joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016bd30
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
movzx edx, al
cmp ecx, 5
jne 0x14016bd72
test al, al
jne 0x14016bd66
mov ebx, 0x15f
jmp 0x14016bd8d
cmp edx, 1
jne 0x14016bd8d
mov ebx, 0x15f
jmp 0x14016bd8d
cmp ecx, 6
jne 0x14016bd8d
test al, al
jne 0x14016bd82
mov ebx, 0x160
jmp 0x14016bd8d
mov eax, 0x161
cmp edx, 1
cmove ebx, eax
xor ecx, ecx
movzx edx, bx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14016beee
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rax, qword [rdi + 0x90]
mov rcx, qword [rax + 8]
cmp ebp, dword [rcx + 8]
jne 0x14016beea
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14016beea
mov rcx, rax
mov qword [rsp + 0x38], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov rax, qword [rdi + 0x90]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14016be10
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rdi + 0x90]
call fcn.14021ae20
mov ecx, 0x10
call fcn.1402bcb4c
mov ecx, 0x20
mov qword [rdi + 0x90], rax
mov qword [rax], rsi
call fcn.1402bcb4c
test rax, rax
je 0x14016be50
mov r8d, ebp
mov rdx, r14
mov rcx, rax
call fcn.1400d3e80
mov rsi, rax
mov rax, qword [rdi + 0x90]
mov qword [rax + 8], rsi
mov rax, qword [rdi + 0xa0]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x90]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
add r8, 0x1b8
mov rcx, rbx
movups xmm0, xmmword [r8]
movups xmmword [rdx + 0x1b8], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rdx + 0x1c8], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [rdx + 0x1d8], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [rdx + 0x1e8], xmm1
mov eax, dword [r8 + 0x40]
mov dword [rdx + 0x1f8], eax
movzx eax, word [r8 + 0x44]
mov word [rdx + 0x1fc], ax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r14, qword [rsp + 0x38]
mov al, 1
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
jmp 0x14016bed5
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14016bf00
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, al
shr ax, 8
movzx ecx, al
cmp edx, 5
jne 0x14016bf31
test al, al
je 0x14016bf26
cmp ecx, 1
jne 0x14016bf50
mov eax, 0x15f
add rsp, 0x20
pop rbx
ret
cmp edx, 6
jne 0x14016bf50
test al, al
jne 0x14016bf45
mov eax, 0x160
add rsp, 0x20
pop rbx
ret
mov eax, 0x161
cmp ecx, 1
cmove ebx, eax
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14016cf90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x98]
test rax, rax
je 0x14016d16d
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov r8d, 0xf
mov rbx, qword [rax + 0x10]
mov dword [rsp + 0x20], 0x414e4544
mov dword [rsp + 0x24], 0x445f494c
lea rcx, [rbx + 3]
mov dword [rsp + 0x28], 0x50415441
mov word [rsp + 0x2c], 0x454c
mov byte [rsp + 0x2e], 0x58
call fcn.1402c8000
test eax, eax
jne 0x14016d009
mov al, 1
jmp 0x14016d16f
xor edx, edx
mov rcx, rbx
lea edi, [rdx + 0x3b]
mov r8d, edx
mov r9d, edx
mov r10d, edx
mov r11d, edx
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
add r8d, eax
movzx eax, byte [rcx - 3]
add r11d, eax
movzx eax, byte [rcx - 2]
add r10d, eax
movzx eax, byte [rcx - 1]
add r9d, eax
dec rdi
jne 0x14016d020
lea eax, [r9 + r10]
add eax, r11d
add r8d, eax
cmp r8d, 0x67d9
je 0x14016d002
mov r10d, edx
mov r11d, edx
mov r8d, edx
mov r9d, edx
mov edi, edx
mov esi, edx
mov ecx, 8
nop dword [rax]
movzx eax, byte [rbx + rcx]
add rcx, 2
add r10d, eax
not al
movzx eax, al
add r8d, eax
movzx eax, byte [rbx + rcx - 1]
add r11d, eax
not al
movzx eax, al
add r9d, eax
cmp rcx, 0x1b6
jl 0x14016d070
cmp rcx, 0x1b7
jge 0x14016d0b2
movzx edi, byte [rcx + rbx]
movzx eax, dil
not al
movzx esi, al
lea eax, [r11 + r10]
add eax, edi
cmp eax, 0xac47
jne 0x14016d0d0
lea eax, [r9 + r8]
add eax, esi
cmp eax, 0x1010a
je 0x14016d002
mov r10d, edx
mov r9d, edx
mov r11d, edx
lea r8, [rbx + 8]
mov edi, 0x198
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov eax, ecx
add r11d, ecx
xor ecx, 0xaa
xor eax, 0x55
add r9d, ecx
add r10d, eax
dec rdi
jne 0x14016d0e2
cmp r11d, 0xaab2
jne 0x14016d122
cmp r10d, 0xc0f6
jne 0x14016d122
cmp r9d, 0xd572
je 0x14016d002
mov r8d, edx
mov r9d, edx
mov r10d, 0x1a0
nop
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov eax, ecx
add r9d, ecx
xor ecx, 0xaa
xor eax, 0x55
add r8d, ecx
add edx, eax
dec r10
jne 0x14016d130
cmp r9d, 0xabf8
jne 0x14016d16d
cmp edx, 0xc6a0
jne 0x14016d16d
cmp r8d, 0xd7c0
je 0x14016d002
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14016d260
Capabilities:
Encode data using xor

Disassembly:
cmp qword [rcx + 0x98], 0
jne 0x14016d260
xor al, al
ret
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
xor r8d, r8d
mov rbx, rcx
mov rdx, qword [rax + 8]
mov r10d, r8d
mov r9d, r8d
mov rax, qword [rdx + 0x10]
mov r11d, 0x15b
add rax, 0x14
nop dword [rax + rax]
movzx edx, byte [rax]
inc rax
mov ecx, edx
add r8d, edx
xor edx, 0xaa
xor ecx, 0x55
add r9d, edx
add r10d, ecx
dec r11
jne 0x14016d290
cmp r8d, 0x97f4
jne 0x14016d35f
cmp r10d, 0x9463
jne 0x14016d35f
cmp r9d, 0xc542
jne 0x14016d35f
lea rcx, [rbx + 0x78]
lea rdx, str.Win64_Bootkit.MBR.Gapz
call fcn.140200d00
mov rax, qword [rbx + 0x98]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
movzx eax, byte [rdx + 0x13]
movzx ecx, byte [rdx + 0x12]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0x11]
shl rcx, 8
add rax, rcx
movzx ecx, byte [rdx + 0x10]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0xf]
shl rcx, 8
add rax, rcx
movzx ecx, byte [rdx + 0xe]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0xd]
shl rcx, 8
add rcx, rax
movzx eax, byte [rdx + 0xc]
mov dword [rbx + 0x88], 1
shl rcx, 8
add rcx, rax
mov al, 1
mov qword [rbx + 0xa8], rcx
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14016d370
Capabilities:
Move file

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
xor bl, bl
lea rdi, [rcx + 8]
mov rcx, rdi
call fcn.1401bf000
lea r8, str..hitmanpro
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1402015b0
nop
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14016d464
mov rcx, rdi
call fcn.14020c4d0
mov rsi, rax
test rax, rax
je 0x14016d464
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x48], rax
mov ebx, 0x13
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.14020ad90
mov rdi, qword [rsp + 0x40]
test al, al
je 0x14016d42c
mov eax, dword [rsp + 0x3c]
inc eax
movsxd rdx, eax
mov r9d, ebx
lea r8, str.127.0.0.1_localhost
mov rcx, rdi
call fcn.1402beb60
mov byte [rdi + 0x13], 0
mov dword [rsp + 0x38], ebx
jmp 0x14016d430
mov ebx, dword [rsp + 0x38]
mov rax, qword [rsi]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x48]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
mov bl, 1
test rdi, rdi
je 0x14016d464
mov r8, rdi
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp dword [rsp + 0x30], 0
jle 0x14016d475
mov rcx, qword [rsp + 0x28]
call fcn.1402bd0e0
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14016e7b0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rsi, rcx
xor bl, bl
xor ebp, ebp
mov qword [r11 + 0x20], rbp
mov qword [r11 + 0x18], rbp
lea rax, [r11 + 0x20]
mov qword [r11 - 0x58], rax
lea r9, [0x14030fff8]
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x1403100c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14016e912
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea rdx, str.root_subscription
call qword [rax + 0x18]
test eax, eax
jne 0x14016e912
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 0xa]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x14016e912
mov rdx, qword [rsi + 0x68]
lea rcx, [rsp + 0x50]
call fcn.14011ef30
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x14016e896
mov rdx, qword [rdx]
jmp 0x14016e899
mov rdx, rbp
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x80]
mov edi, eax
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14016e8f7
lock dec dword [rbx + 0x10]
jne 0x14016e8f7
test rbx, rbx
je 0x14016e8f7
mov rcx, qword [rbx]
test rcx, rcx
je 0x14016e8dd
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14016e8ef
call fcn.1402bcebc
mov qword [rbx + 8], rbp
mov rcx, rbx
call fcn.14021ae20
test edi, edi
je 0x14016e90f
mov r8, qword [rsi + 0x68]
mov edx, edi
lea rcx, str.RepairWMI:__08X__ls_r_n
call fcn.1402bd818
test edi, edi
sete bl
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14016e925
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14016e938
mov rdx, qword [rcx]
call qword [rdx + 0x10]
movzx eax, bl
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140172980
Capabilities:
Print debug messages
Write file on windows

Disassembly:
test rdx, rdx
je 0x140172bb4
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ebx, ecx
lea rsi, [rbp + 0x77]
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, str.INFO
lea rdi, str.WARN
cmp ebx, 2
cmovne rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rbp + 0x25]
movzx edx, word [rbp + 0x23]
movzx r10d, word [rbp + 0x21]
movzx r11d, word [rbp + 0x1f]
movzx ebx, word [rbp + 0x1d]
movzx r9d, word [rbp + 0x19]
movzx r8d, word [rbp + 0x17]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
lea rdx, str._4d__02d__02dT_02d:_02d:_02d._03dZ___5u___ls
lea rcx, [rbp - 1]
call fcn.140202d40
nop
mov r8, rsi
mov rdx, qword [rbp + 0x6f]
lea rcx, [rbp - 0x19]
call fcn.140202de0
nop
mov r8, qword [rbp - 1]
lea rcx, [rbp - 0x19]
call fcn.140203770
lea rdx, [0x14034d704]
lea rcx, [rbp - 0x19]
call fcn.140200ef0
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, dword [rbp - 0xd]
mov r8, qword [rbp - 0x19]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
test eax, eax
jle 0x140172b7c
mov rcx, rdi
call fcn.1402bd120
mov rbx, rax
test rax, rax
je 0x140172b7c
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0xd]
mov r8, qword [rbp - 0x19]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov ecx, dword [0x140433418]
test cl, 1
jne 0x140172b1c
or ecx, 1
mov dword [0x140433418], ecx
lea rdx, str.LogsSophosClean.log
lea rcx, [0x140433420]
call fcn.1400f41b0
lea rcx, [0x1403054a0]
call fcn.1402be804
nop
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
mov rcx, qword [0x140433420]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140172b73
mov qword [rsp + 0x20], r14
lea r9, [rbp - 9]
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x11], 0
jle 0x140172b8c
mov rcx, qword [rbp - 0x19]
call fcn.1402bd0e0
nop
cmp dword [rbp + 7], 0
jle 0x140172b9b
mov rcx, qword [rbp - 1]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140172989
Capabilities:
Print debug messages
Write file on windows

Disassembly:
test rdx, rdx
je 0x140172bb4
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ebx, ecx
lea rsi, [rbp + 0x77]
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, str.INFO
lea rdi, str.WARN
cmp ebx, 2
cmovne rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rbp + 0x25]
movzx edx, word [rbp + 0x23]
movzx r10d, word [rbp + 0x21]
movzx r11d, word [rbp + 0x1f]
movzx ebx, word [rbp + 0x1d]
movzx r9d, word [rbp + 0x19]
movzx r8d, word [rbp + 0x17]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
lea rdx, str._4d__02d__02dT_02d:_02d:_02d._03dZ___5u___ls
lea rcx, [rbp - 1]
call fcn.140202d40
nop
mov r8, rsi
mov rdx, qword [rbp + 0x6f]
lea rcx, [rbp - 0x19]
call fcn.140202de0
nop
mov r8, qword [rbp - 1]
lea rcx, [rbp - 0x19]
call fcn.140203770
lea rdx, [0x14034d704]
lea rcx, [rbp - 0x19]
call fcn.140200ef0
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, dword [rbp - 0xd]
mov r8, qword [rbp - 0x19]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
test eax, eax
jle 0x140172b7c
mov rcx, rdi
call fcn.1402bd120
mov rbx, rax
test rax, rax
je 0x140172b7c
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0xd]
mov r8, qword [rbp - 0x19]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov ecx, dword [0x140433418]
test cl, 1
jne 0x140172b1c
or ecx, 1
mov dword [0x140433418], ecx
lea rdx, str.LogsSophosClean.log
lea rcx, [0x140433420]
call fcn.1400f41b0
lea rcx, [0x1403054a0]
call fcn.1402be804
nop
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
mov rcx, qword [0x140433420]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140172b73
mov qword [rsp + 0x20], r14
lea r9, [rbp - 9]
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1402bd0e0
nop
cmp dword [rbp - 0x11], 0
jle 0x140172b8c
mov rcx, qword [rbp - 0x19]
call fcn.1402bd0e0
nop
cmp dword [rbp + 7], 0
jle 0x140172b9b
mov rcx, qword [rbp - 1]
call fcn.1402bd0e0
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140172fb0
Capabilities:
Set registry value
Terminate process

Disassembly:
push rbx
sub rsp, 0x60
lea r8, str.SophosClean.exe
lea rdx, str.Starting__ls...
mov ecx, 1
call fcn.140172980
mov rbx, qword [0x140430d70]
lea rdx, [0x14034d1a0]
lea rcx, [rbx + 0x40]
xor r8d, r8d
call fcn.1400ce190
lea rdx, str._clean__quiet
mov rcx, rbx
mov byte [rbx + 0xe8], 0
call fcn.140299950
test al, al
mov rax, qword [0x140430d70]
jne 0x140173044
movups xmm0, xmmword [rax + 0x40]
movups xmm1, xmmword [rax + 0x50]
lea r8, [rsp + 0x40]
lea rdx, str.An_error_occurred:__ls
mov ecx, 2
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
call fcn.140172980
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
add rsp, 0x60
pop rbx
ret
mov r9d, dword [rax + 0xa0]
lea r8, str.SophosClean.exe
lea rdx, str._ls_started__PID__u_.
mov ecx, 1
call fcn.140172980
xor ecx, ecx
call fcn.140173de0
mov rcx, qword [0x140430d58]
lea rax, [rsp + 0x70]
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [0x140430d70]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x140430d68]
lea r8, str.SophosClean.exe
lea rdx, str.Waiting_for__ls_to_finish...
mov ecx, 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
call fcn.140172980
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x14017316d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r9d, dword [rsp + 0x70]
lea r8, str.SophosClean.exe
lea rdx, str._ls_process_closed__exit_code__d_.
mov ecx, 1
call fcn.140172980
mov edx, dword [rsp + 0x70]
test edx, edx
je 0x14017312b
cmp edx, 5
jne 0x14017313e
mov ecx, 1
call fcn.140173de0
call fcn.1401757c0
mov edx, dword [rsp + 0x70]
lea eax, [rdx + 1]
test eax, 0xfffffffd
jne 0x140173156
mov ecx, 1
call fcn.140173de0
mov edx, dword [rsp + 0x70]
cmp edx, 5
jne 0x140173160
call fcn.140173ca0
call fcn.1401731a0
mov al, 1
add rsp, 0x60
pop rbx
ret
mov rax, qword [0x140430d70]
lea rdx, str.Service_is_stopping._Terminating_PID__u.
mov ecx, 1
mov r8d, dword [rax + 0xa0]
call fcn.140172980
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x1401731a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x80
lea rax, [r11 + 0x18]
xor ebx, ebx
lea r9, [r11 - 0x58]
mov dword [rsp + 0x90], ebx
mov rcx, qword [0x140430d58]
mov qword [r11 - 0x60], rax
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
xor r8d, r8d
mov dword [r11 + 8], ebx
mov dword [r11 + 0x18], 4
mov qword [r11 - 0x68], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140173202
cmp dword [rsp + 0x90], ebx
setne al
test al, al
jne 0x140173376
mov rcx, qword [0x140430d58]
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0x34]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
lea rdx, str.UIScan
xor r8d, r8d
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0xa8], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140173376
cmp dword [rsp + 0x98], ebx
setne al
test al, al
je 0x140173376
lea r8, str.SophosClean.exe
lea rdx, str.Scan_finished__Set_UIScan_value_and_LastUIScanTime.
mov ecx, 1
mov qword [rsp + 0x78], rdi
call fcn.140172980
lea rcx, [rsp + 0x50]
call fcn.1400ec3f0
cmp dword [rax + 0x10], 1
je 0x1401732a7
lea rdx, [rsp + 0x38]
mov rcx, rax
mov ebx, 1
call fcn.140172920
mov rdi, qword [rax + 8]
lea rcx, vtable.Core::DateTime.0
test bl, 1
mov rax, rcx
mov qword [rsp + 0x50], rcx
mov rcx, qword [0x140430d58]
cmove rax, qword [rsp + 0x38]
lea rdx, str.UIScan
mov r9d, 4
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x90]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movabs rcx, 0xfe624e212ac18000
add rcx, rdi
movabs rax, 0xd6bf94d5e57a42bd
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
imul rcx
add rdx, rcx
mov rcx, qword [0x140430d58]
mov rcx, qword [rcx + 8]
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rsp + 0x98]
mov dword [rsp + 0x98], edx
lea rdx, str.LastUIScanTime
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x78]
add rsp, 0x80
pop rbx
ret
Function at 0x1401736e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x38], rax
lea edx, [rax + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1402028a0
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
mov r9d, 0xc
lea r8, str.SophosClean
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, 0xc
lea rcx, [rsp + 0x30]
call fcn.140203bb0
nop
mov edx, 0x26
lea rcx, [rsp + 0x50]
call fcn.14020e790
nop
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rbx
call fcn.1400d4050
mov dword [rsp + 0x20], 1
cmp dword [rsp + 0x58], 0
jle 0x140173778
mov rcx, qword [rsp + 0x50]
call fcn.1402bd0e0
nop
cmp dword [rsp + 0x38], 0
jle 0x140173789
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1402053e0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401737bd
test al, 0x10
je 0x1401737bd
cmp dword [rsp + 0x48], 0
jle 0x1401737dc
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
jmp 0x1401737dc
cmp dword [rsp + 0x48], 0
jle 0x1401737ce
mov rcx, qword [rsp + 0x40]
call fcn.1402bd0e0
xor r8d, r8d
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rax, rbx
add rsp, 0x60
pop rbx
ret
Function at 0x140173b80
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x140173c80
lea rdx, str.Sophos_Clean_Service
mov r8d, 0x10020
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x140173bf2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
jne 0x140173c72
mov bl, 1
jmp 0x140173c72
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140173c37
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x426
je 0x140173c37
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x14035f038]
lea rdx, str._ls___failed__error__d_
mov r9d, eax
mov ecx, 2
call fcn.140172980
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x140173c48
mov bl, 1
jmp 0x140173c69
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [0x14035f0e0]
lea rdx, str._ls___failed__error__d_
mov r9d, eax
mov ecx, 2
call fcn.140172980
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x60]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret