joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c5fa0
Capabilities:
Get hostname

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea rdx, [r11 - 0x58]
lea rcx, [r11 - 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rcx, [rbx + 8]
call fcn.140018bf0
mov rdi, rax
lea rcx, [rbx + 8]
call fcn.140018bf0
mov rbx, rax
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x68]
mov edi, eax
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x58]
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x48], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x30], sil
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140009d60
nop
cmp byte [rsp + 0x50], sil
jne 0x1400c6047
mov ebx, esi
jmp 0x1400c6059
lea rax, [rsp + 0x50]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400c6050
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
mov r8, rbx
mov rdi, qword [rsp + 0x40]
cmp rdi, rbx
cmovb r8, rdi
test r8, r8
je 0x1400c608c
lea rdx, [rsp + 0x50]
call fcn.1401420f0
test eax, eax
jne 0x1400c60a0
cmp rdi, rbx
jae 0x1400c6096
or eax, 0xffffffff
jmp 0x1400c609e
mov eax, esi
cmp rdi, rbx
seta al
test eax, eax
sete bl
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x1400c60fb
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x1400c60f6
test cl, 0x1f
je 0x1400c60c9
call fcn.14014b4d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400c60d8
call fcn.14014b4d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400c60e7
call fcn.14014b4d8
int3
cmp rcx, 0x27
jbe 0x1400c60f3
call fcn.14014b4d8
int3
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0x48], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x30], 0
movzx eax, bl
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400c67d0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x60
cmp qword [rcx + 0x20], 0
mov rbx, rcx
je 0x1400c680f
cmp qword [rcx + 0x18], 0
jne 0x1400c680f
xor eax, eax
lea r8, [0x1400c68a0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1400c6815
add rsp, 0x60
pop rbx
ret
lea rax, vtable.std::exception.0
mov byte [rsp + 0x38], 1
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x48]
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, str.Could_not_create_licensing_thread.
mov qword [rsp + 0x30], rax
call fcn.140141cc8
lea rdx, [0x1403079f8]
lea rcx, [rsp + 0x40]
call fcn.1401419e8
int3
Function at 0x1400c8570
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 4
jae 0x1400c85da
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x1400c85b4
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x1400c8605
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x1400c8670
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov eax, dword [rbx + 0x10]
cmp dword [r8], eax
je 0x1400c8629
jmp 0x1400c8610
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rax + 8], rdx
dec qword [r11 + 0x10]
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x38], rcx
add rcx, 8
call fcn.1400091f0
mov rcx, rdi
call fcn.1400dbae0
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400c870c
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400c86af
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x1400c86cd
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x1400c86f9
cmp rax, rbx
jne 0x1400c86d7
mov qword [rdx], rdi
jmp 0x1400c86f9
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400c86f9
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.1400ca2f0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400ca8f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r8
jne 0x1400ca981
cmp qword [rcx], r8
jne 0x1400ca977
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1400ca98c
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x1400ca98c
cmp qword [rcx], r8
jne 0x1400ca991
mov rax, qword [r8]
mov qword [rcx], rax
mov r8, qword [rsp + 0x40]
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.1400ca9b0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400cb430
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x290
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x50], rdx
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], r12d
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x170]
call fcn.140141ad0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call fcn.140141ad0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.14010c600
mov rcx, qword [r15 + 0x28]
mov rax, qword [rcx]
mov edi, 1
mov edx, edi
call qword [rax + 0x18]
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax + 0xb0]
add rcx, 0x134
lea rdx, [rsp + 0x60]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 1]
test al, al
jne 0x1400cb4f0
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400cb5b1
mov edi, 2
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], r12d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsi], eax
test eax, eax
je 0x1400cb5a8
mov edi, 3
mov dword [rsp + 0x40], edi
mov ecx, eax
call fcn.140113934
mov rbx, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x44]
mov r8d, dword [rsi]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400cb5a8
or edi, 0xffffffff
mov dword [rsp + 0x40], edi
mov rcx, rbx
call fcn.1401139ac
mov rbx, r12
mov qword [rsp + 0x48], rbx
mov dword [rsi], r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r10, qword [r15]
mov dword [rsp + 0x30], edi
mov eax, dword [rsi]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x60]
lea r8, str.GetLogFileContent__s__0x_p__d____d_
mov edx, 4
mov rcx, r15
call qword [r10 + reloc.WS2_32.dll_recv]
nop
mov rax, rbx
jmp 0x1400cb5e6
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140113910
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400cbeb0
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x1d0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r15, rcx
mov qword [rsp + 0x58], rdx
xor esi, esi
mov qword [rsp + 0x48], rsi
test rdx, rdx
jne 0x1400cbefd
xor eax, eax
jmp 0x1400cc0a7
mov r14d, reloc.WS2_32.dll_recvfrom
mov qword [rsp + 0x50], r14
or ebx, 0xffffffff
mov dword [rsp + 0x40], ebx
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0xb0]
call fcn.140141ad0
mov edx, 0x104
lea rcx, [rsp + 0xb0]
call qword [sym.imp.WSOCK32.dll_gethostname]
test eax, eax
jne 0x1400cc069
lea rcx, [rsp + 0xb0]
call qword [sym.imp.WSOCK32.dll_gethostbyname]
test rax, rax
je 0x1400cc069
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov edx, dword [rcx]
mov r10d, edx
shr r10d, 0x18
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx r9d, al
movzx r8d, dl
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], ecx
lea rdx, str._d._d._d._d
lea rcx, [rsp + 0x70]
call fcn.1400a61e0
lea rax, [rsp + 0xb0]
or rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400cbfe0
lea rax, [rsp + 0x70]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400cbff0
lea r14, [rdi + 0x13]
add r14, rbx
mov qword [rsp + 0x50], r14
mov rcx, qword [r15 + 0x38]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rsi, rax
mov qword [rsp + 0x48], rax
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.140141ad0
mov dword [rsi], 0x200f
mov dword [rsi + 4], r14d
lea rcx, [rdi + 2]
add rcx, rbx
mov dword [rsi + 0xc], ecx
lea rcx, [rsi + 0x10]
mov r8, rdi
lea rdx, [rsp + 0xb0]
call fcn.1401415b0
lea rcx, [rsi + 0x11]
add rcx, rdi
mov r8, rbx
lea rdx, [rsp + 0x70]
call fcn.1401415b0
xor ebx, ebx
mov dword [rsp + 0x40], ebx
mov rax, qword [r15]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, r14
lea r8, str.ProcessGetIPAddress___d__d___s____s
mov edx, 4
mov rcx, r15
call qword [rax + reloc.WS2_32.dll_recv]
nop
jmp 0x1400cc0a4
mov rax, rsi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x1400cca20
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor edx, edx
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x1400cbc60]
mov dword [rsp + 0x20], edx
xor ecx, ecx
mov dword [rsp + 0x48], edx
call fcn.14014b7c4
test rax, rax
je 0x1400cca57
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret
Function at 0x1400cca60
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor edx, edx
lea rax, [rsp + 0x48]
mov r9, rcx
mov qword [rsp + 0x28], rax
lea r8, [0x1400cbc70]
mov dword [rsp + 0x20], edx
xor ecx, ecx
mov dword [rsp + 0x48], edx
call fcn.14014b7c4
test rax, rax
je 0x1400cca97
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x1400ccab0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov dword [rcx + 0x58], edx
lea rax, [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x28], rax
mov r9, rcx
mov dword [rsp + 0x48], edx
lea r8, [0x1400cbc80]
mov dword [rsp + 0x20], edx
xor ecx, ecx
call fcn.14014b7c4
test rax, rax
je 0x1400ccaea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret

Function at 0x1400ccbb0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x1400ccbc7
call fcn.1400ccb20
mov eax, 1
add rsp, 0x28
ret
mov r8, rcx
xor edx, edx
lea rcx, [0x1400ccaa0]
call fcn.14014b6f4
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400ce4f0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov rsi, rcx
xor edi, edi
mov dword [rax - 0x38], edi
mov dword [rax + 0x10], edi
mov dword [rax + 0x18], edi
lea rax, [rax + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rcx
lea r8, [0x1400d1dc0]
xor edx, edx
xor ecx, ecx
call fcn.14014b7c4
mov r14, rax
test rax, rax
je 0x1400ce542
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rsi
lea r8, [0x1400d1db0]
xor edx, edx
xor ecx, ecx
call fcn.14014b7c4
mov qword [rsi + 0x38], rax
mov ecx, 0x28
call fcn.1400dba80
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400ce58b
mov rcx, rax
call fcn.1400c41f0
jmp 0x1400ce58e
mov rax, rdi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400c41b0
nop
cmp qword [rsp + 0x38], 0
je 0x1400ce5fb
mov qword [rsp + 0x88], rdi
lea rcx, [rsp + 0x88]
call fcn.140043ef0
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.1400501d0
test al, al
je 0x1400ce5df
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x38]
call fcn.1400c5750
mov rdx, qword [rsi + 0x20]
mov rcx, qword [rsp + 0x38]
call fcn.1400c44d0
nop
lea rcx, [rsp + 0x88]
call fcn.140043ef0
test r14, r14
je 0x1400ce611
mov eax, 1
cmp qword [rsi + 0x38], 0
cmovne edi, eax
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x38]
call fcn.1400c4850
nop
mov eax, edi
jmp 0x1400ce624
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1400d1f20
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x1400d1f37
call fcn.1400d1e40
mov eax, 1
add rsp, 0x28
ret
mov r8, rcx
xor edx, edx
lea rcx, [0x1400d1dd0]
call fcn.14014b6f4
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400d39d0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov edi, edx
mov rbx, rcx
mov rax, qword [rcx]
mov r9d, edx
lea r8, str.ExecCombinationsRequest_with_flag__X
mov edx, 2
call qword [rax + reloc.WS2_32.dll_recv]
nop
cmp dword [rbx + 0xac], 0
jne 0x1400d3b67
cmp dword [rbx + 0xb0], 0
jne 0x1400d3b67
cmp dword [rbx + 0xa8], 0
je 0x1400d3a3a
or edx, 0xffffffff
mov rcx, qword [rbx + 0x338]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [rbx + 0xb4], 0
je 0x1400d3a53
or edx, 0xffffffff
mov rcx, qword [rbx + 0x340]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp edi, 0x1002
jne 0x1400d3ab7
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 0xb0]
cmp dword [rcx + 0xb67c], 0xffffffff
je 0x1400d3b69
mov edx, 1
xchg dword [rbx + 0xb4], edx
mov r8, rbx
xor edx, edx
lea rcx, [0x1400d9c00]
call fcn.14014b6f4
mov qword [rbx + 0x340], rax
test rax, rax
jne 0x1400d3aa6
xchg dword [rbx + 0xb4], eax
jmp 0x1400d3b69
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x1400d3b65
cmp edi, 0x1003
jne 0x1400d3b03
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax + 0xb0]
cmp dword [rcx + 0xb67c], 0xffffffff
je 0x1400d3b69
mov edx, 1
xor eax, eax
lock cmpxchg dword [rbx + 0xb8], edx
jne 0x1400d3af9
mov rcx, qword [rbx + 0x1f8]
test rcx, rcx
je 0x1400d3af9
call fcn.1400db750
mov rcx, rbx
call fcn.1400d4040
jmp 0x1400d3b65
cmp edi, 0x1004
jne 0x1400d3b23
lea edx, [rdi - 2]
mov rcx, rbx
call fcn.1400d39d0
lea edx, [rdi - 1]
mov rcx, rbx
call fcn.1400d39d0
jmp 0x1400d3b65
cmp edi, 0x1005
jne 0x1400d3b30
lea edx, [rdi - 3]
jmp 0x1400d3b50
cmp edi, 0x1006
je 0x1400d3b4b
cmp edi, 0x1007
jne 0x1400d3b65
lea edx, [rdi - 5]
mov rcx, rbx
call fcn.1400d39d0
mov edx, 0x1003
mov rcx, rbx
call fcn.1400d39d0
mov edx, 1
mov rcx, rbx
call fcn.1400d4bd0
jmp 0x1400d3b69
jmp 0x1400d3b69
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400d3b80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp edx, 3
jne 0x1400d3be4
cmp dword [rcx + 0xa8], 0
jne 0x1400d3be2
cmp dword [rcx + 0xac], 0
jne 0x1400d3be2
cmp dword [rcx + 0xb0], 0
jne 0x1400d3be2
cmp dword [rcx + 0xb4], 0
jne 0x1400d3be2
cmp dword [rcx + 0xb8], 0
jne 0x1400d3be2
mov eax, 1
xchg dword [rcx + 0xac], eax
mov r8, rcx
xor edx, edx
lea rcx, [0x1400d9c10]
call fcn.14014b6f4
jmp 0x1400d3c10
jmp 0x1400d3c10
cmp edx, 4
jne 0x1400d3c10
cmp dword [rcx + 0xac], 2
jge 0x1400d3c10
xor eax, eax
xchg dword [rcx + 0xac], eax
mov r10, qword [rcx]
lea r9, [rcx + 0x2c8]
lea r8, str.ExecInstallRequest_Abort__s
call qword [r10 + reloc.WS2_32.dll_recv]
nop
add rsp, 0x38
ret
Function at 0x1400d4a70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov edi, edx
mov rbx, rcx
lea eax, [rdx - 5]
cmp eax, 1
jbe 0x1400d4acc
cmp edx, 7
jne 0x1400d4b2d
cmp dword [rcx + 0xb0], 2
jge 0x1400d4b2d
xor eax, eax
xchg dword [rcx + 0xb0], eax
mov rax, qword [rcx]
lea r9, [rcx + 0x2c8]
lea r8, str.ExecUninstallRequest_Abort__s
lea edx, [rdi - 3]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1400d4b2d
cmp dword [rcx + 0xa8], 0
jne 0x1400d4b2f
cmp dword [rcx + 0xac], 0
jne 0x1400d4b2f
cmp dword [rcx + 0xb0], 0
jne 0x1400d4b2f
cmp dword [rcx + 0xb4], 0
jne 0x1400d4b2f
cmp dword [rcx + 0xb8], 0
jne 0x1400d4b2f
mov edx, 0x111
call fcn.1400d89c0
xor eax, eax
cmp edi, 6
sete al
mov dword [0x140312164], eax
mov eax, 1
xchg dword [rbx + 0xb0], eax
mov r8, rbx
xor edx, edx
lea rcx, [0x1400d9c20]
call fcn.14014b6f4
jmp 0x1400d4b31
jmp 0x1400d4b31
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400d4bd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
cmp edx, 1
jne 0x1400d4c61
cmp dword [rcx + 0xac], 0
jne 0x1400d4c5f
cmp dword [rcx + 0xb0], 0
jne 0x1400d4c5f
cmp dword [rcx + 0xb4], 0
je 0x1400d4c16
or edx, 0xffffffff
mov rcx, qword [rcx + 0x340]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [rbx + 0xa8], 0
je 0x1400d4c2f
or edx, 0xffffffff
mov rcx, qword [rbx + 0x338]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
xchg dword [rbx + 0xa8], eax
mov r8, rbx
xor edx, edx
lea rcx, [0x1400d9c40]
call fcn.14014b6f4
mov qword [rbx + 0x338], rax
test rax, rax
jne 0x1400d4c90
xchg dword [rbx + 0xa8], eax
jmp 0x1400d4c90
jmp 0x1400d4c90
cmp edx, 2
jne 0x1400d4c90
cmp dword [rcx + 0xa8], edx
jge 0x1400d4c90
xor eax, eax
xchg dword [rcx + 0xa8], eax
mov rax, qword [rcx]
lea r9, [rcx + 0x2c8]
lea r8, str.ExecUpdateRequest_Abort__s
mov edx, 4
call qword [rax + reloc.WS2_32.dll_recv]
nop
add rsp, 0x30
pop rbx
ret

Function at 0x1400d4ca0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov r8, rcx
xor edx, edx
lea rcx, [0x1400d9c30]
call fcn.14014b6f4
nop
add rsp, 0x38
ret
Function at 0x1400d9840
Capabilities:
Delete directory
Move file

Disassembly:
mov qword [rsp + 8], rcx
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov rax, qword [rcx]
lea r8, str.ReloadSharedRegAndRestartRecording_
mov edx, 4
call qword [rax + reloc.WS2_32.dll_recv]
cmp qword [rdi + 0x220], 0
je 0x1400d9897
mov rcx, qword [rdi + 0x228]
call qword [rdi + 0x220]
nop
jmp 0x1400d9897
mov rcx, qword [rdi + 0x1e8]
test rcx, rcx
je 0x1400d99d2
cmp dword [rdi + 0xbc], 0
je 0x1400d99c7
xor r14d, r14d
mov dword [rdi + 0xbc], r14d
mov esi, 1
mov rcx, qword [rdi + 0x208]
xor eax, eax
lock cmpxchg dword [rcx], esi
mov rcx, qword [rdi + 0x200]
or edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
mov rcx, qword [rdi + 0x1e8]
mov rax, qword [rcx]
mov edx, 0x23145623
call qword [rax + 0x30]
test ebx, ebx
jne 0x1400d9991
mov rax, qword [rdi + 0x20]
mov rcx, qword [rax + 0xb0]
add rcx, 0x1734
call fcn.1400faf30
test eax, eax
je 0x1400d9932
mov rax, qword [rdi + 0x20]
mov rcx, qword [rax + 0xb0]
add rcx, 0x1734
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea rbx, [rdi + 0xd7]
mov rax, qword [rdi + 0x20]
mov rdx, qword [rax + 0xb0]
add rdx, 0x1734
mov r8d, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1400d9991
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov r10, qword [rdi]
mov rax, qword [rdi + 0x20]
mov r9, qword [rax + 0xb0]
add r9, 0x247c
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
lea r8, str.Move_file_to_the_new_directory__s_from__s_failed_with__d.
xor edx, edx
mov rcx, rdi
call qword [r10 + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x1e8]
mov r8, qword [rcx]
mov edx, 0x23145623
call qword [r8 + 0x40]
mov rcx, qword [rdi + 0x1e8]
mov r8, qword [rcx]
mov edx, 0x23145623
call qword [r8 + 0x28]
mov rcx, qword [rdi + 0x208]
mov eax, esi
lock cmpxchg dword [rcx], r14d
jmp 0x1400d99d2
mov rax, qword [rcx]
mov edx, 0x23145623
call qword [rax + 0x40]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret