joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005ec0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov qword [rsp + 0x258], 0xfffffffffffffffe
mov rax, qword [0x1400472d0]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x174], 0
mov rax, qword [rsp + 0x288]
cmp qword [rax + 0x20], 0x10
jb 0x140005f28
mov rax, qword [rsp + 0x288]
mov rax, qword [rax + 8]
mov qword [rsp + 0x260], rax
jmp 0x140005f3c
mov rax, qword [rsp + 0x288]
add rax, 8
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400060bf
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x174]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [rsp + 0x170], eax
cmp dword [rsp + 0x170], 0
jne 0x140006095
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x178]
call fcn.1400099b0
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x288]
lea rcx, [rsp + 0x178]
call fcn.1400091c0
nop
lea rcx, [0x14003a89c]
call fcn.140018050
mov qword [rsp + 0x1c8], rax
mov r8, qword [rsp + 0x1c8]
lea rdx, [0x14003a89c]
lea rcx, [rsp + 0x178]
call fcn.140008f60
lea rcx, [rsp + 0x60]
call fcn.140018050
mov qword [rsp + 0x200], rax
mov r8, qword [rsp + 0x200]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x178]
call fcn.140008f60
lea rdx, [rsp + 0x178]
mov rcx, qword [rsp + 0x280]
call fcn.140005ec0
lea rdx, [rsp + 0x178]
mov rcx, qword [rsp + 0x280]
call fcn.140005c10
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x178]
call fcn.1400099b0
mov eax, dword [rsp + 0x174]
add eax, 1
mov dword [rsp + 0x174], eax
cmp dword [rsp + 0x170], 0
je 0x140005f6d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.1400189a0
add rsp, 0x278
ret
Function at 0x140006420
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x20], 0x10
jb 0x14000645d
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 8]
mov qword [rsp + 0xd8], rax
jmp 0x140006471
mov rax, qword [rsp + 0x120]
add rax, 8
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xffffffff
je 0x1400064d6
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x20], 0x10
jb 0x1400064af
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 8]
mov qword [rsp + 0xe0], rax
jmp 0x1400064c3
mov rax, qword [rsp + 0x120]
add rax, 8
mov qword [rsp + 0xe0], rax
mov edx, 0x80
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x20], 0x10
jb 0x1400064fb
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 8]
mov qword [rsp + 0xe8], rax
jmp 0x14000650f
mov rax, qword [rsp + 0x120]
add rax, 8
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jne 0x140006578
mov r8, qword [rsp + 0x120]
lea rdx, str.__del_file:
lea rcx, [rsp + 0x30]
call fcn.14000dd40
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.1400099b0
jmp 0x1400065eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 5
jne 0x1400065eb
mov rcx, qword [rsp + 0x120]
call fcn.140006f40
movzx eax, al
test eax, eax
je 0x1400065eb
mov r8, qword [rsp + 0x120]
lea rdx, str.__del_file_after_rebooting:
lea rcx, [rsp + 0x58]
call fcn.14000dd40
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0x108]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.1400099b0
mov eax, 1
add rsp, 0x118
ret
Function at 0x140006f40
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x128
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x20], 0x10
jb 0x140006f85
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 8]
mov qword [rsp + 0xd8], rax
jmp 0x140006f99
mov rax, qword [rsp + 0x130]
add rax, 8
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x10
test eax, eax
je 0x140007077
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x20], 0x10
jb 0x140006fdf
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 8]
mov qword [rsp + 0xe0], rax
jmp 0x140006ff3
mov rax, qword [rsp + 0x130]
add rax, 8
mov qword [rsp + 0xe0], rax
mov r8d, 4
xor edx, edx
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14000706b
mov r8, qword [rsp + 0x130]
lea rdx, str.__del_dir_on_reboot_:
lea rcx, [rsp + 0x30]
call fcn.14000dd40
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0xf0]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x30]
call fcn.1400099b0
mov al, 1
jmp 0x140007198
xor al, al
jmp 0x140007198
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x20], 0x10
jb 0x14000709c
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 8]
mov qword [rsp + 0xf8], rax
jmp 0x1400070b0
mov rax, qword [rsp + 0x130]
add rax, 8
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1400070d0
mov al, 1
jmp 0x140007198
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 2
jne 0x1400070e8
mov al, 1
jmp 0x140007198
mov rax, qword [rsp + 0x130]
cmp qword [rax + 0x20], 0x10
jb 0x14000710d
mov rax, qword [rsp + 0x130]
mov rax, qword [rax + 8]
mov qword [rsp + 0x100], rax
jmp 0x140007121
mov rax, qword [rsp + 0x130]
add rax, 8
mov qword [rsp + 0x100], rax
mov r8d, 4
xor edx, edx
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140007196
mov r8, qword [rsp + 0x130]
lea rdx, str.__del_file_on_reboot_:
lea rcx, [rsp + 0x58]
call fcn.14000dd40
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x110], rax
mov rcx, qword [rsp + 0x110]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.1400099b0
mov al, 1
jmp 0x140007198
xor al, al
add rsp, 0x128
ret
Function at 0x140007810
Capabilities:
Enumerate services

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x3028
call fcn.1400364d0
sub rsp, rax
lea rax, [rsp + 0x3010]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2fd0
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x3038]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140007994
mov dword [rsp + 0x3014], 0
jmp 0x14000788e
mov eax, dword [rsp + 0x3014]
add eax, 1
mov dword [rsp + 0x3014], eax
mov eax, dword [rsp + 0x3010]
cmp dword [rsp + 0x3014], eax
jae 0x14000798b
mov edx, dword [rsp + 0x3014]
imul rdx, rdx, 0x30
mov r8d, 0xf01ff
mov rdx, qword [rsp + rdx + 0x40]
mov rcx, qword [rsp + 0x3030]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x3018], rax
cmp qword [rsp + 0x3038], 0
jne 0x1400078e0
xor eax, eax
jmp 0x140007996
mov r8d, dword [rsp + 0x3040]
mov rdx, qword [rsp + 0x3018]
mov rcx, qword [rsp + 0x3030]
call fcn.140007810
mov rcx, qword [rsp + 0x3018]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [rsp + 0x3014]
imul rax, rax, 0x30
cmp dword [rsp + rax + 0x54], 2
je 0x140007941
mov eax, dword [rsp + 0x3014]
imul rax, rax, 0x30
cmp dword [rsp + rax + 0x54], 4
je 0x140007941
mov eax, dword [rsp + 0x3014]
imul rax, rax, 0x30
cmp dword [rsp + rax + 0x54], 5
jne 0x140007986
mov r8d, dword [rsp + 0x3014]
imul r8, r8, 0x30
movzx eax, word [0x140058af8]
imul rax, rax, 0x104
lea rcx, [0x1400486f0]
add rcx, rax
mov r8, qword [rsp + r8 + 0x40]
mov edx, 0x104
call fcn.14001911c
movzx eax, word [0x140058af8]
add ax, 1
mov word [0x140058af8], ax
jmp 0x14000787d
mov eax, 1
jmp 0x140007996
xor eax, eax
add rsp, 0x3028
ret
Function at 0x1400079a0
Capabilities:
Query service status
Start service

Disassembly:
sub rsp, 0x68
mov r8d, 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400079c8
xor eax, eax
jmp 0x140007b01
mov dword [rsp + 0x50], 0
jmp 0x1400079dd
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x100
jae 0x140007afc
mov eax, dword [rsp + 0x50]
imul rax, rax, 0x104
lea rdx, [0x1400486f0]
add rdx, rax
mov r8d, 0xf01ff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140007a30
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140007b01
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140007a61
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140007b01
cmp dword [rsp + 0x2c], 4
je 0x140007ae1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov dword [rsp + 0x54], 0
jmp 0x140007a8d
mov eax, dword [rsp + 0x54]
add eax, 1
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x1e
jae 0x140007ae1
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x140007ac5
cmp dword [rsp + 0x2c], 4
jne 0x140007ab8
jmp 0x140007ae1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140007adf
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x140007b01
jmp 0x140007a82
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1400079d2
mov eax, 1
add rsp, 0x68
ret
Function at 0x140007b10
Capabilities:
Enumerate services

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x3178
call fcn.1400364d0
sub rsp, rax
mov qword [rsp + 0x3160], 0xfffffffffffffffe
mov rax, qword [0x1400472d0]
xor rax, rsp
mov qword [rsp + 0x3168], rax
lea rax, [rsp + 0x3010]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2fd0
lea r8, [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x3188]
call qword [sym.imp.ADVAPI32.dll_EnumDependentServicesA]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x140007d17
mov dword [rsp + 0x3014], 0
jmp 0x140007bac
mov eax, dword [rsp + 0x3014]
add eax, 1
mov dword [rsp + 0x3014], eax
mov eax, dword [rsp + 0x3010]
cmp dword [rsp + 0x3014], eax
jae 0x140007d11
mov edx, dword [rsp + 0x3014]
imul rdx, rdx, 0x30
mov r8d, 0xf01ff
mov rdx, qword [rsp + rdx + 0x40]
mov rcx, qword [rsp + 0x3180]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x3048], rax
cmp qword [rsp + 0x3048], 0
jne 0x140007bfe
xor al, al
jmp 0x140007d19
mov r8d, dword [rsp + 0x3190]
mov rdx, qword [rsp + 0x3048]
mov rcx, qword [rsp + 0x3180]
call fcn.140007b10
mov rcx, qword [rsp + 0x3048]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edx, dword [rsp + 0x3014]
imul rdx, rdx, 0x30
mov rdx, qword [rsp + rdx + 0x40]
lea rcx, [rsp + 0x3020]
call fcn.140007fb0
nop
cmp qword [rsp + 0x3040], 0x10
jb 0x140007c64
mov rax, qword [rsp + 0x3028]
mov qword [rsp + 0x3108], rax
jmp 0x140007c74
lea rax, [rsp + 0x3028]
mov qword [rsp + 0x3108], rax
lea rax, [rsp + 0x30b0]
mov qword [rsp + 0x30b8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x3050]
call fcn.1400099b0
mov rcx, qword [rsp + 0x3108]
call fcn.140018050
mov qword [rsp + 0x30e8], rax
mov r8, qword [rsp + 0x30e8]
mov rdx, qword [rsp + 0x3108]
lea rcx, [rsp + 0x3050]
call fcn.14000aae0
nop
mov r8d, dword [rsp + 0x3190]
lea rdx, [rsp + 0x3050]
mov rcx, qword [rsp + 0x3180]
call fcn.140007d40
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x3050]
call fcn.1400099b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x3020]
call fcn.1400099b0
jmp 0x140007b9b
mov al, 1
jmp 0x140007d19
xor al, al
mov rcx, qword [rsp + 0x3168]
xor rcx, rsp
call fcn.1400189a0
add rsp, 0x3178
ret
Function at 0x140007d40
Capabilities:
Query service status
Stop service

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1f8
mov qword [rsp + 0x1d0], 0xfffffffffffffffe
mov byte [rsp + 0x28], 1
mov rax, qword [rsp + 0x208]
cmp qword [rax + 0x20], 0x10
jb 0x140007d8c
mov rax, qword [rsp + 0x208]
mov rax, qword [rax + 8]
mov qword [rsp + 0x1d8], rax
jmp 0x140007da0
mov rax, qword [rsp + 0x208]
add rax, 8
mov qword [rsp + 0x1d8], rax
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140007dd0
xor al, al
jmp 0x140007fa4
mov r8, qword [rsp + 0x208]
lea rdx, str.__stopping_service:
lea rcx, [rsp + 0x58]
call fcn.14000dd40
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rax
mov rcx, qword [rsp + 0x1e8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.1400099b0
mov dword [rsp + 0x50], 0
jmp 0x140007e33
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x210]
cmp dword [rsp + 0x50], eax
jae 0x140007f95
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140007e62
mov byte [rsp + 0x28], 0
jmp 0x140007f95
cmp dword [rsp + 0x34], 1
je 0x140007e95
cmp dword [rsp + 0x50], 0
jne 0x140007e93
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140007e93
mov byte [rsp + 0x28], 0
jmp 0x140007f95
jmp 0x140007f12
lea rax, [rsp + 0xf1]
mov qword [rsp + 0xf8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.1400099b0
lea rcx, str.__stopped
call fcn.140018050
mov qword [rsp + 0x128], rax
mov r8, qword [rsp + 0x128]
lea rdx, str.__stopped
lea rcx, [rsp + 0x80]
call fcn.14000aae0
nop
lea rcx, [rsp + 0x80]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x80]
call fcn.1400099b0
mov byte [rsp + 0x28], 1
jmp 0x140007f95
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x151]
mov qword [rsp + 0x158], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.1400099b0
lea rcx, [0x14003ab80]
call fcn.140018050
mov qword [rsp + 0x188], rax
mov r8, qword [rsp + 0x188]
lea rdx, [0x14003ab80]
lea rcx, [rsp + 0xa8]
call fcn.14000aae0
nop
lea rcx, [rsp + 0xa8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xa8]
call fcn.1400099b0
jmp 0x140007e28
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [rsp + 0x28]
add rsp, 0x1f8
ret
Function at 0x140010eb0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1d8
mov qword [rsp + 0x1c0], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x1e0]
call fcn.14000fa40
nop
mov rcx, qword [rsp + 0x1e0]
lea rax, vtable.DiasInstall::FirewallPecker_FWAS.0
mov qword [rcx], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x1e0]
add rax, 8
mov qword [rsp + 0x20], rax
lea r9, [0x14003bf58]
mov r8d, 1
xor edx, edx
lea rcx, [0x14003bf48]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140011030
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x100], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.1400099b0
lea rcx, str.FirewallPcker_FWAS::FirewallPcker_FWAS__
call fcn.140018050
mov qword [rsp + 0x128], rax
mov r8, qword [rsp + 0x128]
lea rdx, str.FirewallPcker_FWAS::FirewallPcker_FWAS__
lea rcx, [rsp + 0xa8]
call fcn.14000aae0
nop
lea rax, [rsp + 0x130]
mov qword [rsp + 0x138], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xd0]
call fcn.1400099b0
lea rcx, str.CoCreateInstance___fail
call fcn.140018050
mov qword [rsp + 0x160], rax
mov r8, qword [rsp + 0x160]
lea rdx, str.CoCreateInstance___fail
lea rcx, [rsp + 0xd0]
call fcn.14000aae0
nop
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x38]
call fcn.14000f270
lea rdx, [0x140045918]
lea rcx, [rsp + 0x38]
call fcn.1400193e0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd0]
call fcn.1400099b0
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xa8]
call fcn.1400099b0
nop
mov rax, qword [rsp + 0x1e0]
add rsp, 0x1d8
ret
Function at 0x14001a100
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14001a189
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x14001a14b
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14001a199
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x14001a161
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14001a199
cmp dword [rax + 0x84], 0xe
ja 0x14001a175
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x14001a199
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x14001a199
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.140020fb8
test eax, eax
jne 0x14001a1c9
cmp dword [0x140058cb0], 1
jne 0x14001a1b5
call fcn.14002001c
mov ecx, 0x1c
call fcn.14001fdc8
mov ecx, 0xff
call fcn.14001f8fc
call fcn.14001aae8
test eax, eax
jne 0x14001a1f4
cmp dword [0x140058cb0], 1
jne 0x14001a1e0
call fcn.14002001c
mov ecx, 0x10
call fcn.14001fdc8
mov ecx, 0xff
call fcn.14001f8fc
call fcn.140020f48
nop
call fcn.140020bec
test eax, eax
jns 0x14001a20d
mov ecx, 0x1b
call fcn.14001f890
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x140059db8], rax
call fcn.140020a38
mov qword [0x140058ca0], rax
call fcn.140020940
test eax, eax
jns 0x14001a239
mov ecx, 8
call fcn.14001f890
call fcn.140020638
test eax, eax
jns 0x14001a24c
mov ecx, 9
call fcn.14001f890
mov ecx, 1
call fcn.14001fa2c
test eax, eax
je 0x14001a261
mov ecx, eax
call fcn.14001f890
call fcn.1400205bc
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call section..text
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x14001a298
mov ecx, eax
call fcn.14001fc68
call fcn.14001fc80
jmp 0x14001a2b9
mov eax, edi
jmp 0x14001a2c2
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1400eb000
add rsp, 0x28
jmp 0x14001a100
Function at 0x14001cd1f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400472d0]
jne 0x1400189ba
rol rcx, 0x10
test cx, 0xffff
jne 0x1400189b6
repz ret
ror rcx, 0x10
jmp 0x14001cc78
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140058d60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140058e58]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001ccfd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140058d60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001cd1f
mov rax, qword [rsp + 0x88]
mov qword [0x140058e58], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140058df8], rax
mov rax, qword [0x140058e58]
mov qword [0x140058cd0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140058de0], rax
mov dword [0x140058cc0], 0xc0000409
mov dword [0x140058cc4], 1
mov rax, qword [0x1400472d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400472d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140058d58], eax
mov ecx, 1
call fcn.14001f124
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14003c6f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140058d58], 0
jne 0x14001cda6
mov ecx, 1
call fcn.14001f124
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14001fc68
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400221bc
nop
cmp dword [0x1400592e8], 1
je 0x14001fc14
mov dword [0x1400592e4], 1
mov byte [0x1400592e0], r12b
test ebx, ebx
jne 0x14001fc00
mov rcx, qword [0x140059d90]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001fbed
mov rcx, qword [0x140059d88]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001fb8c
call fcn.14001a7a4
cmp qword [rdi], rax
jne 0x14001fb8c
jmp 0x14001fb72
cmp rdi, rsi
jb 0x14001fbed
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14001a7a4
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140059d90]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140059d88]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14001fbcb
cmp r13, rax
je 0x14001fbeb
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14001fb72
lea rdx, [0x14003a460]
lea rcx, [0x14003a458]
call fcn.14001f92c
lea rdx, [0x14003a470]
lea rcx, [0x14003a468]
call fcn.14001f92c
nop
test r12d, r12d
je 0x14001fc23
mov ecx, 8
call fcn.14002209c
test r12d, r12d
jne 0x14001fc4e
mov dword [0x1400592e8], 1
lea ecx, [r12 + 8]
call fcn.14002209c
mov ecx, r15d
call fcn.14001f8c0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14001fadc

Function at 0x14001fc74
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001fadc