joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ea65
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xffffffffffffffff
lea rax, [0x14001e88b]
mov rdx, rax
lea rax, [0x140032dc0]
mov rcx, rax
call fcn.14001de96
mov eax, dword [0x1400284f0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001eab8
mov rax, qword [rbp - 0x10]
jmp 0x14001ec18
call fcn.14001d600
mov qword [rbp - 0x10], rax
mov rax, qword [0x140035050]
test rax, rax
je 0x14001ead4
cmp qword [rbp - 0x10], 0
jne 0x14001eade
mov eax, 0
jmp 0x14001ec18
mov rax, qword [rbp - 0x10]
mov dword [rax + 0x44], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0x70], eax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 0x30], rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 0x10]
lea rcx, [rax + 0x68]
mov rax, qword [rbp - 8]
mov rdx, rax
call fcn.14001d724
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xb8], 0
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
lea rdi, [rax + 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov rsi, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rax
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DuplicateHandle]
call rax
test eax, eax
jne 0x14001ebb9
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadPriority]
call rax
mov rdx, qword [rbp - 0x10]
mov dword [rdx + 0xc0], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 0
mov rax, qword [rbp - 0x10]
movzx edx, byte [rax + 0x40]
and edx, 0xffffffcf
or edx, 0x10
mov byte [rax + 0x40], dl
mov eax, dword [0x1400284f0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
test eax, eax
jne 0x14001ec14
call sub.msvcrt.dll_abort
mov rax, qword [rbp - 0x10]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x14001ed12
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp - 0x10], 0
mov rax, qword [rbp + 0x10]
mov dword [rbp - 4], eax
call fcn.14001ea65
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rdx, qword [rbp + 0x10]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 0x18]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call fcn.14001e8b9
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 0x40]
and eax, 0x30
test al, al
jne 0x14001ed7f
mov rax, qword [rbp - 0x18]
add rax, 0xd0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll_longjmp]
call rax
mov eax, dword [0x1400284f0]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x14001eec3
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14001ee1c
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001edd7
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001d4dc
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400284f0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14001eec3
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 8]
mov dword [rbp - 4], eax
mov rax, qword [rbp - 0x10]
mov dword [rax + 0xbc], 1
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001ee56
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x44]
and eax, 4
test eax, eax
je 0x14001eec3
mov rax, qword [rbp - 0x10]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 0x10]
mov rax, qword [rax + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x10]
mov qword [rax + 0x28], 0
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.14001d4dc
mov qword [rbp - 0x10], 0
mov eax, dword [0x1400284f0]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov eax, dword [rbp - 4]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x1400011b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, edx
mov r9, rcx
test rcx, rcx
je 0x1400012ae
test r8, r8
je 0x1400012ae
lea rbx, [r8 + 0x50]
test edx, edx
je 0x1400012a1
mov edx, 2
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea r11, [r8 + 3]
cmp r11, rbx
ja 0x1400012ae
lea eax, [rdx - 2]
mov ecx, eax
movzx eax, byte [rax + r9]
shr rax, 2
mov al, byte [rax + rsi]
mov byte [r8], al
lea eax, [rdx - 1]
movzx edi, byte [rcx + r9]
and edi, 3
shl rdi, 4
cmp eax, r10d
jae 0x14000127e
mov ecx, eax
movzx eax, byte [rax + r9]
shr rax, 4
or rax, rdi
mov al, byte [rax + rsi]
mov byte [r8 + 1], al
movzx eax, byte [rcx + r9]
and eax, 0xf
lea rdi, [rax*4]
cmp edx, r10d
jae 0x140001270
mov ecx, edx
movzx eax, byte [rcx + r9]
shr rax, 6
or rax, rdi
mov al, byte [rax + rsi]
mov byte [r8 + 2], al
movzx eax, byte [rcx + r9]
and eax, 0x3f
mov cl, byte [rax + rsi]
jmp 0x140001279
mov al, byte [rdi + rsi]
mov cl, 0x3d
mov byte [r8 + 2], al
mov byte [r11], cl
jmp 0x14000128e
mov al, byte [rdi + rsi]
mov byte [r8 + 1], al
mov byte [r8 + 2], 0x3d
mov byte [r11], 0x3d
add edx, 3
add r8, 4
lea eax, [rdx - 2]
cmp eax, r10d
jb 0x1400011ef
cmp r8, rbx
ja 0x1400012ae
mov byte [r8], 0
mov al, 1
jmp 0x1400012b0
xor al, al
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140003184
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x1338]
mov eax, 0x1430
call fcn.1400c8e90
sub rsp, rax
mov rax, qword [0x1400fd010]
xor rax, rsp
mov qword [rbp + 0x1320], rax
mov rdi, rcx
mov qword [rsp + 0x58], rcx
call fcn.14004b9a0
mov edx, eax
or r9d, 0xffffffff
mov dword [rbp + 0x12e4], r9d
mov dword [rsp + 0x64], eax
mov ecx, 1
mov r8d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x64], edx
inc rcx
cmp rcx, r8
jb 0x1400031e2
mov dword [rsp + 0x60], r8d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x20
mov dword [rsp + 0x50], r9d
lea rcx, [rsp + 0x40]
call fcn.140007014
mov r8d, eax
btr r8d, 0x1f
lea r9, [rbp + 0x131a]
xor esi, esi
sub r9, 2
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140003235
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], si
lea rax, [rbp + 0x131a]
cmp r9, rax
je 0x1400032c5
lea rdx, [rbp + 0x131a]
sub rdx, r9
sar rdx, 1
lfence
lea rcx, [rsp + 0x20]
cmp rdx, 7
ja 0x1400032bf
mov qword [rsp + 0x30], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.140072f00
mov word [rsp + rbx + 0x20], si
jmp 0x1400032c5
call fcn.140005880
nop
lea r8, [rsp + 0x20]
lea rdx, str.SEDRecoveryService_
mov rcx, rdi
call fcn.1400053cc
nop
lea rcx, [rsp + 0x20]
call fcn.140004904
mov rax, rdi
mov rcx, qword [rbp + 0x1320]
xor rcx, rsp
call fcn.1400494a0
lea r11, [rsp + 0x1430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140007014
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rbx, rcx
mov esi, 0x7fffffff
mov ebp, 0x9908b0df
mov r9, qword [rbx]
mov r8d, dword [r9]
cmp r8d, 0x270
jne 0x140007084
lea r8, [r9 + 8]
mov r10d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, esi
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140007049
mov r8d, dword [r9]
jmp 0x140007152
cmp r8d, 0x4e0
jb 0x140007152
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400070a1
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400070e6
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, esi
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
xor r8d, r8d
mov eax, r8d
mov edx, dword [r9 + rax*4 + 4]
mov ecx, edx
lea eax, [r8 + 1]
shr ecx, 0xb
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [rbx + 0x10]
ja 0x140007030
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
ret
Function at 0x140007878
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400fd010]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov rdi, rcx
mov qword [rbp - 0x20], rbx
mov dword [rbp - 0x18], ebx
test rcx, rcx
je 0x14000793a
lea rax, [rbp - 0x20]
xor r8d, r8d
lea r9d, [rbx + 1]
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesSophos_Endpoint_Defense
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 5
je 0x14000793a
test eax, eax
je 0x1400078e0
mov byte [rdi], bl
mov al, 1
jmp 0x14000793c
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SetupFlags
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007926
cmp dword [rbp - 0x10], 4
jne 0x140007926
cmp dword [rbp - 0x14], 4
jne 0x140007926
mov ebx, dword [rbp - 0x18]
jmp 0x140007929
mov dword [rbp - 0x18], ebx
mov rcx, qword [rbp - 0x20]
and bl, 1
mov byte [rdi], bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400078dc
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400494a0
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret

Function at 0x140007958
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400fd010]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x20], 0
mov rbx, rcx
and dword [rbp - 0x18], 0
test rcx, rcx
je 0x140007a1c
lea rax, [rbp - 0x20]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesSophos_Endpoint_DefenseEndpointFlags
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 5
je 0x140007a1c
test eax, eax
je 0x1400079be
mov byte [rbx], 0
mov al, 1
jmp 0x140007a1e
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x14]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x18]
mov dword [rbp - 0x14], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.sed.tpsafeboot.available
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007a04
cmp dword [rbp - 0x10], 4
jne 0x140007a04
cmp dword [rbp - 0x14], 4
jne 0x140007a04
mov eax, dword [rbp - 0x18]
jmp 0x140007a09
xor eax, eax
mov dword [rbp - 0x18], eax
mov rcx, qword [rbp - 0x20]
test eax, eax
setne al
mov byte [rbx], al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400079ba
xor al, al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400494a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140007a38
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400fd010]
xor rax, rsp
mov qword [rbp - 0x10], rax
and qword [rbp - 0x30], 0
mov rdi, r8
and dword [rbp - 0x20], 0
mov rbx, rdx
and dword [rbp - 0x1c], 0
mov rsi, rcx
and dword [rbp - 0x18], 0
test rcx, rcx
je 0x140007bce
test rdx, rdx
je 0x140007bce
test r8, r8
je 0x140007bce
lea rax, [rbp - 0x30]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesSophos_Endpoint_DefenseTamperProtectionConfig
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 5
je 0x140007bce
test eax, eax
je 0x140007acc
mov byte [rsi], 0
mov byte [rbx], 0
mov byte [rdi], 0
mov al, 1
jmp 0x140007bd0
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x24]
lea rax, [rbp - 0x20]
mov r15d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SEDEnabled
mov dword [rbp - 0x28], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007b15
cmp dword [rbp - 0x24], r15d
jne 0x140007b15
cmp dword [rbp - 0x28], r15d
jne 0x140007b15
mov eax, dword [rbp - 0x20]
jmp 0x140007b1a
xor eax, eax
mov dword [rbp - 0x20], eax
test eax, eax
lea r9, [rbp - 0x24]
lea rdx, str.IgnoreSAV
setne al
xor r8d, r8d
mov byte [rbx], al
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x28], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007b64
cmp dword [rbp - 0x24], r15d
jne 0x140007b64
cmp dword [rbp - 0x28], r15d
jne 0x140007b64
mov eax, dword [rbp - 0x1c]
jmp 0x140007b69
xor eax, eax
mov dword [rbp - 0x1c], eax
test eax, eax
lea r9, [rbp - 0x24]
lea rdx, str.SAVEnabled
setne al
xor r8d, r8d
mov byte [rdi], al
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x28], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007bb3
cmp dword [rbp - 0x24], r15d
jne 0x140007bb3
cmp dword [rbp - 0x28], r15d
jne 0x140007bb3
mov eax, dword [rbp - 0x18]
jmp 0x140007bb8
xor eax, eax
mov dword [rbp - 0x18], eax
test eax, eax
setne al
mov byte [rsi], al
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140007ac5
xor al, al
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400494a0
add rsp, 0x60
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140008208
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400fd010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov eax, dword [0x1400e44d8]
lea rdx, str.SYSTEMCurrentControlSetServicesSophos_Endpoint_DefenseTamperProtectionComponentsHOME
movups xmm0, xmmword [str.SophosUI.exe_]
xor ebx, ebx
mov dword [rsp + 0x58], eax
movsd xmm1, qword [0x1400e44d0]
lea rax, [r11 - 0x48]
xor r8d, r8d
mov qword [r11 - 0x48], rbx
mov rcx, 0xffffffff80000002
movsd qword [rsp + 0x50], xmm1
lea r9d, [rbx + 1]
mov qword [r11 - 0x58], rax
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008320
mov ecx, 0x208
call fcn.1400948dc
mov rdi, rax
test rax, rax
je 0x140008320
lea rcx, [rax + 2]
xor edx, edx
mov r8d, 0x206
call fcn.1400735b0
lea eax, [rbx + 0x22]
xor r8d, r8d
mov word [rdi], ax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea rax, [rdi + 2]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x3c]
lea rdx, str.IntegrityPath
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0x202
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008318
cmp dword [rsp + 0x3c], 1
jne 0x140008318
lea edx, [rbx + 0x5c]
mov rcx, rdi
call fcn.140072bd4
test rax, rax
je 0x140008318
lea r9d, [rbx + 0xd]
mov word [rax + 2], bx
lea r8, [rsp + 0x40]
mov edx, 0x103
mov rcx, rdi
call fcn.140093ca0
test eax, eax
jne 0x140008318
mov rbx, rdi
jmp 0x140008320
mov rcx, rdi
call fcn.1400924bc
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400494a0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14001aab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400fd010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r9
mov rbx, r8
mov eax, dword [r9]
add eax, eax
mov dword [rsp + 0x30], eax
xor esi, esi
mov dword [r9], esi
lea rax, [r11 - 0x28]
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
lea r9, [r11 - 0x24]
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ab2b
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
ja 0x14001ab26
mov ecx, dword [rsp + 0x30]
test rbx, rbx
je 0x14001ab43
test ecx, ecx
je 0x14001ab40
test cl, 1
jne 0x14001ab26
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x14001ab43
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400494a0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov word [rbx], si
shr ecx, 1
mov dword [rdi], ecx
xor eax, eax
jmp 0x14001ab2b
Function at 0x140022000
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
test rcx, rcx
je 0x14002219d
cmp qword [rcx + 0x98], 0
je 0x14002219d
lea r8, str.Starting_communications_threads...
mov edx, 1
mov ecx, 0x10000
call fcn.140027720
xor r14d, r14d
mov esi, r14d
cmp r14d, dword [rbp + 0x90]
jae 0x1400220f5
nop dword [rax + rax]
mov rax, qword [rbp + 0x98]
mov ecx, esi
mov rbx, qword [rax + rcx*8]
test rbx, rbx
je 0x1400220ef
mov r15, qword [rbx + 0x38]
test r15, r15
je 0x1400220ef
lea rcx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [rbx + 0x88], 1
lea rcx, [rbx + 0x60]
je 0x1400220e9
mov byte [rbx + 0x88], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rbx + 0x40]
lea rax, [r15 + 0x10]
mov r8, qword [rbx + 0x48]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r15 + 8], rax
test rax, rax
je 0x1400220d4
inc esi
cmp esi, dword [rbp + 0x90]
jb 0x140022060
jmp 0x1400220ef
lea rcx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbx + 0x60]
mov byte [rbx + 0x88], r14b
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, dword [rbp + 0x90]
jne 0x1400220fe
mov al, 1
jmp 0x14002219f
test esi, esi
je 0x140022145
mov qword [rsp + 0x50], r12
mov r15, r14
mov r12d, esi
nop dword [rax]
mov rax, qword [rbp + 0x98]
mov rbx, qword [r15 + rax]
lea rcx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbx + 0x60]
mov byte [rbx + 0x88], r14b
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r15, [r15 + 8]
sub r12, 1
jne 0x140022110
mov r12, qword [rsp + 0x50]
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x14002215a
mov rax, qword [rbp + 0x28]
xor edx, edx
call qword [0x1400ce5a8]
test esi, esi
je 0x14002219d
mov edi, esi
mov rax, qword [rbp + 0x98]
mov rbx, qword [r14 + rax]
test rbx, rbx
je 0x140022193
mov rbx, qword [rbx + 0x38]
test rbx, rbx
je 0x140022193
cmp qword [rbx + 8], 0
je 0x140022193
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140022180
add r14, 8
sub rdi, 1
jne 0x140022160
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1400a2b44
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400a28d8
Function at 0x1400b878c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400b87bc
xor eax, eax
jmp 0x1400b887f
mov rbp, rbx
cmp word [rax], si
je 0x1400b87e1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400b87c8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400b87c4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400b8680
movsxd r14, eax
test eax, eax
jne 0x1400b881f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400b87b5
mov rcx, r14
call fcn.1400ad0ac
mov rdi, rax
test rax, rax
jne 0x1400b8838
xor ecx, ecx
call fcn.1400ad070
jmp 0x1400b8814
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400b8680
test eax, eax
jne 0x1400b8869
mov rcx, rdi
call fcn.1400ad070
jmp 0x1400b8873
xor ecx, ecx
call fcn.1400ad070
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400b889c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400b8923
mov rsi, rbx
cmp word [rax], bp
je 0x1400b88e2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400b88cc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400b88c8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400ad0ac
mov rdi, rax
test rax, rax
je 0x1400b8910
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140072f00
mov rbp, rdi
xor ecx, ecx
call fcn.1400ad070
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret