joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140296430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov eax, dword [r8]
mov rdi, r8
lea rsi, [0x140000000]
not eax
mov r11d, edx
mov r10, rcx
cmp edx, 0xf
jl 0x14029653a
mov r9d, ecx
mov qword [rsp + 0x10], rbx
and r9d, 7
je 0x140296493
neg r9d
and r9d, 7
sub r11d, r9d
nop dword [rax]
movzx edx, byte [r10]
mov ecx, eax
xor rdx, rcx
inc r10
shr ecx, 8
movzx r8d, dl
mov eax, dword [rsi + r8*4 + 0x32a080]
xor eax, ecx
sub r9d, 1
jne 0x140296470
mov ebx, r11d
sar ebx, 3
and r11d, 7
nop dword [rax]
mov rdx, qword [r10]
add r10, 8
mov ecx, eax
mov r9, rdx
shr r9, 0x20
mov r8d, edx
xor r8, rcx
mov rax, r8
shr rax, 0x10
movzx edx, al
mov rax, r8
shr rax, 8
movzx ecx, al
mov eax, dword [rsi + rdx*4 + 0x335c00]
xor eax, dword [rsi + rcx*4 + 0x34ade0]
mov rcx, r9
shr rcx, 0x10
movzx edx, cl
mov rcx, r9
shr rcx, 8
xor eax, dword [rsi + rdx*4 + 0x336400]
movzx edx, cl
mov rcx, r8
shr rcx, 0x18
xor eax, dword [rsi + rdx*4 + 0x337000]
xor eax, dword [rsi + rcx*4 + 0x336000]
mov rcx, r9
shr rcx, 0x18
xor eax, dword [rsi + rcx*4 + 0x32a080]
movzx ecx, r8b
xor eax, dword [rsi + rcx*4 + 0x34a9e0]
movzx ecx, r9b
xor eax, dword [rsi + rcx*4 + 0x336800]
sub ebx, 1
jne 0x1402964a0
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x140296564
nop
movzx edx, byte [r10]
lea r10, [r10 + 1]
mov ecx, eax
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [rsi + r8*4 + 0x32a080]
xor eax, ecx
sub r11d, 1
jne 0x140296540
mov rsi, qword [rsp + 0x18]
not eax
mov dword [rdi], eax
pop rdi
ret
Function at 0x140297c48
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov esi, r8d
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x140297d38
test edx, edx
je 0x140297d38
cmp r8d, 0x80
jae 0x140297d38
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140297c8f
mov eax, ebp
jmp 0x140297d3d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
cmp eax, 0xb7
je 0x140297c88
cmp eax, 3
je 0x140297cb5
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x140297d3d
lea rax, [rsp + 0x50]
mov edx, 0x5c
mov qword [rsp + 0x28], rax
mov r8d, edi
lea rax, [rsp + 0x68]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140297618
test eax, eax
js 0x140297d3d
cmp dword [rsp + 0x50], ebp
jne 0x140297cea
mov eax, 0x80070003
jmp 0x140297d3d
mov edx, dword [rsp + 0x68]
lea r8d, [rsi + 1]
mov rcx, rbx
mov edi, edx
mov word [rbx + rdx*2], bp
call fcn.140297c48
test eax, eax
js 0x140297d3d
mov eax, 0x5c
xor edx, edx
mov rcx, rbx
mov word [rbx + rdi*2], ax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140297c88
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
cmp eax, 0xb7
je 0x140297c88
jmp 0x140297ca3
mov eax, 0x80070057
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140297dbc
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov qword [r11 + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, dword [rcx + 0x808]
xor edi, edi
mov r13, qword [rcx + 0x800]
mov rbp, r8
mov sil, byte [rcx + 0x80c]
mov rbx, rcx
mov dword [rsp + 0x38], eax
test r8, r8
je 0x140297f2a
mov r14b, byte [r11 + 0xb]
lea r9, [0x14032a080]
mov r15b, byte [r11 + 0xa]
mov r12b, byte [r11 + 9]
mov cl, byte [rdi + rdx]
cmp cl, sil
jne 0x140297e2c
cmp cl, r14b
jne 0x140297e2c
cmp cl, r15b
jne 0x140297e2c
cmp cl, r12b
je 0x140297f0b
movzx edx, cl
movzx eax, r12b
mov byte [rsp + 0x38], al
movzx r12d, r15b
movzx r15d, r14b
mov r11d, dword [r9 + rax*4]
movzx r14d, sil
mov sil, cl
mov r8d, dword [r9 + r12*4]
mov r10d, dword [r9 + r15*4]
mov eax, r10d
shr eax, 8
movzx ecx, al
mov eax, r11d
shr eax, 0x10
movzx eax, al
xor rcx, rax
movzx eax, byte [r9 + rdx*4]
mov r9d, dword [r9 + r14*4]
xor rcx, rax
mov eax, r9d
shr eax, 8
inc qword [rbx + rcx*8]
movzx ecx, al
mov eax, r8d
shr eax, 0x10
movzx eax, al
xor rcx, rax
movzx eax, r11b
xor rcx, rax
shr r11d, 8
lea rax, [0x14032a080]
mov edx, dword [rax + rdx*4]
mov eax, r10d
shr eax, 0x10
inc qword [rbx + rcx*8]
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
xor rcx, rax
shr edx, 0x10
movzx eax, r8b
xor rcx, rax
shr r8d, 8
mov eax, r9d
shr eax, 0x10
inc qword [rbx + rcx*8]
movzx ecx, al
movzx eax, r11b
xor rcx, rax
movzx eax, r10b
xor rcx, rax
movzx eax, dl
mov rdx, qword [rsp + 0x40]
inc qword [rbx + rcx*8]
movzx ecx, r8b
xor rcx, rax
movzx eax, r9b
xor rcx, rax
lea r9, [0x14032a080]
inc qword [rbx + rcx*8]
add r13, 5
inc rdi
cmp rdi, rbp
jb 0x140297e11
mov byte [rsp + 0x3b], r14b
mov byte [rsp + 0x3a], r15b
mov byte [rsp + 0x39], r12b
mov eax, dword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
mov dword [rbx + 0x808], eax
mov byte [rbx + 0x80c], sil
mov qword [rbx + 0x800], r13
mov rbx, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14029cc94
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r8d, dword [rcx]
lea rsi, [rcx + 0x20]
mov r14, rdx
lea rbx, [rcx + 0x60]
mov rdi, rcx
mov ebp, 0x40
mov byte [r8 + rcx + 0x20], 0x80
inc r8d
cmp r8d, 0x38
jbe 0x14029cd06
mov edx, ebp
mov eax, r8d
add rcx, 0x20
sub edx, r8d
add rcx, rax
call fcn.1402b4a50
mov eax, dword [0x14044eb14]
lea r9, [rsp + 0x40]
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
test al, 0x42
jne 0x14029ccfe
call fcn.14029e0c0
jmp 0x14029cd03
call fcn.14029cda8
xor r8d, r8d
mov edx, ebp
mov eax, r8d
lea rcx, [rdi + 0x20]
sub edx, r8d
add rcx, rax
call fcn.1402b4a50
mov rax, qword [rdi + 0x10]
lea r9, [rsp + 0x40]
shl rax, 3
mov r8, rbp
bswap rax
mov qword [rdi + 0x58], rax
mov rdx, rsi
mov eax, dword [0x14044eb14]
mov rcx, rbx
test al, 0x42
jne 0x14029cd48
call fcn.14029e0c0
jmp 0x14029cd4d
call fcn.14029cda8
mov rcx, rbx
mov r8d, 4
mov rax, qword [rcx]
lea rcx, [rcx + 8]
rol rax, 0x20
bswap rax
mov qword [r14], rax
lea r14, [r14 + 8]
sub r8, 1
jne 0x14029cd56
mov edx, 0x80
mov rcx, rdi
call fcn.1402b4a50
movups xmm0, xmmword [0x14034b800]
mov rbp, qword [rsp + 0x50]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x14034b810]
movups xmmword [rbx + 0x10], xmm1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1402a65c8
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
mov r14, rdx
mov rdi, rcx
mov qword [rbp - 0x49], r15
mov rdx, rcx
lea rcx, [rbp - 0x49]
lea r8d, [r15 + 4]
call fcn.1402a63f4
mov esi, eax
test eax, eax
jns 0x1402a664c
cmp qword [rdi + 0x18], 8
jb 0x1402a661e
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x28], rdi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, esi
mov qword [rsp + 0x20], rax
mov edx, 0x113
call fcn.14016b7bc
jmp 0x1402a6731
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp - 0x41]
call qword [sym.imp.api_ms_win_service_winsvc_l1_1_0.dll_QueryServiceStatus]
test eax, eax
jne 0x1402a6690
cmp qword [rdi + 0x18], 8
jb 0x1402a6668
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea r9, str.Cannot_query_service_status_for_service__ls
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov qword [rsp + 0x20], rdi
mov edx, 0x117
call fcn.1401ea930
mov esi, eax
jmp 0x1402a6731
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1402a6728
cmp qword [rdi + 0x18], 8
lea rax, str.Read_current_state_of_service
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x3c
jb 0x1402a66c0
mov rdi, qword [rdi]
lea rcx, [0x14030cae0]
mov rax, r15
test rdi, rdi
je 0x1402a66e0
mov rcx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x1402a66d6
lea eax, [rax*2 + 2]
mov qword [rbp + 0x17], rcx
mov dword [rbp + 0x1f], eax
lea rax, [rbp - 0x3d]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x23], r15d
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a3ecc]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001158
mov eax, dword [rbp - 0x3d]
mov esi, r15d
mov dword [r14], eax
cmp qword [rbp - 0x49], r15
je 0x1402a6741
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0xc0]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1402a6d78
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r14d, r14d
mov dword [rbp - 0x29], edx
mov rdi, rcx
mov qword [rbp - 0x21], r14
mov rdx, rcx
lea rcx, [rbp - 0x21]
lea r8d, [r14 + 2]
call fcn.1402a63f4
mov esi, eax
test eax, eax
jns 0x1402a6df6
cmp qword [rdi + 0x18], 8
jb 0x1402a6dc8
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x28], rdi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, esi
mov qword [rsp + 0x20], rax
mov edx, 0x176
call fcn.14016b7bc
jmp 0x1402a6f05
mov r8d, dword [rbp - 0x29]
or edx, 0xffffffff
mov rcx, qword [rbp - 0x21]
mov r9d, edx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfigW]
test eax, eax
jne 0x1402a6e6a
cmp qword [rdi + 0x18], 8
jb 0x1402a6e3b
mov rdi, qword [rdi]
mov eax, dword [rbp - 0x29]
lea r9, str.Cannot_change_the_service_start_type_to__d_for_service__ws
mov rcx, qword [rbp + 0x5f]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov qword [rsp + 0x28], rdi
mov edx, 0x188
mov dword [rsp + 0x20], eax
call fcn.1401ea930
mov esi, eax
jmp 0x1402a6f05
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1402a6f02
cmp qword [rdi + 0x18], 8
lea rax, str.Changed_the_service_start_type_successfully
mov qword [rbp + 7], rax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x17], rax
mov qword [rbp + 0xf], 0x58
mov qword [rbp + 0x1f], 4
jb 0x1402a6eaa
mov rdi, qword [rdi]
lea rcx, [0x14030cae0]
mov rax, r14
test rdi, rdi
je 0x1402a6eca
mov rcx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1402a6ec0
lea eax, [rax*2 + 2]
mov qword [rbp + 0x27], rcx
mov dword [rbp + 0x2f], eax
mov dword [rbp + 0x33], r14d
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a3f72]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001158
mov esi, r14d
cmp qword [rbp - 0x21], r14
je 0x1402a6f15
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, esi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402ae860
mov rsi, qword [rsp + 0x100]
add rsp, 0xd0
pop r14
pop rdi
pop rbp
ret
Function at 0x1402a7200
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14b, dl
mov rdi, rcx
lea rdx, [rbp - 0x45]
call fcn.1402a7418
xor r15d, r15d
mov ebx, eax
test eax, eax
jns 0x1402a7278
cmp qword [rdi + 0x18], 8
jb 0x1402a7248
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Failed_to_query_launch_protected_level_of_service__ws
mov qword [rsp + 0x28], rdi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov edx, 0x204
call fcn.14016b7bc
mov eax, ebx
jmp 0x1402a73f2
mov r8d, 2
mov qword [rbp - 0x41], r15
mov rdx, rdi
lea rcx, [rbp - 0x41]
call fcn.1402a63f4
mov esi, eax
test eax, eax
jns 0x1402a72d0
cmp qword [rdi + 0x18], 8
jb 0x1402a729e
mov rdi, qword [rdi]
mov rcx, qword [rbp + 0x5f]
lea rax, str.Could_not_get_handle_for_service__ws
mov qword [rsp + 0x28], rdi
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov r9d, esi
mov qword [rsp + 0x20], rax
mov edx, 0x207
call fcn.14016b7bc
mov rbx, qword [rbp - 0x41]
jmp 0x1402a73e2
mov rbx, qword [rbp - 0x41]
movzx eax, r14b
add eax, eax
mov dword [rbp - 0x49], eax
cmp dword [rbp - 0x45], eax
je 0x1402a73df
call fcn.14004acb4
mov ecx, 4
mov r10, qword [rax + 8]
cmp dword [r10], ecx
jbe 0x1402a738d
cmp qword [rdi + 0x18], 8
lea rax, str.Change_the_service_protection_level
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x45]
mov qword [rbp - 9], rax
lea rax, [rbp - 0x49]
mov qword [rbp + 7], rax
mov rax, rdi
mov qword [rbp - 0x11], VarR8FromUI1
mov qword [rbp - 1], rcx
mov qword [rbp + 0xf], rcx
jb 0x1402a7335
mov rax, qword [rdi]
lea rdx, [0x14030cae0]
mov rcx, r15
test rax, rax
je 0x1402a7355
mov rdx, rax
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r15w
jne 0x1402a734b
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x17], rdx
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], r15d
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a3fe1]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001158
mov eax, dword [rbp - 0x49]
lea r8, [rbp - 0x41]
mov edx, SafeArrayGetDim
mov dword [rbp - 0x41], eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l2_1_0.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x1402a73df
cmp qword [rdi + 0x18], 8
jb 0x1402a73b3
mov rdi, qword [rdi]
mov eax, dword [rbp - 0x49]
lea r9, str.Failed_to_change_the_service__ws_launch_protected_level_to__d.
mov rcx, qword [rbp + 0x5f]
lea r8, str.amcorewcd_sourcecommon_src_serviceutils.cpp
mov dword [rsp + 0x28], eax
mov edx, 0x21b
mov qword [rsp + 0x20], rdi
call fcn.1401ea930
mov esi, eax
jmp 0x1402a73e2
mov esi, r15d
test rbx, rbx
je 0x1402a73f0
mov rcx, rbx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov eax, esi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1402ae860
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402a97a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x18], 8
jb 0x1402a97e9
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402a993a
test al, 0x10
jne 0x1402a993a
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.1401d92a4
nop
xor ebx, ebx
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], rbx
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x39]
call fcn.1401d8730
test al, al
jne 0x1402a9908
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1402a992a
mov dword [rbp - 0x49], 0x8000ffff
lea rax, [rbp - 0x49]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 4
lea rax, str.Failed_to_analyze_version_of_tool
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], 0x44
cmp qword [rdi + 0x18], 8
jb 0x1402a9873
mov rdi, qword [rdi]
lea rdx, [0x14030cae0]
mov r8, rdx
mov rax, rbx
or rcx, 0xffffffffffffffff
test rdi, rdi
je 0x1402a9898
mov r8, rdi
mov rax, rcx
inc rax
cmp word [rdi + rax*2], bx
jne 0x1402a988f
mov qword [rbp + 0x27], r8
lea eax, [rax*2 + 2]
mov dword [rbp + 0x2f], eax
mov dword [rbp + 0x33], ebx
lea r8, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae r8, qword [rbp - 0x39]
mov rax, rbx
test r8, r8
je 0x1402a98cf
mov rdx, r8
mov rax, rcx
inc rax
cmp word [r8 + rax*2], bx
jne 0x1402a98c5
mov qword [rbp + 0x37], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 0x3f], eax
mov dword [rbp + 0x43], ebx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403a4305]
mov rcx, r10
call fcn.140001158
jmp 0x1402a992a
mov eax, dword [rsi]
cmp eax, dword [rbp - 0x59]
jne 0x1402a9925
mov eax, dword [rsi + 4]
cmp eax, dword [rbp - 0x55]
jne 0x1402a9925
mov eax, dword [rsi + 8]
cmp eax, dword [rbp - 0x51]
jne 0x1402a9925
mov eax, dword [rsi + 0xc]
cmp eax, dword [rbp - 0x4d]
setae al
mov bl, al
lea rcx, [rbp - 0x39]
call fcn.14004b500
mov al, bl
jmp 0x1402a99c0
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1402a99be
lea rax, str.Tool_does_not_exist_at_path
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x38
xor ebx, ebx
cmp qword [rdi + 0x18], 8
jb 0x1402a9968
mov rdi, qword [rdi]
lea rdx, [0x14030cae0]
mov rcx, rbx
test rdi, rdi
je 0x1402a9987
mov rdx, rdi
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdi + rcx*2], bx
jne 0x1402a997e
mov qword [rbp + 0x17], rdx
lea eax, [rcx*2 + 2]
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], ebx
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403a43c7]
mov rcx, r10
call fcn.140001158
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1402aa474
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov r8d, 0x104
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
test eax, eax
jne 0x1402aa582
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 2
jbe 0x1402aa573
cmp qword [rbx + 0x18], 8
lea rax, [rbp - 0x29]
mov qword [rbp + 7], rax
lea rax, str.ComputeSenseModuleFullPath_failed
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x25]
mov qword [rbp + 0x27], rax
mov dword [rbp - 0x29], SafeArrayGetDim
mov qword [rbp + 0xf], 4
mov qword [rbp + 0x1f], CloseCompressor
mov dword [rbp - 0x25], edi
mov qword [rbp + 0x2f], 4
jb 0x1402aa51d
mov rbx, qword [rbx]
lea rcx, [0x14030cae0]
mov rax, rsi
test rbx, rbx
je 0x1402aa53c
mov rcx, rbx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], si
jne 0x1402aa533
lea eax, [rax*2 + 2]
mov qword [rbp + 0x37], rcx
mov dword [rbp + 0x3f], eax
mov dword [rbp + 0x43], esi
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a448b]
xor r8d, r8d
mov dword [rsp + 0x20], 6
mov rcx, r10
call fcn.140001158
movzx eax, di
or eax, 0x80070000
test edi, edi
cmovle eax, edi
jmp 0x1402aa5ad
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
mov word [rax], si
cmp qword [rbx + 0x18], 8
jb 0x1402aa59d
mov rbx, qword [rbx]
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call fcn.140043484
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1402aa754
Capabilities:
Check if file exists
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rdx]
add rcx, 0x60
cmp qword [rcx + 0x18], 8
jb 0x1402aa78d
mov rcx, qword [rcx]
mov rdx, qword [rbx]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
test eax, eax
jne 0x1402aa7a6
mov al, 1
jmp 0x1402aa7b4
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFileExistsW]
test eax, eax
sete al
mov byte [rbp - 0x29], al
call fcn.14004acb4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1402aa854
lea rax, str.irrelevantRulesPredicate_returned_with
mov qword [rbp + 0xf], 0x27
mov qword [rbp + 7], rax
mov rax, qword [rdi]
add rax, 0x60
cmp qword [rax + 0x18], 8
jb 0x1402aa7ee
mov rax, qword [rax]
lea rdx, [0x14030cae0]
mov rcx, rsi
test rax, rax
je 0x1402aa80d
mov rdx, rax
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], si
jne 0x1402aa804
lea eax, [rcx*2 + 2]
mov qword [rbp + 0x17], rdx
mov dword [rbp + 0x1f], eax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x23], esi
mov qword [rbp + 0x2f], 1
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403a43f1]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001158
mov al, byte [rbp - 0x29]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402ae860
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402ac37c
Capabilities:
Check if file exists
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
and qword [rcx], 0
lea rsi, [rcx + 8]
and dword [rsi], 0
mov r8d, 0x104
lea rdx, [rbp - 0x60]
lea rcx, str.SystemRoot
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x1402ac44b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsi], eax
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x1402ac528
mov qword [rbp - 0x80], rsi
mov eax, 4
mov dword [rbp - 0x78], eax
and dword [rbp - 0x74], 0
lea rdx, str.The_call_to_get_environment_variable_failed
mov qword [rbp - 0x70], rdx
mov dword [rbp - 0x68], 0x58
and dword [rbp - 0x64], 0
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403a4566]
call fcn.140001158
jmp 0x1402ac528
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.14004a9e4
nop
mov r8d, CreateCompressor
lea rdx, str._system32FirewallAPI.dll
lea rcx, [rsp + 0x40]
call fcn.14005b1c8
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140061d90
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
mov r15, qword [rdi]
test r15, r15
je 0x1402ac4b9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, ebx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov qword [rdi], r14
test r14, r14
jne 0x1402ac51d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rsi], eax
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x1402ac51d
mov qword [rbp - 0x80], rsi
lea eax, [r14 + 4]
mov dword [rbp - 0x78], eax
and dword [rbp - 0x74], r14d
lea rdx, str.Failed_to_load_the_firewall_dll_library
mov qword [rbp - 0x70], rdx
mov dword [rbp - 0x68], 0x50
and dword [rbp - 0x64], r14d
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1403a4566]
call fcn.140001158
nop
lea rcx, [rsp + 0x40]
call fcn.14004b500
nop
mov rax, rdi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1402ae860
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret