joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052eb0
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x2038
call fcn.1400fc8d0
sub rsp, rax
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rsp + 0x2020], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2000
call fcn.1400fe8d0
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.1400fe094
xor ecx, ecx
lea r8, str.debug
mov edx, 0x1000
mov word [rax], cx
lea rcx, [rsp + 0x20]
call fcn.14010fea4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0x20
jne 0x140052f46
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140052f45
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140052f1e
int3
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400fb890
add rsp, 0x2038
ret

Function at 0x1400551d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rdx
mov r9, rcx
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rdx + 1]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 2]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 3]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 4]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 5]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 6]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 7]
xor r8, rax
imul r8, rcx
and r8, qword [r9 + 0x30]
mov rdi, qword [r9 + 0x18]
mov r10, r8
shl r10, 4
add r10, rdi
mov rbx, qword [r10 + 8]
mov rdx, qword [r9 + 8]
cmp rbx, rdx
je 0x140055327
mov rcx, qword [r10]
mov rax, qword [r11]
cmp rax, qword [rbx + 0x10]
je 0x140055293
nop dword [rax + rax]
cmp rbx, rcx
je 0x140055327
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x140055280
test rbx, rbx
je 0x140055327
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r10 + 8], rbx
jne 0x1400552c2
cmp rax, rbx
jne 0x1400552b8
mov qword [rdi + r8*8], rdx
mov qword [r10 + 8], rdx
jmp 0x1400552ce
mov rdx, qword [rbx + 8]
mov qword [r10 + 8], rdx
jmp 0x1400552ce
cmp rax, rbx
jne 0x1400552ce
mov rax, qword [rbx]
mov qword [rdi + r8*8], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14005530a
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x14005530a
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14000cca5.0]
nop
mov edx, 0x28
mov rcx, rbx
call fcn.140074f80
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140055560
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x140055740
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rdi, qword [0x1401c3f18]
lea rdx, [rbx + rbx]
mov r8, rdi
lea rcx, [0x1401c3f28]
call fcn.140055420
lea r9, [rbx - 1]
mov qword [0x1401c3f40], r9
mov qword [0x1401c3f48], rbx
mov rcx, qword [0x1401c3f18]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rdi
je 0x140055730
movabs rsi, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r11d, byte [rcx + 0x10]
xor r11, rsi
imul r11, rbx
movzx eax, byte [rcx + 0x11]
xor r11, rax
imul r11, rbx
movzx eax, byte [rcx + 0x12]
xor r11, rax
imul r11, rbx
movzx eax, byte [rcx + 0x13]
xor r11, rax
imul r11, rbx
movzx eax, byte [rcx + 0x14]
xor r11, rax
imul r11, rbx
movzx eax, byte [rcx + 0x15]
xor r11, rax
imul r11, rbx
movzx eax, byte [rcx + 0x16]
xor r11, rax
imul r11, rbx
movzx eax, byte [rcx + 0x17]
xor r11, rax
imul r11, rbx
and r11, r9
shl r11, 4
add r11, qword [0x1401c3f28]
mov r10, qword [r11]
cmp r10, rdi
jne 0x14005567b
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400556f6
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1400556b8
mov r10, qword [rax]
cmp r10, rcx
je 0x1400556b2
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400556f6
mov r8, rax
cmp r10, rax
je 0x1400556d2
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x14005570a
cmp r10, rax
jne 0x1400556c0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rdi
je 0x140055730
mov r9, qword [0x1401c3f40]
jmp 0x140055600
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400556f6
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1400d4244
int3
Function at 0x140057640
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov dword [rsp + 0x70], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x140057670
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov word [rsp + 0x68], si
mov word [rsp + 0x60], si
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_IsWow64Process2]
test eax, eax
jne 0x14005769d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, qword gs:[0x30]
mov edi, 0x7ffe0030
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x90]
lea rcx, [rax + 0x1e]
test rax, rax
jne 0x1400576c1
mov ecx, edi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2000000
mov edx, 0x100080
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rbp, [0x1401b5890]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140057723
xor r9d, r9d
mov r8d, 0x100
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
test eax, eax
jne 0x14005779e
test rbx, rbx
je 0x140057723
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x90]
test rax, rax
jne 0x1400577d4
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], si
jne 0x140057747
mov rax, qword [str.__]
lea rcx, [0x1401b5898]
add rbx, rbx
mov qword [0x1401b5890], rax
mov r8, rbx
mov rdx, rdi
call fcn.1400fe220
lea rax, [rbp + 8]
add rax, rbx
mov word [rax], si
sub rax, rbp
sar rax, 1
mov qword [0x1401b5a98], rax
mov qword [0x1401b5a90], rbp
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp eax, 0x100
jae 0x140057715
mov eax, eax
mov qword [0x1401b5a98], rax
mov qword [0x1401b5a90], rbp
test rbx, rbx
je 0x140057791
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea rdi, [rax + 0x1e]
jmp 0x140057740
Function at 0x14005d4b4
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r14, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
mov ebp, ebx
mov r15d, ebx
mov dword [rax + 8], ebx
lea rdx, [rax - 0x48]
call fcn.14005d69c
nop
cmp byte [rsp + 0xd0], bl
je 0x14005d512
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
sub rdi, rbx
mov rbp, qword [rsi + 0x20]
mov r15d, dword [r14]
mov eax, dword [rsi + 0x78]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov dword [rsp + 0x58], eax
lea rax, vtable.McCryptoLib::CWinError.0
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0xb0]
mov qword [r14], rax
lea rcx, [rsp + 0x50]
mov rax, qword [0x14016fa58]
call qword [case.0x14000cca5.0]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.14005dc14
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14005d5a8
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r14, r9
mov r12, r8
mov r13, rdx
mov rsi, rcx
xor ebx, ebx
mov edi, ebx
mov ebp, ebx
mov r15d, ebx
mov dword [rax + 8], ebx
lea rdx, [rax - 0x48]
call fcn.14005d69c
nop
cmp byte [rsp + 0xd0], bl
je 0x14005d606
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
sub rdi, rbx
mov rbp, qword [rsi + 0x20]
mov r15d, dword [r14]
mov eax, dword [rsi + 0x78]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov dword [rsp + 0x58], eax
lea rax, vtable.McCryptoLib::CWinError.0
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0xb0]
mov qword [r14], rax
lea rcx, [rsp + 0x50]
mov rax, qword [0x14016fa58]
call qword [case.0x14000cca5.0]
mov ebx, eax
lea rcx, [rsp + 0x60]
call fcn.14005dc14
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006ff90
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rbp, rcx
xor r14d, r14d
lea ecx, [r14 + 8]
cmp qword [rbp], r14
jbe 0x1400700fe
xor r15d, r15d
xor r12d, r12d
lea rdi, [0x1401c10d8]
nop dword [rax]
mov rax, qword [rbp + 0x10]
mov rsi, qword [rbp + r14*8 + 0x2a0]
test rsi, rsi
jne 0x14006ffe8
lea rsi, [rbp + 0x70]
add rsi, r12
mov r13, qword [r15 + rax + 8]
mov rax, qword [r15 + rax]
mov qword [rsp + 0x90], rax
mov rax, qword [rsi + 8]
cmp rax, qword [rsi + 0x10]
je 0x140070007
mov qword [rsi + 0x20], rax
mov rbx, qword [rsi + 0x28]
test rbx, rbx
je 0x14007007a
mov rdi, rbx
cmp rbx, 8
cmova rdi, rcx
xor r9d, r9d
mov r8d, edi
lea rdx, [0x140186200]
mov rcx, qword [rsi]
call sub.bcrypt.dll_BCryptHashData
test eax, eax
jns 0x14007004b
mov dword [rsp + 0x20], eax
lea rax, [0x1401c10d8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
jmp 0x140070064
mov dword [rsp + 0x30], 0
mov rax, qword [0x1401c1068]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x30]
cmp dword [rcx], 0
jne 0x1400700c2
sub rbx, rdi
mov ecx, 8
jne 0x140070010
lea rdi, [0x1401c10d8]
xor r9d, r9d
mov r8d, r13d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsi]
call sub.bcrypt.dll_BCryptFinishHash
test eax, eax
jns 0x1400700a4
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x40]
jmp 0x1400700bd
mov dword [rsp + 0x50], 0
mov rax, qword [0x1401c1068]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
cmp dword [rcx], 0
je 0x1400700dd
movups xmm0, xmmword [rcx]
movd eax, xmm0
test eax, eax
je 0x1400700dd
mov rax, qword [rbp + 0x18]
cmp dword [rax + r15], 0
jne 0x1400700dd
movups xmmword [rax + r15], xmm0
inc r14
add r12, 0x30
add r15, 0x10
cmp r14, qword [rbp]
lea rdi, [0x1401c10d8]
mov ecx, 8
jb 0x14006ffd0
mov rcx, qword [rbp + 0x300]
test rcx, rcx
je 0x140070118
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbp + 0x2f0]
test rcx, rcx
je 0x14007012a
call fcn.1400fbdd4
nop
lea rcx, [rbp + 0x70]
lea r9, [0x14006f900]
mov edx, 0x30
lea r8d, [rdx - 0x26]
call fcn.1400fc0b8
nop
lea r9, [0x14006f970]
mov edx, 8
lea r8d, [rdx + 2]
lea rcx, [rbp + 0x20]
call fcn.1400fc0b8
nop
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140070210
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x43a0
call fcn.1400fc8d0
sub rsp, rax
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rsp + 0x4390], rax
mov r10, r9
mov rbx, rcx
mov r9, qword [rsp + 0x43f8]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x88], 1
mov qword [rsp + 0x90], r10
mov rax, qword [rsp + 0x43f0]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], r9
mov r8, r10
lea rcx, [rsp + 0xa8]
call fcn.14006f980
xor r13d, r13d
mov qword [rsp + 0x378], r13
mov qword [rsp + 0x380], r13
mov qword [rsp + 0x388], r13
movaps xmm0, xmmword [rbx]
movdqa xmmword [rsp + 0x30], xmm0
mov esi, r13d
cmp qword [rsp + 0x88], r13
jbe 0x140070432
mov r14d, r13d
lea r15, [rsp + 0xf8]
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
nop dword [rax + rax]
mov rax, qword [rsp + rsi*8 + 0x328]
mov rbx, r15
test rax, rax
cmovne rbx, rax
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 8], rcx
jne 0x140070356
xor r9d, r9d
mov r8d, edi
mov rdx, r12
mov rcx, qword [rbx]
call sub.bcrypt.dll_BCryptHashData
test eax, eax
jns 0x140070333
mov dword [rsp + 0x58], eax
lea rax, [0x1401c10d8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
jmp 0x14007040c
mov dword [rsp + 0x68], r13d
mov rax, qword [0x1401c1068]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x68]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
jmp 0x14007040c
mov rax, qword [rbx + 0x20]
cmp rax, rcx
je 0x1400703f6
mov rcx, qword [rax]
cmp rdi, rcx
jbe 0x1400703f6
mov rdx, rcx
test rcx, rcx
cmove rdx, r13
mov rax, qword [rax + 8]
sub rax, rcx
mov rcx, rdi
sub rcx, rdx
cmp rax, rcx
cmovb ecx, eax
add rdx, r12
xor r9d, r9d
mov r8d, ecx
mov rcx, qword [rbx]
call sub.bcrypt.dll_BCryptHashData
test eax, eax
jns 0x1400703bb
mov dword [rsp + 0x78], eax
lea rax, [0x1401c10d8]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x78]
jmp 0x1400703d1
mov dword [rsp + 0x48], r13d
mov rax, qword [0x1401c1068]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
cmp dword [rcx], r13d
jne 0x14007046d
mov rax, qword [rbx + 0x20]
cmp rdi, qword [rax + 8]
jb 0x1400703f6
add rax, 0x10
mov qword [rbx + 0x20], rax
cmp rax, qword [rbx + 0x10]
jne 0x140070363
mov dword [rsp + 0x30], r13d
mov rax, qword [0x1401c1068]
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
mov rax, qword [rsp + 0xa0]
movups xmmword [r14 + rax], xmm0
inc rsi
add r15, 0x30
add r14, 0x10
cmp rsi, qword [rsp + 0x88]
jb 0x1400702e0
lea rcx, [rsp + 0x88]
call fcn.14006ff90
nop
mov rcx, qword [rsp + 0x4390]
xor rcx, rsp
call fcn.1400fb890
lea r11, [rsp + 0x43a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm0
jmp 0x14007040c
Function at 0x14007d130
Capabilities:
Create directory
Get common file path

Disassembly:
push r14
sub rsp, 0x250
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp byte [rcx], 0
mov r14, rcx
jne 0x14007d36d
mov r9d, 1
mov byte [rcx], 1
mov qword [rsp + 0x248], rsi
lea rsi, [rcx + 0x218]
mov rdx, rsi
xor ecx, ecx
lea r8d, [r9 + 0x22]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14007d365
mov qword [rsp + 0x268], rbx
mov rax, rsi
mov ebx, 0x104
mov qword [rsp + 0x270], rbp
mov ecx, ebx
mov qword [rsp + 0x240], rdi
cmp word [rax], 0
je 0x14007d1b8
add rax, 2
sub rcx, 1
jne 0x14007d1a8
xor ebp, ebp
mov rax, rbx
sub rax, rcx
mov edi, 0x7ffffffe
test rcx, rcx
cmove rax, rbp
je 0x14007d215
mov rdx, rbx
lea rcx, [rsi + rax*2]
sub rdx, rax
je 0x14007d207
lea r9, str.McAfee_
mov eax, edi
sub r9, rcx
test rax, rax
je 0x14007d207
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x14007d207
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x14007d1e6
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bp
mov dl, 1
mov rcx, rsi
call fcn.140085ec0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14007d23f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14007d2e1
lea r8, [r14 + 0x10]
mov rdx, rbx
mov rcx, rsi
call fcn.14007d070
mov dl, 1
mov rcx, rsi
call fcn.140085ec0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14007d274
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14007d2e1
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400fe8d0
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x20]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14007d2e6
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdx, rbx
mov rcx, rsi
mov r8, rax
call fcn.14007d070
mov dl, 1
mov rcx, rsi
call fcn.140085ec0
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14007d2e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14007d2e6
mov word [rsi], bp
jmp 0x14007d34d
mov rcx, rbx
mov rax, rsi
nop dword [rax]
cmp word [rax], bp
je 0x14007d2ff
add rax, 2
sub rcx, 1
jne 0x14007d2f0
mov rax, rbx
sub rax, rcx
test rcx, rcx
cmove rax, rbp
je 0x14007d34d
lea rcx, [rsi + rax*2]
sub rbx, rax
je 0x14007d33f
lea rdx, str.log.txt
sub rdx, rcx
test rdi, rdi
je 0x14007d33f
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14007d33f
mov word [rcx], ax
dec rdi
add rcx, 2
sub rbx, 1
jne 0x14007d321
test rbx, rbx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bp
mov rbx, qword [rsp + 0x268]
mov rbp, qword [rsp + 0x270]
mov rdi, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x248]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400fb890
add rsp, 0x250
pop r14
ret
Function at 0x14007dea0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rcx
mov qword [rsp + 0x40], rcx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14007e023
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14007e023
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007e023
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14007e023
cmp word [rax + 4], 0
jne 0x14007e023
cmp dword [rax + 0x28], 0xfeef04bd
jne 0x14007e023
movzx ebp, word [rax + 0x32]
movzx esi, word [rax + 0x30]
movzx edi, word [rax + 0x36]
movzx ebx, word [rax + 0x34]
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x50]
call fcn.1400fe8d0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
mov r9d, ebp
lea r8, str._d._d._d._d
mov edx, 0x100
lea rcx, [rsp + 0x50]
call fcn.14007ee20
test eax, eax
jns 0x14007dff0
lea rax, str.Failed_to_format_version
mov qword [rsp + 0x20], rax
mov r9d, 0xb0
lea r8, str.XMLUpdater::v2::CSubstitutionManager::GetOsVersion
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterSubstitutionManager.cpp
mov ecx, 1
call fcn.14007d3e0
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], ax
mov rdx, qword [0x1401b04c0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14007dfe0
jmp 0x14007e07b
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], ax
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14007e011
lea rdx, [rsp + 0x50]
jmp 0x14007e07b
lea rax, str.Failed_to_retrieve_kernel_verison
mov qword [rsp + 0x20], rax
mov r9d, 0xa9
lea r8, str.XMLUpdater::v2::CSubstitutionManager::GetOsVersion
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterSubstitutionManager.cpp
mov ecx, 1
call fcn.14007d3e0
xor eax, eax
mov qword [r14], rax
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 7
mov word [r14], ax
mov rdx, qword [0x1401b04c0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14007e070
mov rcx, r14
call fcn.140002fb0
mov rax, r14
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400fb890
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400851f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x98
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0xd8]
mov rcx, r9
mov qword [rsp + 0x80], rdx
mov rbx, r9
lea rdx, [0x14017013c]
call fcn.140002f90
lea rdx, [0x14017013c]
mov rcx, rdi
call fcn.140002f90
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400852fc
test al, 0x10
je 0x1400852fc
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
nop dword [rax]
test ebx, ebx
lea rcx, [rsp + 0x30]
setne dl
call fcn.1400844b0
test al, al
jne 0x140085328
inc ebx
cmp ebx, 2
jl 0x1400852e0
jmp 0x140085326
lea rax, str.Destination_directory_does_not_exist
mov r9d, SetErrorInfo
lea r8, str.XMLUpdater::v2::NHttp::NDownloadFile::StoreOnDisk
mov qword [rsp + 0x20], rax
lea rdx, str.E:BT5141214d_e130_48fa_889d_d54b39cac869xmlupdater_srcXmlUpdaterHttpsDownloadFile.cpp
mov ecx, 1
call fcn.14007d3e0
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400fb890
add rsp, 0x98
pop rdi
pop rbx
ret
Function at 0x140085e00
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x1401b4a98]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140085ea2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140085ea2
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400fe8d0
mov r8, rbx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.14010c3b4
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.1400fe094
test rax, rax
je 0x140085e74
xor ecx, ecx
mov word [rax], cx
lea rcx, [rsp + 0x20]
call fcn.140085e00
test al, al
jne 0x140085e86
xor al, al
jmp 0x140085ea4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140085ea2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140085e82
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400fb890
add rsp, 0x240
pop rbx
ret