joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025590
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rdx
xor eax, eax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rbx, r8
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x44], eax
call fcn.1400252a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140025420
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140091a70
add rsp, 0xa0
pop rbx
ret

Function at 0x140025b80
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rsi, rcx
mov rcx, qword [rdx]
mov rbx, r8
mov rdi, rdx
mov dword [rsp + 0x48], ebp
test rcx, rcx
je 0x140025bb4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi], rbp
mov rcx, qword [rbx]
test rcx, rcx
je 0x140025bc5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx], rbp
xor edx, edx
lea r9, [0x1400c4920]
lea rcx, [0x1400bb7c0]
lea r8d, [rdx + 1]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140025c19
mov rcx, qword [rdi]
lea rdx, [0x1400c48f0]
mov r8, rbx
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140025c19
test rsi, rsi
je 0x140025c3b
mov rcx, qword [rbx]
mov r8d, 2
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
jns 0x140025c3b
mov rcx, qword [rdi]
test rcx, rcx
je 0x140025c2a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rdi], rbp
mov rcx, qword [rbx]
test rcx, rcx
je 0x140025c3b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx], rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14002a520
Capabilities:
Generate random numbers via rtlgenrandom
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
xor edx, edx
or rax, 0xffffffffffffffff
xor ebx, ebx
div rcx
mov r12d, 0xffffffff
mov dword [rsp + 0x170], ebx
mov r14, rax
mov r15, rcx
mov qword [rsp + 0x178], r12
imul r14, rcx
dec r14
nop
mov edi, 8
lea rsi, [rsp + 0x180]
mov qword [rsp + 0x170], rdi
nop word [rax + rax]
lea rcx, [rsp + 0x170]
lea rax, [rsp + 0x178]
cmp rdi, r12
cmovbe rax, rcx
mov rcx, rsi
mov ebp, dword [rax]
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
jne 0x14002a5b1
cmp byte [0x1400d77dc], al
jne 0x14002a601
int3
test bl, 1
je 0x14002a5c3
lea rcx, [rsp + 0x20]
and ebx, 0xfffffffe
call fcn.140009830
sub rdi, rbp
add rsi, rbp
mov qword [rsp + 0x170], rdi
test rdi, rdi
jne 0x14002a580
mov rax, qword [rsp + 0x180]
cmp rax, r14
ja 0x14002a560
xor edx, edx
div r15
mov rax, rdx
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 1
call fcn.14009400c
int3
Function at 0x14002ae40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rbx, [rcx + 8]
mov rsi, rcx
or r8, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rdx
mov dword [rsp + 0x30], 0
call fcn.14001b260
test al, al
jne 0x14002aee3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rax - 0x20]
cmp ecx, 1
jbe 0x14002aece
cmp eax, 5
jne 0x14002ae99
mov eax, 0x3e8
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp qword [rbx + 0x18], 8
jb 0x14002aea3
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 0x3e9
mov edx, 0x3eb
cmp eax, 0xffffffff
cmove ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, 0x3ea
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rdi + 0x10]
mov rbx, qword [rsp + 0x38]
mov qword [rsi + 0x30], rax
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x14002b760
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rdx
xor edx, edx
cmp qword [rcx + 0x18], 0xffffffffffffffff
mov dword [rsp + 0x30], edx
mov rbx, rcx
jne 0x14002b782
cmp byte [0x1400d77dc], dl
jne 0x14002b7bc
int3
lea rcx, [rax + 0x3f]
and rcx, 0xffffffffffffffc0
mov qword [rbx + 0x18], rcx
cmp rcx, 0xffffffffffffffff
je 0x14002b79b
mov rdx, qword [rbx + 0x10]
add rdx, rcx
mov rcx, qword [rbx + 8]
call fcn.140095e1c
test rax, rax
jne 0x14002b7b2
cmp byte [0x1400d77dc], al
jne 0x14002b7c7
int3
mov qword [rbx + 8], rax
add rsp, 0x20
pop rbx
ret
mov ecx, 1
call fcn.14009400c
int3
mov ecx, 1
call fcn.14009400c
int3
Function at 0x140032610
Capabilities:
Encode data using xor

Disassembly:
mov r9d, edx
mov r8, rcx
mov eax, edx
test edx, edx
jle 0x1400326eb
test rcx, rcx
je 0x1400326eb
mov r10d, edx
sar r9d, 2
and r10d, 3
test r9d, r9d
jle 0x14003266a
nop dword [rax]
movzx ecx, word [r8]
movzx edx, word [r8 + 2]
dec r9d
add eax, ecx
shl edx, 0xb
add r8, 4
mov ecx, eax
shl ecx, 0x10
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test r9d, r9d
jg 0x140032640
dec r10d
je 0x1400326ab
dec r10d
je 0x140032697
dec r10d
jne 0x1400326be
movzx ecx, word [r8]
movsx edx, byte [r8 + 2]
add eax, ecx
shl edx, 0x12
mov ecx, eax
shl ecx, 0x10
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
jmp 0x1400326bc
movzx ecx, word [r8]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x1400326bc
movsx ecx, byte [r8]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [rax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
shr ecx, 6
add eax, ecx
ret
xor eax, eax
ret

Function at 0x140036630
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rdi, rcx
mov dword [rsp + 0x48], ebp
mov rcx, qword [rcx]
lea rax, [rcx + 1]
test rax, 0xfffffffffffffffe
jne 0x14003665f
xor al, al
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
cmp byte [rdi + 0x50], bpl
mov eax, 0x1000002
mov r8d, 2
cmovne r8d, eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x50], rsi
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lea rcx, [rdi + 0x48]
mov rdx, rax
call fcn.14000edb0
mov rax, qword [rdi + 0x48]
inc rax
test rax, 0xfffffffffffffffe
jne 0x1400366b8
xor al, al
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
mov qword [rsp + 0x40], rbx
xor ebx, ebx
call fcn.1400239e0
lea rcx, [rax - 1]
cmp rcx, 0x7ffffffe
ja 0x140036705
mov rcx, qword [rdi + 0x48]
mov r8d, ebx
lea edx, [rbx + 4]
shr r8, 0x20
mov r9d, ebx
mov qword [rdi + 0x40], rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 0x38], rax
test rax, rax
je 0x140036705
mov qword [rdi + 0x38], rax
mov al, 1
jmp 0x140036707
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140051cd4
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp], rax
mov rsi, rdx
lea rdx, [rbp - 0x40]
xor r14d, r14d
mov rbx, rcx
mov dword [rsp + 0x20], r14d
call fcn.1400146f0
lea r15d, [r14 + 7]
or rdi, 0xffffffffffffffff
lea rcx, [rbp - 0x20]
mov rdx, rax
xor r8d, r8d
mov r9, rdi
mov qword [rbp - 8], r15
mov qword [rbp - 0x10], r14
mov word [rbp - 0x20], r14w
call fcn.140007850
lea rcx, [rbp - 0x40]
call fcn.1400045a0
lea rdx, [rbp - 0x60]
xor r8d, r8d
mov rcx, rbx
call fcn.1400158c0
cmp qword [rbp - 0x48], 8
mov r8, qword [rbp - 0x10]
lea rax, [rbp - 0x60]
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x30], r14
cmovae rax, qword [rbp - 0x60]
mov word [rbp - 0x40], r14w
mov r9, rdi
cmp word [rax], 0x22
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x40]
jne 0x140051d84
add r8, 2
call fcn.140007850
cmp qword [rbp - 0x48], 8
jb 0x140051d99
mov rcx, qword [rbp - 0x60]
call fcn.1400910f4
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r14
mov word [rbp - 0x60], r14w
call fcn.1400076a0
cmp qword [rbp - 0x28], 8
jb 0x140051dc3
mov rcx, qword [rbp - 0x40]
call fcn.1400910f4
lea r8, [rbp - 0x60]
lea rcx, [rbp - 0x60]
mov edx, 3
call fcn.14000fc70
call fcn.1400513e0
xor edx, edx
lea r8d, [rdx + 0x6c]
lea rcx, [rsp + 0x34]
mov rbx, rax
call fcn.140091cf0
cmp qword [rbp - 8], 8
lea rax, str.runas
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x20]
lea rax, [rbp - 0x60]
cmovae rcx, qword [rbp - 0x20]
cmp qword [rbp - 0x48], 8
mov dword [rsp + 0x30], 0x70
cmovae rax, qword [rbp - 0x60]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x60], 5
mov qword [rsp + 0x50], rax
mov dil, r14b
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, 1
jne 0x140051e82
mov rcx, qword [rbp - 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x68]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140051e82
mov dil, 1
test rsi, rsi
je 0x140051e82
mov eax, dword [rsp + 0x20]
mov dword [rsi], eax
test rbx, rbx
je 0x140051e90
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyWindow]
cmp qword [rbp - 0x48], 8
jb 0x140051ea0
mov rcx, qword [rbp - 0x60]
call fcn.1400910f4
cmp qword [rbp - 8], 8
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x50], r14
mov word [rbp - 0x60], r14w
jb 0x140051ebd
mov rcx, qword [rbp - 0x20]
call fcn.1400910f4
mov al, dil
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140091a70
mov rbx, qword [rsp + 0x150]
add rsp, 0x110
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140059510
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor esi, esi
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], 0x100
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400595c3
cmp dword [rsp + 0x20], 1
jb 0x1400595c3
mov edx, dword [rsp + 0x20]
mov rdi, qword [rbx + 0x10]
cmp rdi, rdx
ja 0x140059599
cmp qword [rbx + 0x18], rdx
je 0x140059599
mov r8b, 1
mov rcx, rbx
call fcn.140007bc0
test al, al
je 0x140059599
cmp qword [rbx + 0x18], 8
mov qword [rbx + 0x10], rdi
jb 0x140059592
mov rax, qword [rbx]
jmp 0x140059595
mov rax, rbx
mov word [rax + rdi*2], si
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x2d]
call fcn.140016250
mov r8d, dword [rsp + 0x20]
lea rdx, [rsp + 0x30]
dec r8d
mov rcx, rbx
call fcn.1400060d0
mov al, 1
jmp 0x1400595c5
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140091a70
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140064c34
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
and dword [rbp + 0x20], 0
mov rdi, qword [rcx + 8]
mov rbx, qword [rcx]
mov rsi, rcx
jmp 0x140064c61
xor edx, edx
mov rcx, rbx
call fcn.14007120c
add rbx, 0x40
cmp rbx, rdi
jne 0x140064c53
mov rax, qword [rsi]
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
lea rcx, [rbp - 0x18]
mov r9d, 1
mov rdx, 0xffffffff80000002
mov qword [rsi + 8], rax
call fcn.140018610
mov rbx, qword [rbp - 0x18]
test rbx, rbx
jne 0x140064c9d
mov ebx, 0x80070002
jmp 0x140064d75
and dword [rbp + 0x20], 0
and qword [rbp - 0x20], 0
xorps xmm0, xmm0
lea rcx, [rbp - 0x30]
mov edx, 1
movdqu xmmword [rbp - 0x30], xmm0
call fcn.140065f7c
mov rdi, qword [rbp - 0x30]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rdx, str.PendingFileRenameOperations
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x140064cf1
mov ebx, 0x80070002
jmp 0x140064d68
cmp eax, 0xea
jne 0x140064d44
cmp dword [rbp + 0x28], 7
jne 0x140064d04
test byte [rbp + 0x20], 1
je 0x140064d0b
mov ebx, 0x8000ffff
jmp 0x140064d68
mov edx, dword [rbp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.140065f7c
mov rdi, qword [rbp - 0x30]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rdx, str.PendingFileRenameOperations
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140064d54
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140064d68
mov rdx, qword [rbp - 0x28]
mov r8, rsi
mov rcx, rdi
sub rdx, rdi
call fcn.140065108
mov ebx, eax
test rdi, rdi
je 0x140064d75
mov rcx, rdi
call fcn.1400910f4
lea rcx, [rbp - 0x18]
call fcn.140018670
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006595c
Capabilities:
Move file

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edi, edi
mov rbx, rcx
lea rcx, [r11 - 0x3c]
lea r8d, [rdi + 0x20]
xor edx, edx
mov dword [rsp + 0x30], edi
mov dword [r11 - 0x40], edi
call fcn.140091cf0
cmp qword [rbx + 0x18], 8
jb 0x1400659a5
mov rcx, qword [rbx]
jmp 0x1400659a8
mov rcx, rbx
lea r8, [rsp + 0x148]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x140065a28
call fcn.1400096a0
cmp eax, 1
jg 0x140065a11
mov edi, 1
call sub.KERNEL32.dll_GetLastError
lea r8d, [rdi + 0x3d]
lea rdx, str.c:_b_build_slavewin64_build_srcchromeinstallerutildelete_after_reboot_helper.cc
lea rcx, [rsp + 0x38]
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.140009f90
cmp qword [rbx + 0x18], 8
jb 0x1400659f6
mov rbx, qword [rbx]
lea rcx, [rax + 0x10]
mov rdx, rbx
call fcn.14000a0a0
lea rdx, str._does_not_exist.
mov rcx, rax
call fcn.140008810
test dil, 1
je 0x140065a21
lea rcx, [rsp + 0x38]
call fcn.14000a010
xor al, al
jmp 0x140065b32
mov rcx, rbx
call fcn.14000da40
mov ecx, 5
test al, al
lea r8d, [rcx - 1]
cmove r8d, ecx
cmp qword [rbx + 0x18], 8
jb 0x140065a4b
mov rcx, qword [rbx]
jmp 0x140065a4e
mov rcx, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140065ac7
call fcn.1400096a0
cmp eax, 2
jg 0x140065abe
mov edi, 2
call sub.KERNEL32.dll_GetLastError
lea r8d, [rdi + 0x47]
lea rdx, str.c:_b_build_slavewin64_build_srcchromeinstallerutildelete_after_reboot_helper.cc
lea rcx, [rsp + 0x38]
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.140009f90
lea rdx, str.Could_not_schedule
lea rcx, [rax + 0x10]
call fcn.140008810
cmp qword [rbx + 0x18], 8
jb 0x140065aa4
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14000a0a0
lea rdx, str._for_deletion.
mov rcx, rax
call fcn.140008810
test dil, 2
jmp 0x140065a15
lea rcx, str.c:_b_build_slavewin64_build_srcchromeinstallerutildelete_after_reboot_helper.cc
mov edx, 0x55
call fcn.1400096b0
cmp eax, 1
jl 0x140065b20
mov edi, 4
lea rdx, str.c:_b_build_slavewin64_build_srcchromeinstallerutildelete_after_reboot_helper.cc
lea rcx, [rsp + 0x38]
lea r8d, [rdi + 0x59]
or r9d, 0xffffffff
call fcn.1400097c0
lea rdx, str.Scheduled_for_deletion:
lea rcx, [rax + 8]
call fcn.140008810
cmp qword [rbx + 0x18], 8
jb 0x140065b15
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14000a0a0
test dil, 4
je 0x140065b30
lea rcx, [rsp + 0x38]
call fcn.140009830
mov al, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140091a70
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret

Function at 0x140067f28
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov eax, dword [r8 + 0x10]
movsxd rcx, ecx
add eax, eax
cmp qword [r8 + 0x18], 8
jb 0x140067f3f
mov r8, qword [r8]
cmp qword [rdx + 0x18], 8
jb 0x140067f49
mov rdx, qword [rdx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
add rsp, 0x38
ret
Function at 0x140077538
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400d33c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
and dword [rbp - 0x40], 0
movzx r12d, word [rbp + 0x60]
and qword [rbp - 0x40], 0
mov rsi, rdx
xor edx, edx
mov r14, r9
mov rdi, r8
mov rbx, rcx
lea rax, [rbp - 0x40]
lea r8d, [rdx + 0x17]
lea r9, [0x1400ba178]
lea rcx, [0x1400bb7f0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400775b5
mov rcx, qword [rbp - 0x40]
and qword [rsi], 0
test rcx, rcx
je 0x14007774b
mov rdx, qword [rcx]
call qword [rdx + 0x10]
jmp 0x14007774b
cmp qword [rdi + 0x18], 8
mov r15, qword [rbp - 0x40]
jb 0x1400775c3
mov rdi, qword [rdi]
lea rcx, [rbp - 0x38]
mov rdx, rdi
call fcn.14002ad00
mov r8, qword [r15]
mov rcx, r15
mov rdx, qword [rax]
call qword [r8 + 0x40]
lea rcx, [rbp - 0x38]
call fcn.14002ad20
cmp qword [r14 + 0x18], 8
mov rdi, qword [rbp - 0x40]
jb 0x1400775f3
mov r14, qword [r14]
lea rcx, [rbp - 0x38]
mov rdx, r14
call fcn.14002ad00
mov r8, qword [rdi]
mov rcx, rdi
mov rdx, qword [rax]
call qword [r8 + 0x50]
lea rcx, [rbp - 0x38]
call fcn.14002ad20
mov rdi, qword [rbp - 0x40]
lea rdx, [rbx + 0x20]
cmp qword [rdx + 0x18], 8
jb 0x140077627
mov rdx, qword [rdx]
lea rcx, [rbp - 0x38]
call fcn.14002ad00
mov r8, qword [rdi]
mov rcx, rdi
mov rdx, qword [rax]
call qword [r8 + 0x60]
lea rcx, [rbp - 0x38]
call fcn.14002ad20
mov rcx, qword [rbp - 0x40]
mov edx, 0x11
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rcx, qword [rbp - 0x40]
mov r14d, 1
mov rax, qword [rcx]
mov edx, r14d
call qword [rax + 0xe0]
mov rcx, qword [rbp - 0x40]
or edx, 0xffffffff
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rdi, qword [rbp - 0x40]
lea rdx, [0x1400ba170]
lea rcx, [rbp - 0x30]
movzx r8d, r12w
call fcn.140011e10
cmp qword [rax + 0x18], 8
jb 0x1400776a0
mov rax, qword [rax]
lea rcx, [rbp - 0x38]
mov rdx, rax
call fcn.14002ad00
mov r8, qword [rdi]
mov rcx, rdi
mov rdx, qword [rax]
call qword [r8 + 0x90]
lea rcx, [rbp - 0x38]
call fcn.14002ad20
cmp qword [rbp - 0x18], 8
jb 0x1400776d5
mov rcx, qword [rbp - 0x30]
call fcn.1400910f4
cmp qword [rbx + 0x18], 8
mov rdi, qword [rbp - 0x40]
jb 0x1400776e3
mov rbx, qword [rbx]
lea rcx, [rbp - 0x38]
mov rdx, rbx
call fcn.14002ad00
mov r8, qword [rdi]
mov rcx, rdi
mov rdx, qword [rax]
call qword [r8 + 0x120]
lea rcx, [rbp - 0x38]
call fcn.14002ad20
mov rcx, qword [rbp - 0x40]
mov edx, 0x7fffffff
mov rax, qword [rcx]
call qword [rax + 0x130]
mov rcx, qword [rbp - 0x40]
mov edx, r14d
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [rbp - 0x40]
mov qword [rsi], rcx
test rcx, rcx
je 0x14007774b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14007774b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, rsi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140091a70
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140077eb0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
and dword [rsp + 0x30], 0
lea rdi, [rcx + 0x48]
mov rbx, rcx
mov rcx, qword [rdi]
and qword [rdi], 0
mov r14, r8
mov rbp, rdx
test rcx, rcx
je 0x140077edf
mov rax, qword [rcx]
call qword [rax + 0x10]
xor edx, edx
lea rsi, [rbx + 0x40]
lea r9, [0x1400ba188]
lea r8d, [rdx + 0x17]
lea rcx, [0x1400bb810]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rsi]
test eax, eax
jns 0x140077f1c
and qword [rsi], 0
test rcx, rcx
je 0x140077f18
mov rax, qword [rcx]
call qword [rax + 0x10]
xor al, al
jmp 0x140077f5a
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x90]
test eax, eax
jns 0x140077f35
mov rcx, qword [rdi]
and qword [rdi], 0
jmp 0x140077f0d
cmp rbx, rbp
je 0x140077f4c
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.140007850
lea rcx, [rbx + 0x20]
mov rdx, r14
call fcn.1400045d0
mov al, 1
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14007856c
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
and dword [rsp + 0x30], 0
and qword [r11 - 0x20], 0
mov rsi, rdx
xor edx, edx
mov rbp, r8
mov rbx, rcx
lea rax, [r11 - 0x20]
lea r9, [0x1400ba1b8]
lea r8d, [rdx + 0x17]
lea rcx, [0x1400bb820]
mov qword [r11 - 0x38], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x1400785b7
xor bl, bl
jmp 0x14007860b
mov rcx, qword [rsp + 0x38]
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x38]
test eax, eax
js 0x1400785f9
mov rcx, qword [rsp + 0x30]
lea rdi, [rbx + 0x40]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x38]
test eax, eax
jns 0x14007862a
mov rcx, qword [rdi]
and qword [rdi], 0
test rcx, rcx
je 0x1400785f9
mov rax, qword [rcx]
call qword [rax + 0x10]
xor bl, bl
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14007860b
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14007861b
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov al, bl
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp rbx, rsi
je 0x140078641
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.140007850
lea rcx, [rbx + 0x20]
mov rdx, rbp
call fcn.1400045d0
mov bl, 1
jmp 0x1400785fb
Function at 0x140078d04
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
and dword [rbp + 0x30], 0
and qword [rbp + 0x38], 0
mov sil, cl
lea rax, [rbp + 0x38]
mov r14, rdx
mov edi, 1
lea rcx, [0x1400c3df8]
lea r9, [0x1400ba2c0]
mov r8d, edi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140078d5b
xor dil, dil
jmp 0x140078e0b
and qword [rbp + 0x30], 0
mov rbx, qword [rbp + 0x38]
lea rdx, [0x1400ba2d0]
lea rcx, [rbp - 0x10]
call fcn.14002ad00
mov r10, qword [rbx]
lea rcx, [rbp + 0x30]
mov rdx, qword [rax]
mov qword [rsp + 0x40], rcx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [r10 + 0x18]
lea rcx, [rbp - 0x10]
mov ebx, eax
call fcn.14002ad20
test ebx, ebx
js 0x140078df9
test sil, sil
je 0x140078dea
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov rcx, qword [rbp + 0x30]
mov eax, 3
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea edx, [rax + 7]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x140078df9
mov rax, qword [rbp + 0x30]
xor ecx, ecx
mov qword [r14], rax
mov qword [rbp + 0x30], rcx
jmp 0x140078e00
mov rcx, qword [rbp + 0x30]
xor dil, dil
test rcx, rcx
je 0x140078e0b
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140078e1a
mov rdx, qword [rcx]
call qword [rdx + 0x10]
lea r11, [rsp + 0x60]
mov al, dil
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret