joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400079c4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, rdx
call fcn.14000144c
xor r14d, r14d
test rax, rax
je 0x140007bc3
mov r8, qword [rax]
mov rcx, rax
call qword [r8 + 0x18]
lea ebp, [r14 + 1]
mov ecx, ebp
lea rbx, [rax + 0x18]
mov eax, dword [rbx - 0xc]
sub ecx, dword [rbx - 8]
sub eax, 0x104
or ecx, eax
mov qword [rsp + 0x60], rbx
jge 0x140007a26
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.140001a54
mov rbx, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x23]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x140007a54
lea rcx, [rsp + 0x50]
lea rdx, [0x14004b718]
call fcn.1400055c0
jmp 0x140007a77
lea rdx, str.GoogleUpdateLog
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
test eax, eax
je 0x140007a46
lea rdx, [rsp + 0x60]
call fcn.14000564c
test rbx, rbx
jne 0x140007a81
mov eax, r14d
jmp 0x140007a95
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140031b90
test eax, eax
js 0x140007bb8
cmp eax, dword [rbx - 0xc]
jg 0x140007bb8
mov dword [rbx - 0x10], eax
lea rdx, [rbx - 0x18]
cdqe
mov word [rbx + rax*2], r14w
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, ebp
jg 0x140007ac1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
cmp dword [rbx - 0x10], r14d
jne 0x140007afd
call fcn.14000144c
test rax, rax
je 0x140007bc3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rdx, [rbx - 0x18]
mov qword [rsi], rax
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, ebp
jmp 0x140007b8d
mov eax, dword [rbx - 0xc]
sub ebp, dword [rbx - 8]
sub eax, 0x104
or ebp, eax
jge 0x140007b20
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140001a54
mov rbx, qword [rsp + 0x50]
lea rdx, str.GoogleUpdate.log
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
sete bpl
test rbx, rbx
jne 0x140007b40
mov eax, r14d
jmp 0x140007b50
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140031b90
test eax, eax
js 0x140007bb8
cmp eax, dword [rbx - 0xc]
jg 0x140007bb8
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
test bpl, bpl
je 0x140007ba9
call fcn.14000144c
test rax, rax
je 0x140007bc3
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsi], rax
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007b98
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14000564c
jmp 0x140007b7e
mov ecx, 0x80070057
call fcn.1400017a4
int3
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x140007bd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x138], 0
mov rbp, rcx
jne 0x140007c20
mov ecx, 0x40
call fcn.140039484
mov rcx, rax
call fcn.14000c7dc
mov qword [rbp + 0x138], rax
test rax, rax
jne 0x140007c20
mov rdx, qword [rbp + 0x58]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_ETW_log_writer
call fcn.14000c5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x140007c46
movsxd rax, dword [rbp + 0xa8]
cmp eax, 0xf
jge 0x140007c46
mov qword [rbp + rax*8 + 0xb0], rcx
inc dword [rbp + 0xa8]
cmp byte [rbp + 0x93], 0
je 0x140007d99
cmp qword [rbp + 0x128], 0
jne 0x140007d73
lea rdx, [rsp + 0x40]
call fcn.1400079c4
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], 0
jne 0x140007c9c
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140007d99
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140007d99
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14000c0dc
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call fcn.1400065a4
test al, al
jne 0x140007cf0
mov rcx, rdi
call fcn.140004880
test eax, eax
jns 0x140007cf0
or ebx, 0xffffffff
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140007ce5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
jmp 0x140007c7d
mov sil, byte [rbp + 0x95]
mov ecx, 0x38
call fcn.140039484
mov r8b, sil
mov rdx, rbx
mov rcx, rax
call fcn.14000877c
mov qword [rbp + 0x128], rax
test rax, rax
jne 0x140007d37
mov rdx, qword [rbp + 0x58]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Cannot_create_log_writer_to__s
mov r8, rbx
call fcn.14000c5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
or ebx, 0xffffffff
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140007d54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140007d73
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x140007d99
movsxd rax, dword [rbp + 0xa8]
cmp eax, 0xf
jge 0x140007d99
mov qword [rbp + rax*8 + 0xb0], rcx
inc dword [rbp + 0xa8]
cmp byte [rbp + 0x94], 0
je 0x140007deb
mov rcx, qword [rbp + 0x130]
test rcx, rcx
jne 0x140007dd1
mov ecx, 8
call fcn.140039484
mov rcx, rax
lea rax, fcn.140002460
mov qword [rcx], rax
mov qword [rbp + 0x130], rcx
test rcx, rcx
je 0x140007deb
movsxd rax, dword [rbp + 0xa8]
cmp eax, 0xf
jge 0x140007deb
mov qword [rbp + rax*8 + 0xb0], rcx
inc dword [rbp + 0xa8]
cmp dword [rbp + 0xa8], 0
mov rbx, qword [rsp + 0x50]
setg al
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007e04
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp byte [rcx + 0x96], 1
jne 0x140007e4a
lea rcx, [rsp + 0x48]
call fcn.1400073c4
mov rdx, qword [rax]
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Calling_the_logging_system_after_it_has_been_shut_down__n
call fcn.14000c5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x48]
call fcn.1400018b0
xor al, al
jmp 0x140007e9b
cmp byte [rcx + 0x50], 1
jne 0x140007e54
mov al, 1
jmp 0x140007e9b
cmp byte [rcx + 0x51], 0
je 0x140007e5e
xor al, al
jmp 0x140007e9b
mov byte [rcx + 0x51], 1
call fcn.140007774
cmp byte [rbx + 0x90], 0
je 0x140007e7b
mov rcx, rbx
call fcn.140007bd0
mov byte [rbx + 0x50], al
mov byte [rbx + 0x51], 0
mov al, 1
jmp 0x140007e9b
add rsp, 0x30
pop rbx
ret

Function at 0x140007ea4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov al, 1
mov rbx, rcx
cmp byte [rcx + 0x96], al
jne 0x140007f00
lea rcx, [rsp + 0x30]
call fcn.1400073c4
lea rcx, str.LOG_SYSTEM:___s_:_ERROR___Calling_the_logging_system_after_it_has_been_shut_down__n
mov rdx, qword [rax]
call fcn.14000c5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140007efc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor al, al
jmp 0x140007f27
cmp byte [rcx + 0x50], al
je 0x140007f27
lea rdi, [rcx + 0x60]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov rcx, rbx
call fcn.140007e04
mov rdx, qword [rdi]
mov rcx, rdi
mov bl, al
call qword [rdx + 0x10]
mov al, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000839c
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rsi, qword [rsp + 0xa0]
mov ebp, r9d
mov r12d, r8d
mov r14d, edx
mov r13, rcx
test rsi, rsi
je 0x140008500
test edx, edx
jne 0x1400083e3
cmp r9d, 2
jg 0x140008500
call fcn.14000144c
test rax, rax
je 0x14000851e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.14000144c
test rax, rax
je 0x14000851e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
mov edi, 1
lea r15, [r13 + 0x60]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xa0], rbx
xor edx, edx
mov rcx, r15
call fcn.14000a6b8
test al, al
jne 0x140008451
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x14
jle 0x14000842f
jmp 0x14000849c
mov rax, qword [rsp + 0xa8]
mov r9d, ebp
mov qword [rsp + 0x38], rax
mov r8d, r12d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov edx, r14d
lea rax, [rsp + 0x40]
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.140008114
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
mov rbx, qword [rsp + 0xa0]
cmp edi, 0x14
jle 0x1400084c4
lea rcx, str.LOG_SYSTEM:_Couldnt_acquire_lock__
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x14004edb8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400084e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rsp + 0x40]
mov eax, ebx
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140008500
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x14000877c
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and word [rcx + 0xc], 0
lea rax, fcn.140008978
mov ebp, 1
mov qword [rcx], rax
mov byte [rcx + 0xf], bpl
mov rbx, rdx
mov rdi, rcx
mov dword [rcx + 8], 0x989680
mov byte [rcx + 0xe], r8b
call fcn.14000144c
test rax, rax
je 0x1400088c8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rcx, [rdi + 0x20]
mov rdx, rbx
add rax, 0x18
mov qword [rdi + 0x10], rax
and qword [rdi + 0x18], 0
call fcn.1400055c0
and qword [rdi + 0x28], 0
call fcn.14000144c
test rax, rax
je 0x1400088c8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
lea rcx, [0x140059d40]
mov qword [rdi + 0x30], rax
mov al, byte [0x140059d39]
neg al
sbb rsi, rsi
and rsi, rcx
je 0x1400088b2
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140008700
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 0x10], 0
je 0x140008880
mov r9, rbx
lea rdx, str.MaxLogFileSize
mov r8d, 0x989680
lea rcx, str.LoggingSettings
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r9, rbx
lea rdx, str.LogFileWide
lea rcx, str.LoggingSettings
mov dword [rdi + 8], eax
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
setne bpl
jmp 0x140008887
mov dword [rdi + 8], 0x989680
lea rdx, [rsi + 0x58]
mov byte [rdi + 0xf], bpl
lea rcx, [rdi + 0x30]
call fcn.1400017c8
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400088b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x1400089b0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, rcx
lea r8, [rcx + 0x20]
lea rcx, [rbp + 0x50]
lea rdx, str._Google_Update_logging_mutex_
call fcn.1400094c0
or r12d, 0xffffffff
mov r14, rax
xor edi, edi
mov r9, qword [rax]
mov rdx, r9
movzx r8d, word [r9]
jmp 0x1400089fd
cmp r8w, 0x5c
je 0x140008a1c
add rdx, 2
movzx r8d, word [rdx]
test r8w, r8w
jne 0x1400089ee
mov edx, r12d
cmp edx, r12d
jne 0x140008a24
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.14000564c
jmp 0x140008ab0
sub rdx, r9
sar rdx, 1
jmp 0x140008a06
call fcn.14000144c
mov rcx, rax
test rax, rax
je 0x140008bc7
mov rax, qword [rax]
call qword [rax + 0x18]
mov esi, edi
lea rbx, [rax + 0x18]
mov rax, qword [r14]
mov qword [rbp + 0x40], rbx
cmp dword [rax - 0x10], edi
jle 0x140008a87
mov rbx, rdi
test rbx, rbx
js 0x140008bbc
cmp esi, dword [rax - 0x10]
jg 0x140008bbc
movzx edx, word [rbx + rax]
cmp dx, 0x5c
je 0x140008a78
lea rcx, [rbp + 0x40]
call fcn.14000574c
mov rax, qword [r14]
inc esi
add rbx, 2
cmp esi, dword [rax - 0x10]
jl 0x140008a50
mov rbx, qword [rbp + 0x40]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.14000564c
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140008ab0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rbp + 0x48]
lea rcx, [r15 + 0x10]
call fcn.1400017c8
mov rdx, qword [rbp + 0x48]
mov eax, r12d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140008add
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rdx, qword [rbp + 0x50]
mov eax, r12d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r12d
test eax, eax
jg 0x140008afd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rsi, [0x14004e3d8]
mov qword [rbp - 0x38], rdi
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rsi
call fcn.140004218
mov rdx, qword [rbp - 0x38]
mov rax, rdi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rax
test rdx, rdx
je 0x140008b36
lea rcx, [rbp - 0x18]
call fcn.14000394c
mov rax, qword [rbp - 0x10]
mov rbx, qword [r15 + 0x10]
mov dword [rbp - 0x30], 0x18
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], edi
call fcn.14000a4a8
mov rax, qword [0x140059a60]
lea rcx, [rbp - 0x30]
test rax, rax
je 0x140008b6d
mov r9d, 0x100001
xor r8d, r8d
mov rdx, rbx
call rax
jmp 0x140008b78
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [r15 + 0x18], rax
test rax, rax
je 0x140008b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete dil
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x18], rsi
call fcn.140003874
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rsi
call fcn.140003874
mov al, dil
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400017a4
int3
mov ecx, 0x80004005
call fcn.1400017a4
int3
Function at 0x140008e70
Capabilities:
Move file
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.LOG_SYSTEM:_trying_to_move_log_file_to_backup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdi, [rsi + 0x20]
mov rdx, rdi
lea r8, str..bak
lea rcx, [rsp + 0x30]
call fcn.14000639c
mov rbx, qword [rsp + 0x30]
mov r8d, 0xb
mov rcx, qword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140008ec9
call fcn.14000c44c
jmp 0x140008ecb
xor eax, eax
test eax, eax
jns 0x140008ef8
lea rcx, str.LOG_SYSTEM:_failed_to_move_log_file_to_backup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rsi
call fcn.140008f2c
test al, al
jne 0x140008ef3
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.1400066ac
xor dil, dil
jmp 0x140008efb
mov dil, 1
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140008f16
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rbx, qword [rsp + 0x38]
mov al, dil
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140008f2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp + 0x27], rax
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetControlSession_Manager]
lea rdx, [rbp - 0x49]
movaps xmm1, xmmword [0x14004f0f0]
mov rdi, rcx
movzx eax, word [0x14004f140]
xor r12d, r12d
movaps xmmword [rbp - 0x49], xmm0
mov r9d, 0x20019
movaps xmm0, xmmword [0x14004f100]
xor r8d, r8d
movaps xmmword [rbp - 0x39], xmm1
mov rcx, 0xffffffff80000002
movaps xmm1, xmmword [0x14004f110]
movaps xmmword [rbp - 0x29], xmm0
movaps xmm0, xmmword [0x14004f120]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [0x14004f130]
mov word [rbp + 0x17], ax
lea rax, [rbp - 0x61]
movaps xmmword [rbp - 9], xmm0
movaps xmmword [rbp + 7], xmm1
mov qword [rbp - 0x61], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009119
mov rcx, qword [rbp - 0x61]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x65]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, str.PendingFileRenameOperations
mov dword [rbp - 0x69], r12d
mov dword [rbp - 0x65], 7
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009119
cmp dword [rbp - 0x65], 7
jne 0x140009119
mov ecx, dword [rbp - 0x69]
call fcn.1400394e0
mov r8d, dword [rbp - 0x69]
xor edx, edx
mov rcx, rax
mov qword [rbp - 0x59], rax
mov rbx, rax
call fcn.140021eb0
mov rcx, qword [rbp - 0x61]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
lea rdx, str.PendingFileRenameOperations
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009104
mov esi, dword [rbp - 0x69]
shr rsi, 1
lea rax, [rsi - 2]
cmp rax, 0xffffd
ja 0x140009104
cmp word [rbx + rsi*2 - 4], r12w
jne 0x140009104
cmp word [rbx + rsi*2 - 2], r12w
jne 0x140009104
lea r8, [rdi + 0x20]
lea rdx, str.___
lea rcx, [rbp - 0x51]
call fcn.1400094c0
mov rdi, qword [rbp - 0x51]
mov r14d, r12d
test rsi, rsi
je 0x1400090d8
lea r15, [rbx + r14*2]
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400090dc
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
inc rcx
add r14, rcx
cmp r14, rsi
jb 0x1400090ad
or r14d, 0xffffffff
cmp r14d, 0xffffffff
lea rdx, [rdi - 0x18]
setne sil
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400090fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x59]
jmp 0x140009107
mov sil, r12b
test rbx, rbx
je 0x140009114
mov rcx, rbx
call fcn.14002154c
mov al, sil
jmp 0x14000911b
xor al, al
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400212a0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140009444
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x14000945a
xor al, al
jmp 0x140009491
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x14000948f
mov r8, qword [rbx + 0x10]
lea rcx, str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
mov rdx, qword [rbx + 0x30]
call fcn.14000c5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [rbx + 0xd], 0
jmp 0x140009456
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140009bd4
Capabilities:
Check os version

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x78]
sub rsp, 0x170
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor ebx, ebx
lea rcx, [rsp + 0x44]
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x118
mov dword [rsp + 0x40], 0x11c
call fcn.140021eb0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140009cb8
mov esi, dword [rsp + 0x44]
lea eax, [rsi - 6]
test eax, 0xfffffffb
je 0x140009cf8
cmp esi, 5
jne 0x140009cb8
cmp dword [rsp + 0x48], 2
jne 0x140009cdf
cmp byte [rbp + 0x5a], 1
jne 0x140009c7d
lea rcx, [rsp + 0x38]
call fcn.140009a98
lea rdx, [0x14004f1e0]
lea ebx, [rsi - 4]
mov rcx, qword [rax]
call fcn.140035078
test eax, eax
jne 0x140009c7d
mov sil, bl
jmp 0x140009c80
xor sil, sil
test bl, 1
je 0x140009ca4
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140009ca4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test sil, sil
jne 0x140009cf1
mov eax, 0x8000
test word [rbp + 0x58], ax
je 0x140009db7
xor eax, eax
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1400212a0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
cmp dword [rsp + 0x48], 1
jne 0x140009cb8
mov eax, 0x200
test word [rbp + 0x58], ax
jne 0x140009cb8
mov eax, 1
jmp 0x140009cba
and dword [rsp + 0x30], ebx
lea rcx, str.kernel32.dll
mov r14d, dword [rsp + 0x48]
call fcn.140005300
mov rbx, rax
test rax, rax
je 0x140009cb8
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140009d4e
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov ecx, esi
mov edx, r14d
call rax
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140009d59
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
test esi, esi
je 0x140009cb8
mov edx, dword [rsp + 0x30]
cmp edx, 0x1b
ja 0x140009dc1
je 0x140009e0b
cmp edx, 0xf
ja 0x140009d9a
cmp edx, 0xc
jae 0x140009db7
cmp edx, 1
je 0x140009cf1
lea eax, [rdx - 4]
test eax, 0xfffffffd
je 0x140009e0b
lea eax, [rdx - 7]
cmp eax, 3
jbe 0x140009db7
jmp 0x140009cb8
cmp edx, 0x10
je 0x140009e0b
lea ecx, [rdx - 0x11]
test ecx, 0xfffffff6
jne 0x140009cb8
cmp edx, 0x1a
je 0x140009cb8
mov eax, 2
jmp 0x140009cba
cmp edx, 0x54
ja 0x140009de0
je 0x140009e0b
cmp edx, 0x30
je 0x140009cf1
lea eax, [rdx - 0x46]
test eax, 0xfffffffd
je 0x140009e0b
jmp 0x140009cb8
cmp edx, 0x79
jb 0x140009cb8
cmp edx, 0x7a
jbe 0x140009e15
cmp edx, 0x7c
jbe 0x140009cb8
cmp edx, 0x7e
jbe 0x140009e0b
lea eax, [rdx - 0x81]
cmp eax, 1
ja 0x140009cb8
mov eax, 3
jmp 0x140009cba
mov eax, 4
jmp 0x140009cba
Function at 0x14000a6b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 8]
mov esi, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
jne 0x14000a707
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
jne 0x14000a707
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, esi
jb 0x14000a6e2
xor al, al
jmp 0x14000a709
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret