl
mov r8d, 0x1b
lea rdx, str.GetExitCodeProcess_failed:
lea rcx, [rsp + 0x50]
call fcn.14000bc80
nop
lea rcx, [rsp + 0x50]
call fcn.14004c820
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140052684
lea rax, [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], bl
mov r8d, reloc.WS2_32.dll_shutdown
lea rdx, str.CreateProcess_failed:
lea rcx, [rsp + 0x50]
call fcn.14000bc80
nop
lea rcx, [rsp + 0x50]
call fcn.14004c820
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140282c10
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret