joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a5e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c80], 0
lea rbx, [rcx + 0x5c88]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001a683
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x14001a636
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.14001c6f0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004c90
mov eax, dword [rbx]
lea rcx, [0x14005281c]
mov r9, qword [rdi + 0x5c80]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x5c90]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001a68b
mov rcx, rbx
call fcn.140004c90
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001ab00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140052828]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001ab63
mov qword [rsp], rbx
lea rbx, [0x140044cc0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001ab43
cmp byte [r8], r9b
jne 0x14001ab43
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001ab30
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bf8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001ab97
mov r10, qword [r10 + 0x5c00]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001ab9e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001ab84
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140042a80
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140042aca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140042aca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140042aca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140042aca
cmp dword [rcx + 0x84], 0xe
jbe 0x140042aca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140042acc
xor al, al
add rsp, 0x28
ret
Function at 0x1400012bc
Capabilities:
Check http status code

Disassembly:
jmp 0x14001ba78
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rdi, rcx
xor r15d, r15d
mov qword [rcx + 0x900], r15
mov qword [rcx + 0x960], r15
mov qword [rcx + 0x978], r15
mov rsi, qword [rdi + 0x888]
lea r12, [rdi + 0x188]
mov r14, qword [rdi + 0x838]
sub r14, qword [rdi + 0x840]
mov rbx, qword [rdi + 0x890]
mov qword [rcx + 0x990], r15
mov rcx, qword [rcx + 0x178]
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], rsi
mov qword [rbp - 0x18], rbx
mov rax, qword [rcx + 0x9a10]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], r15
test rsi, rsi
je 0x14001c3f3
mov eax, dword [rsi + 8]
add rcx, 0xb040
lea edx, [rax + rax]
shl rdx, 5
add rdx, qword [r12 + 0x570]
call fcn.140001190
mov eax, dword [rsi + 8]
mov rcx, qword [rdi + 0x178]
add rcx, 0xb2c0
lea edx, [rax*2 + 1]
shl rdx, 5
add rdx, qword [r12 + 0x570]
call fcn.140001190
test rbx, rbx
je 0x14001bb96
mov eax, dword [rbx + 8]
mov rcx, qword [rdi + 0x178]
add rcx, 0xb180
lea edx, [rax + rax]
shl rdx, 5
add rdx, qword [r12 + 0x570]
call fcn.140001190
mov eax, dword [rbx + 8]
mov rcx, qword [rdi + 0x178]
add rcx, 0xb400
lea edx, [rax*2 + 1]
shl rdx, 5
add rdx, qword [r12 + 0x570]
call fcn.140001190
cmp qword [rdi + 0x48], r15
jne 0x14001c2fa
mov r13d, r15d
lea rdx, str.missing_class_reference
mov rcx, r12
call fcn.140001663
int3

Function at 0x1400012c1
Capabilities:
Terminate process

Disassembly:
jmp 0x140010cec
sub rsp, 0x28
mov rcx, qword [rcx + 0xc0]
lea rax, str.error_unpacking_archive
test rdx, rdx
cmovne rax, rdx
lea rdx, [0x14002e2a4]
cmp byte [rax], 0x40
lea r8, [rax + 1]
cmovne r8, rax
call fcn.140001384
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000f650
Capabilities:
Terminate process

Disassembly:
jmp 0x14000f650
push rbx
movsxd r11, r9d
mov rbx, r8
mov r10, rcx
test edx, edx
jns 0x14000f668
lea rcx, str.bad_value_count
jmp 0x14000f6d6
mov r9, qword [rcx]
cmp r11d, 1
je 0x14000f6aa
mov ecx, 0x100
cmp dword [rsp + 0x30], ecx
je 0x14000f6aa
sub ecx, dword [rsp + 0x30]
mov r8d, r11d
jmp 0x14000f6a1
inc r9
sub r8d, 1
je 0x14000f697
movzx eax, byte [r9 - 1]
cmp eax, ecx
jge 0x14000f6a1
dec edx
mov r8d, r11d
cmp r9, rbx
ja 0x14000f6cf
test edx, edx
jg 0x14000f685
mov qword [r10], r9
pop rbx
ret
movsxd r8, edx
mov rcx, r11
imul r11, r8
xor edx, edx
mov rax, r11
div rcx
cmp rax, r8
jne 0x14000f6cf
lea rax, [r11 + r9]
cmp rax, rbx
ja 0x14000f6cf
mov qword [r10], rax
pop rbx
ret
lea rcx, str.EOF_reading_band
xor edx, edx
pop rbx
jmp fcn.14000101e

Function at 0x140010cec
Capabilities:
Terminate process

Disassembly:
jmp 0x140010cec
sub rsp, 0x28
mov rcx, qword [rcx + 0xc0]
lea rax, str.error_unpacking_archive
test rdx, rdx
cmovne rax, rdx
lea rdx, [0x14002e2a4]
cmp byte [rax], 0x40
lea r8, [rax + 1]
cmovne r8, rax
call fcn.140001384
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140014eac
Capabilities:
Terminate process

Disassembly:
jmp 0x140014eac
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, 2
call fcn.1400010b9
movzx ecx, bx
mov rdx, rax
cmp ebx, ecx
je 0x140014edb
xor edx, edx
lea rcx, str.Internal_buffer_overflow
add rsp, 0x20
pop rbx
jmp fcn.14000101e
mov eax, ebx
mov byte [rdx + 1], bl
sar eax, 8
mov byte [rdx], al
add rsp, 0x20
pop rbx
ret

Function at 0x14001ba78
Capabilities:
Check http status code

Disassembly:
jmp 0x14001ba78
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rdi, rcx
xor r15d, r15d
mov qword [rcx + 0x900], r15
mov qword [rcx + 0x960], r15
mov qword [rcx + 0x978], r15
mov rsi, qword [rdi + 0x888]
lea r12, [rdi + 0x188]
mov r14, qword [rdi + 0x838]
sub r14, qword [rdi + 0x840]
mov rbx, qword [rdi + 0x890]
mov qword [rcx + 0x990], r15
mov rcx, qword [rcx + 0x178]
mov qword [rbp + 0x58], r14
mov qword [rbp + 0x60], rsi
mov qword [rbp - 0x18], rbx
mov rax, qword [rcx + 0x9a10]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], r15
test rsi, rsi
je 0x14001c3f3
mov eax, dword [rsi + 8]
add rcx, 0xb040
lea edx, [rax + rax]
shl rdx, 5
add rdx, qword [r12 + 0x570]
call fcn.140001190
mov eax, dword [rsi + 8]
mov rcx, qword [rdi + 0x178]
add rcx, 0xb2c0
lea edx, [rax*2 + 1]
shl rdx, 5
add rdx, qword [r12 + 0x570]
call fcn.140001190
test rbx, rbx
je 0x14001bb96
mov eax, dword [rbx + 8]
mov rcx, qword [rdi + 0x178]
add rcx, 0xb180
lea edx, [rax + rax]
shl rdx, 5
add rdx, qword [r12 + 0x570]
call fcn.140001190
mov eax, dword [rbx + 8]
mov rcx, qword [rdi + 0x178]
add rcx, 0xb400
lea edx, [rax*2 + 1]
shl rdx, 5
add rdx, qword [r12 + 0x570]
call fcn.140001190
cmp qword [rdi + 0x48], r15
jne 0x14001c2fa
mov r13d, r15d
lea rdx, str.missing_class_reference
mov rcx, r12
call fcn.140001663
int3
Function at 0x1400012f0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdi, [0x14004ea40]
mov rcx, rdi
call fcn.140015368
test rax, rax
je 0x14000152a
mov rbx, rax
movzx eax, word [rdi + rax*2 - 2]
cmp eax, 0x5c
je 0x140001522
cmp eax, 0x2f
je 0x140001522
mov rax, rbx
add rax, 2
lea r14, [rbx + rbx + 4]
mov rcx, 0xffffffffffffffff
cmovns rcx, r14
call fcn.140015294
mov rdi, rax
xor r15d, r15d
mov rcx, rax
xor edx, edx
mov r8, r14
call fcn.1400170d0
lea r8, [rbx + 1]
lea rdx, [0x14004ea40]
mov rcx, rdi
call fcn.14001549c
mov rcx, rdi
call fcn.1400154e4
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x38]
mov qword [rcx], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14000152e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov edx, 0x8003
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001561
add ebx, ebx
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140001561
lea r9, [rsp + 0x2c]
mov dword [r9], 4
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
lea r8, [rsp + 0x28]
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001561
lea r14, [rsp + 0x28]
mov r15d, dword [r14]
mov rcx, r15
call fcn.140015294
mov rbx, rax
mov rcx, rax
xor edx, edx
mov r8, r15
call fcn.1400170d0
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x20], 0
mov edx, 2
mov r8, rbx
mov r9, r14
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x140001561
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14000148d
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000149f
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, rdi
call fcn.140015494
lea rdx, [0x140043ffc]
mov r8d, 0x104
mov rcx, rsi
call fcn.14001549c
mov ebp, 1
cmp dword [rsp + 0x28], 0
je 0x1400014fb
add rsi, 0x48
xor r14d, r14d
lea rdi, str._.2x
mov r15, qword [sym.imp.USER32.dll_wsprintfW]
movzx r8d, byte [rbx + r14]
mov rcx, rsi
mov rdx, rdi
call r15
add rsi, 4
inc r14
mov eax, dword [rsp + 0x28]
cmp r14, rax
jb 0x1400014dd
mov rdi, rbx
mov rcx, rdi
call fcn.140015494
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140027f60
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
dec rbx
jmp 0x140001340
xor ebp, ebp
jmp 0x140001506
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x140001561
mov dword [rsp + 0x20], 0xf0000008
lea rcx, [rsp + 0x38]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400013c0
xor ebp, ebp
jmp 0x1400014fe
Function at 0x1400044d0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov dx, 0x2f
call fcn.14001740c
test rax, rax
je 0x140004505
mov rsi, rax
mov word [rax], 0
mov rcx, rdi
call fcn.1400044d0
mov ebx, eax
test eax, eax
je 0x140004511
mov word [rsi], 0x2f
jmp 0x140004507
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
cmp word [rdi], 0
je 0x1400044fe
mov rcx, rdi
call fcn.140020f54
test eax, eax
jns 0x1400044fe
call fcn.14001c8b0
cmp dword [rax], 0x11
je 0x1400044fe
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000456e
call fcn.14001c8b0
mov r9d, dword [rax]
lea rdx, str.ensure_parent_dir:_failed_to_create_directory:__S__err:__d
mov r8, rdi
call fcn.1400137e0
mov ebx, 7
jmp 0x1400044fe
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140004550
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140004550
Function at 0x140007a80
Capabilities:
Copy file

Disassembly:
push rsi
sub rsp, 0x660
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x658], rax
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007c65
mov rcx, qword [0x14004fc78]
test rcx, rcx
je 0x140007adb
call fcn.1400222a4
mov qword [0x14004fc78], 0
cmp byte [0x14004ea39], 1
jne 0x140007b83
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400170d0
mov rcx, rsi
call fcn.140013400
test eax, eax
je 0x140007b37
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400170d0
lea rcx, [0x1400437c8]
mov rdx, rsi
call fcn.140013500
test eax, eax
jne 0x140007b9d
lea rsi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400170d0
mov rcx, rsi
call fcn.140013400
test eax, eax
je 0x140007b83
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400170d0
lea rcx, [0x140043d68]
mov rdx, rsi
call fcn.140013500
test eax, eax
jne 0x140007c02
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.140027f60
nop
add rsp, 0x660
pop rsi
ret
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0x440]
call fcn.140037390
test eax, eax
je 0x140007b37
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400170d0
lea r8, str._supdate.status
lea r9, [0x14004e200]
mov edx, 0x105
mov rcx, rsi
call fcn.140004090
lea rcx, [rsp + 0x230]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x140007b37
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x440]
call fcn.140037390
test eax, eax
je 0x140007b83
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.1400170d0
lea r8, str._supdate_elevated.log
lea r9, [0x14004e200]
mov edx, 0x105
mov rcx, rsi
call fcn.140004090
lea rcx, [rsp + 0x20]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x140007b83
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007abf
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140007abf
Function at 0x140007cb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebx, r9d
mov rsi, r8
mov edi, edx
mov r14, rcx
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, str.MOZ_LAUNCHED_CHILD1
call fcn.14001fd80
mov rcx, r14
call fcn.140020594
test eax, eax
je 0x140007d23
mov eax, dword [0x14004fe88]
mov ecx, dword [0x14004cde8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140007dd5
lea rdx, str.Warning:_chdir_failed
call fcn.1400137e0
test bl, bl
je 0x140007d46
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140027f60
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsi]
lea r9, [rsp + 0x28]
mov edx, edi
mov r8, rsi
call fcn.140036f40
test eax, eax
je 0x140007d27
mov rsi, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov r14, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15, qword [sym.imp.KERNEL32.dll_SetLastError]
mov r12, qword [sym.imp.USER32.dll_WaitForInputIdle]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
call r14
mov ebx, eax
sub ebx, edi
cmp ebx, 0x270f
ja 0x140007dc5
xor ecx, ecx
call r15
mov edx, 0x2710
sub edx, ebx
mov rcx, rsi
call r12
cmp eax, 0xffffffff
jne 0x140007dc5
call r13
cmp eax, 0x5bf
jne 0x140007dc5
mov ecx, 0xa
call rbp
jmp 0x140007d8c
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140007d27
lea rcx, [0x14004fe88]
call fcn.140015660
cmp dword [0x14004fe88], 0xffffffff
jne 0x140007d17
mov qword [0x14004fc78], 0
lea rcx, [0x140003af0]
call fcn.1400157f8
lea rcx, [0x14004fe88]
call fcn.1400156c8
jmp 0x140007d17
Function at 0x140010bb0
Capabilities:
Hash data via wincrypt
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r12, qword [rsp + 0x90]
movq xmm0, rcx
movq xmm1, rdx
punpcklqdq xmm1, xmm0
movq xmm0, r12
movq xmm2, r8
punpcklqdq xmm2, xmm0
pxor xmm0, xmm0
pcmpeqd xmm2, xmm0
pshufd xmm3, xmm2, 0xb1
pand xmm3, xmm2
pcmpeqd xmm1, xmm0
pshufd xmm0, xmm1, 0xb1
pand xmm0, xmm1
packssdw xmm0, xmm3
movmskps eax, xmm0
test eax, eax
jne 0x140010c84
mov rbx, qword [rsp + 0xa0]
test rbx, rbx
je 0x140010c84
mov esi, r9d
mov r15d, r9d
mov rax, qword [rcx + 8]
sub rax, r15
jb 0x140010cbe
mov r14, rdx
mov rdx, qword [rdx]
cmp rdx, rax
ja 0x140010cbe
mov rdi, r8
mov ebp, dword [rsp + 0x98]
add rdx, qword [rcx]
mov rcx, r8
mov r8, r15
call fcn.140027fb0
add qword [r14], r15
mov r14d, ebp
xor r15d, r15d
mov r13, qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [r12 + r15*8]
mov rdx, rdi
mov r8d, esi
xor r9d, r9d
call r13
test eax, eax
je 0x140010cd1
inc r15
cmp r14, r15
jne 0x140010c64
xor eax, eax
jmp 0x140010cad
mov ecx, 2
call fcn.140017878
lea rcx, str.ERROR:_Invalid_parameter_specified._n
mov edx, 0x24
mov r8d, 1
mov r9, rax
call fcn.140022c28
mov eax, 0xffffffff
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call fcn.140017878
lea rdx, str.ERROR:_Could_not_read__s_n
jmp 0x140010ce2
mov ecx, 2
call fcn.140017878
lea rdx, str.ERROR:_Could_not_update_verify_context_for__s_n
mov rcx, rax
mov r8, rbx
call fcn.1400371a0
jmp 0x140010ca8
Function at 0x140012400
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov rbp, rcx
cmp dword [rcx], 4
mov rcx, qword [r8]
jne 0x140012420
sub r9, rcx
cmp r9, 5
jae 0x140012427
xor esi, esi
jmp 0x140012584
add rdx, rcx
mov edi, dword [rbp + 0x10]
add r9, 0xfffffffffffffffc
mov r10, 0xffffffffffffffff
xor esi, esi
lea r11, [0x1400402a8]
mov cl, byte [rdx + rsi]
and cl, 0xfe
cmp cl, 0xe8
jne 0x14001245c
mov rcx, rsi
sub rcx, r10
cmp rcx, 3
jbe 0x140012464
xor edi, edi
jmp 0x1400124a1
mov rcx, rsi
jmp 0x14001255b
dec cl
shl edi, cl
mov ecx, edi
mov edi, 0
and ecx, 7
je 0x1400124a1
mov eax, 0xe8
bt eax, ecx
jb 0x14001254e
movzx r10d, byte [rcx + r11]
mov rdi, rsi
sub rdi, r10
mov r10b, byte [rdi + rdx + 4]
dec r10b
cmp r10b, 0xfe
jae 0x14001254e
mov edi, ecx
mov cl, byte [rdx + rsi + 4]
dec cl
cmp cl, 0xfe
jae 0x1400124b8
lea edi, [rdi*2 + 1]
jmp 0x140012555
mov r14d, dword [rbp + 0xc]
mov r15d, 0xfffffffb
sub r15d, esi
mov ebx, dword [rdx + rsi + 1]
add ebx, r15d
sub ebx, r14d
test edi, edi
je 0x140012520
mov ecx, edi
movzx ecx, byte [rcx + r11]
shl ecx, 3
mov r10d, 0x18
sub r10d, ecx
neg cl
mov r12d, 0xffffffff
shl r12d, cl
mov r13d, ebx
mov ecx, r10d
shr r13d, cl
dec r13b
cmp r13b, 0xfe
jb 0x140012520
xor ebx, r12d
not ebx
add ebx, r15d
sub ebx, r14d
mov r13d, ebx
mov ecx, r10d
shr r13d, cl
dec r13b
cmp r13b, 0xfd
ja 0x140012503
lea rcx, [rsi + 4]
mov eax, ebx
and eax, 0x1000000
mov r10d, eax
neg r10d
or r10d, eax
mov byte [rdx + rsi + 1], bl
mov byte [rdx + rsi + 2], bh
shr ebx, 0x10
mov byte [rdx + rsi + 3], bl
shr r10d, 0x18
mov byte [rdx + rsi + 4], r10b
jmp 0x140012558
lea edi, [rcx*2 + 1]
mov rcx, rsi
mov r10, rsi
mov rsi, rcx
inc rsi
cmp rsi, r9
jb 0x140012441
mov rax, rsi
sub rax, r10
lea ecx, [rax - 1]
shl edi, cl
xor ecx, ecx
cmp rax, 4
cmovb ecx, edi
mov dword [rbp + 0x10], ecx
mov rcx, qword [r8]
add rcx, rsi
mov qword [r8], rcx
add dword [rbp + 0xc], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140013400
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140039010]
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140013456
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140015368
cmp rax, 0x105
jb 0x14001346d
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140027f60
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.14001549c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call fcn.140037390
test eax, eax
je 0x140013456
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400134ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140013456
lea rdx, str.UpdateLogs
mov rcx, rdi
call fcn.140037390
test eax, eax
je 0x140013456
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400134ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140013456
mov esi, 1
jmp 0x140013456
Function at 0x1400135d0
Capabilities:
Query service status

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, ecx
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ecx, ecx
xor edx, edx
mov r8d, 5
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
je 0x1400136c8
mov rsi, rax
lea rdx, str.MozillaMaintenance
mov rcx, rax
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
je 0x1400136ee
mov rdi, rax
lea rbx, [rsp + 0x2c]
mov dword [rbx + 4], 0xcf
imul ebp, ebp, 0x3e8
xor r14d, r14d
lea r15, [rsp + 0x28]
mov r12, qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], r15
mov rcx, rdi
xor edx, edx
mov r8, rbx
mov r9d, 0x24
call r12
test eax, eax
je 0x14001367d
cmp dword [rsp + 0x30], 1
jne 0x1400136ae
jmp 0x14001372f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jle 0x14001369a
lea ecx, [rax - 0x425]
cmp ecx, 2
jb 0x1400136ae
jmp 0x140013780
cmp eax, 0x79
jle 0x140013736
cmp eax, 0x41c
jne 0x140013761
mov ecx, 0x32
call r13
add r14d, 0x32
cmp r14d, ebp
jb 0x140013657
mov ebx, dword [rsp + 0x30]
jmp 0x14001379e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0x429
sete cl
xor ecx, 0xff
cmp eax, 5
mov ebx, 0xfd
cmovne ebx, ecx
jmp 0x1400137b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp edi, 0x7a
jg 0x140013718
cmp edi, 5
je 0x14001374c
cmp edi, 6
jne 0x14001375a
mov ebx, 0xec
jmp 0x1400137b1
cmp edi, 0x7b
je 0x140013753
cmp edi, 0x424
jne 0x14001375a
mov ebx, 0xee
jmp 0x1400137b1
mov ebx, 1
jmp 0x14001379e
cmp eax, 5
je 0x140013772
cmp eax, 6
je 0x140013779
cmp eax, 0x57
jne 0x14001378e
mov ebx, 0xdc
jmp 0x14001379a
mov ebx, 0xeb
jmp 0x1400137b1
mov ebx, 0xed
jmp 0x1400137b1
mov ebx, 0xef
jmp 0x1400137b1
cmp eax, 0x7a
je 0x140013795
cmp eax, 0x7c
jne 0x14001378e
mov ebx, 0xdd
jmp 0x14001379a
mov ebx, 0xda
jmp 0x14001379a
mov ebx, 0xd9
jmp 0x14001379a
cmp eax, 0x45b
jne 0x14001378e
mov ebx, 0xde
jmp 0x14001379a
mov ebx, 0xdf
jmp 0x14001379a
mov ebx, 0xdb
mov dword [rsp + 0x30], ebx
mov r14, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call r14
mov rcx, rsi
call r14
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140027f60
mov eax, ebx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140013900
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
mov rax, qword [0x14004c030]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x14004fc78], 0
je 0x14001399a
mov rsi, rdx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov r9, qword [0x14004fc78]
lea rcx, str._Warning:
mov edx, ntohl
mov r8d, 1
call fcn.140022c28
mov rbx, qword [rsp + 0x30]
mov rdi, qword [0x14004fc78]
call fcn.140001080
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov r8, rsi
xor r9d, r9d
call fcn.140017c34
mov r9, qword [0x14004fc78]
lea rcx, str._n
mov edx, 4
mov r8d, 1
call fcn.140022c28
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140027f60
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret