joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401647c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
lea rax, vtable.Core::ByteArray.0
mov qword [rbp - 0x50], rax
xor esi, esi
mov dword [rbp - 0x48], esi
mov qword [rbp - 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140206130
mov r11, qword [rbp - 0x40]
test al, al
je 0x140164931
mov eax, dword [rbp - 0x48]
cmp eax, 0x4000
jl 0x140164931
mov r10, r11
mov ecx, 0x5a4d
cmp word [r11], cx
jne 0x140164931
mov dword [rbp - 0x28], 0x6972645c
mov dword [rbp - 0x24], 0x73726576
mov dword [rbp - 0x20], 0x6374655c
mov dword [rbp - 0x1c], 0x736f685c
mov word [rbp - 0x18], 0x7374
mov byte [rbp - 0x16], sil
mov r9d, 0x1000
lea ebx, [rax - 0x400]
cmp ebx, r9d
jle 0x1401648be
nop
mov r8, r10
mov eax, esi
lea rdx, [rbp - 0x28]
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
cmp cl, byte [rdx]
jne 0x1401648b3
cmp eax, 0x12
je 0x140164931
inc eax
inc rdx
movsxd rcx, eax
cmp rcx, 0x13
jb 0x140164890
inc r10
inc r9d
cmp r9d, ebx
jl 0x140164880
lea rax, [0x140346ce0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rsi
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call fcn.140164970
mov rcx, rdi
test al, al
je 0x14016490e
mov edx, dword [rbp - 0x54]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x54]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x60]
mov rcx, qword [rdi]
call fcn.1402ba94c
mov edx, dword [rbp - 0x54]
mov rcx, rdi
call fcn.1401fde50
jmp 0x14016491a
mov rdx, qword [0x140416ee8]
call fcn.1401fafa0
mov bl, 1
cmp dword [rbp - 0x58], 0
jle 0x14016492b
mov rcx, qword [rbp - 0x60]
call fcn.1402b7350
mov r11, qword [rbp - 0x40]
jmp 0x140164933
xor bl, bl
test r11, r11
je 0x140164947
mov r8, r11
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140168e90
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr ax, 8
movzx edx, al
cmp ecx, 5
jne 0x140168ed2
test al, al
jne 0x140168ec6
mov ebx, 0x15f
jmp 0x140168eed
cmp edx, 1
jne 0x140168eed
mov ebx, 0x15f
jmp 0x140168eed
cmp ecx, 6
jne 0x140168eed
test al, al
jne 0x140168ee2
mov ebx, 0x160
jmp 0x140168eed
mov eax, 0x161
cmp edx, 1
cmove ebx, eax
xor ecx, ecx
movzx edx, bx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14016904e
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
mov rax, qword [rdi + 0x90]
mov rcx, qword [rax + 8]
cmp ebp, dword [rcx + 8]
jne 0x14016904a
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14016904a
mov rcx, rax
mov qword [rsp + 0x38], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
mov rax, qword [rdi + 0x90]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140168f70
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rcx, qword [rdi + 0x90]
call fcn.1402150f0
mov ecx, 0x10
call fcn.1402b6dbc
mov ecx, 0x20
mov qword [rdi + 0x90], rax
mov qword [rax], rsi
call fcn.1402b6dbc
test rax, rax
je 0x140168fb0
mov r8d, ebp
mov rdx, r14
mov rcx, rax
call fcn.1400d29d0
mov rsi, rax
mov rax, qword [rdi + 0x90]
mov qword [rax + 8], rsi
mov rax, qword [rdi + 0xa0]
mov rcx, qword [rax + 8]
mov rax, qword [rdi + 0x90]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
add r8, 0x1b8
mov rcx, rbx
movups xmm0, xmmword [r8]
movups xmmword [rdx + 0x1b8], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rdx + 0x1c8], xmm1
movups xmm0, xmmword [r8 + 0x20]
movups xmmword [rdx + 0x1d8], xmm0
movups xmm1, xmmword [r8 + 0x30]
movups xmmword [rdx + 0x1e8], xmm1
mov eax, dword [r8 + 0x40]
mov dword [rdx + 0x1f8], eax
movzx eax, word [r8 + 0x44]
mov word [rdx + 0x1fc], ax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r14, qword [rsp + 0x38]
mov al, 1
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
jmp 0x140169035
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140169060
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx edx, al
shr ax, 8
movzx ecx, al
cmp edx, 5
jne 0x140169091
test al, al
je 0x140169086
cmp ecx, 1
jne 0x1401690b0
mov eax, 0x15f
add rsp, 0x20
pop rbx
ret
cmp edx, 6
jne 0x1401690b0
test al, al
jne 0x1401690a5
mov eax, 0x160
add rsp, 0x20
pop rbx
ret
mov eax, 0x161
cmp ecx, 1
cmove ebx, eax
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14016a0f0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x98]
test rax, rax
je 0x14016a2cd
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x20]
mov r8d, 0xf
mov rbx, qword [rax + 0x10]
mov dword [rsp + 0x20], 0x414e4544
mov dword [rsp + 0x24], 0x445f494c
lea rcx, [rbx + 3]
mov dword [rsp + 0x28], 0x50415441
mov word [rsp + 0x2c], 0x454c
mov byte [rsp + 0x2e], 0x58
call fcn.1402c22d0
test eax, eax
jne 0x14016a169
mov al, 1
jmp 0x14016a2cf
xor edx, edx
mov rcx, rbx
lea edi, [rdx + 0x3b]
mov r8d, edx
mov r9d, edx
mov r10d, edx
mov r11d, edx
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
add r8d, eax
movzx eax, byte [rcx - 3]
add r11d, eax
movzx eax, byte [rcx - 2]
add r10d, eax
movzx eax, byte [rcx - 1]
add r9d, eax
dec rdi
jne 0x14016a180
lea eax, [r9 + r10]
add eax, r11d
add r8d, eax
cmp r8d, 0x67d9
je 0x14016a162
mov r10d, edx
mov r11d, edx
mov r8d, edx
mov r9d, edx
mov edi, edx
mov esi, edx
mov ecx, 8
nop dword [rax]
movzx eax, byte [rbx + rcx]
add rcx, 2
add r10d, eax
not al
movzx eax, al
add r8d, eax
movzx eax, byte [rbx + rcx - 1]
add r11d, eax
not al
movzx eax, al
add r9d, eax
cmp rcx, 0x1b6
jl 0x14016a1d0
cmp rcx, 0x1b7
jge 0x14016a212
movzx edi, byte [rcx + rbx]
movzx eax, dil
not al
movzx esi, al
lea eax, [r11 + r10]
add eax, edi
cmp eax, 0xac47
jne 0x14016a230
lea eax, [r9 + r8]
add eax, esi
cmp eax, 0x1010a
je 0x14016a162
mov r10d, edx
mov r9d, edx
mov r11d, edx
lea r8, [rbx + 8]
mov edi, 0x198
movzx ecx, byte [r8]
lea r8, [r8 + 1]
mov eax, ecx
add r11d, ecx
xor ecx, 0xaa
xor eax, 0x55
add r9d, ecx
add r10d, eax
dec rdi
jne 0x14016a242
cmp r11d, 0xaab2
jne 0x14016a282
cmp r10d, 0xc0f6
jne 0x14016a282
cmp r9d, 0xd572
je 0x14016a162
mov r8d, edx
mov r9d, edx
mov r10d, 0x1a0
nop
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov eax, ecx
add r9d, ecx
xor ecx, 0xaa
xor eax, 0x55
add r8d, ecx
add edx, eax
dec r10
jne 0x14016a290
cmp r9d, 0xabf8
jne 0x14016a2cd
cmp edx, 0xc6a0
jne 0x14016a2cd
cmp r8d, 0xd7c0
je 0x14016a162
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14016a3c0
Capabilities:
Encode data using xor

Disassembly:
cmp qword [rcx + 0x98], 0
jne 0x14016a3c0
xor al, al
ret
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x98]
xor r8d, r8d
mov rbx, rcx
mov rdx, qword [rax + 8]
mov r10d, r8d
mov r9d, r8d
mov rax, qword [rdx + 0x10]
mov r11d, 0x15b
add rax, 0x14
nop dword [rax + rax]
movzx edx, byte [rax]
inc rax
mov ecx, edx
add r8d, edx
xor edx, 0xaa
xor ecx, 0x55
add r9d, edx
add r10d, ecx
dec r11
jne 0x14016a3f0
cmp r8d, 0x97f4
jne 0x14016a4bf
cmp r10d, 0x9463
jne 0x14016a4bf
cmp r9d, 0xc542
jne 0x14016a4bf
lea rcx, [rbx + 0x78]
lea rdx, str.Win64_Bootkit.MBR.Gapz
call fcn.1401fafa0
mov rax, qword [rbx + 0x98]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
movzx eax, byte [rdx + 0x13]
movzx ecx, byte [rdx + 0x12]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0x11]
shl rcx, 8
add rax, rcx
movzx ecx, byte [rdx + 0x10]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0xf]
shl rcx, 8
add rax, rcx
movzx ecx, byte [rdx + 0xe]
shl rax, 8
add rcx, rax
movzx eax, byte [rdx + 0xd]
shl rcx, 8
add rcx, rax
movzx eax, byte [rdx + 0xc]
mov dword [rbx + 0x88], 1
shl rcx, 8
add rcx, rax
mov al, 1
mov qword [rbx + 0xa8], rcx
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14016a4d0
Capabilities:
Move file

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
xor bl, bl
lea rdi, [rcx + 8]
mov rcx, rdi
call fcn.1401bb7e0
lea r8, str..hitmanpro
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1401fb850
nop
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14016a5c4
mov rcx, rdi
call fcn.140205ec0
mov rsi, rax
test rax, rax
je 0x14016a5c4
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x48], rax
mov ebx, 0x13
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.1402050a0
mov rdi, qword [rsp + 0x40]
test al, al
je 0x14016a58c
mov eax, dword [rsp + 0x3c]
inc eax
movsxd rdx, eax
mov r9d, ebx
lea r8, str.127.0.0.1_localhost
mov rcx, rdi
call fcn.1402b8dd0
mov byte [rdi + 0x13], 0
mov dword [rsp + 0x38], ebx
jmp 0x14016a590
mov ebx, dword [rsp + 0x38]
mov rax, qword [rsi]
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x48]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
mov bl, 1
test rdi, rdi
je 0x14016a5c4
mov r8, rdi
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
cmp dword [rsp + 0x30], 0
jle 0x14016a5d5
mov rcx, qword [rsp + 0x28]
call fcn.1402b7350
movzx eax, bl
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14016b910
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov rsi, rcx
xor bl, bl
xor ebp, ebp
mov qword [r11 + 0x20], rbp
mov qword [r11 + 0x18], rbp
lea rax, [r11 + 0x20]
mov qword [r11 - 0x58], rax
lea r9, [0x140309fd8]
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x14030a0a8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14016ba72
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea rdx, str.root_subscription
call qword [rax + 0x18]
test eax, eax
jne 0x14016ba72
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [rbp + 0xa]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jne 0x14016ba72
mov rdx, qword [rsi + 0x68]
lea rcx, [rsp + 0x50]
call fcn.14011c2c0
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x14016b9f6
mov rdx, qword [rdx]
jmp 0x14016b9f9
mov rdx, rbp
mov rcx, qword [rsp + 0x90]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
call qword [rax + 0x80]
mov edi, eax
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14016ba57
lock dec dword [rbx + 0x10]
jne 0x14016ba57
test rbx, rbx
je 0x14016ba57
mov rcx, qword [rbx]
test rcx, rcx
je 0x14016ba3d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14016ba4f
call fcn.1402b712c
mov qword [rbx + 8], rbp
mov rcx, rbx
call fcn.1402150f0
test edi, edi
je 0x14016ba6f
mov r8, qword [rsi + 0x68]
mov edx, edi
lea rcx, str.RepairWMI:__08X__ls_r_n
call fcn.1402b7a88
test edi, edi
sete bl
mov rcx, qword [rsp + 0x90]
test rcx, rcx
je 0x14016ba85
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14016ba98
mov rdx, qword [rcx]
call qword [rdx + 0x10]
movzx eax, bl
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14016fab0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
test rdx, rdx
je 0x14016fce4
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ebx, ecx
lea rsi, [rbp + 0x77]
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, str.INFO
lea rdi, str.WARN
cmp ebx, 2
cmovne rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rbp + 0x25]
movzx edx, word [rbp + 0x23]
movzx r10d, word [rbp + 0x21]
movzx r11d, word [rbp + 0x1f]
movzx ebx, word [rbp + 0x1d]
movzx r9d, word [rbp + 0x19]
movzx r8d, word [rbp + 0x17]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
lea rdx, str._4d__02d__02dT_02d:_02d:_02d._03dZ___5u___ls
lea rcx, [rbp - 1]
call fcn.1401fcfe0
nop
mov r8, rsi
mov rdx, qword [rbp + 0x6f]
lea rcx, [rbp - 0x19]
call fcn.1401fd080
nop
mov r8, qword [rbp - 1]
lea rcx, [rbp - 0x19]
call fcn.1401fda10
lea rdx, [0x140347124]
lea rcx, [rbp - 0x19]
call fcn.1401fb190
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, dword [rbp - 0xd]
mov r8, qword [rbp - 0x19]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
test eax, eax
jle 0x14016fcac
mov rcx, rdi
call fcn.1402b7390
mov rbx, rax
test rax, rax
je 0x14016fcac
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0xd]
mov r8, qword [rbp - 0x19]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov ecx, dword [0x14042b348]
test cl, 1
jne 0x14016fc4c
or ecx, 1
mov dword [0x14042b348], ecx
lea rdx, str.LogsSophosClean.log
lea rcx, [0x14042b350]
call fcn.1400f1930
lea rcx, [0x1402ff1b0]
call fcn.1402b8a74
nop
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
mov rcx, qword [0x14042b350]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14016fca3
mov qword [rsp + 0x20], r14
lea r9, [rbp - 9]
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1402b7350
nop
cmp dword [rbp - 0x11], 0
jle 0x14016fcbc
mov rcx, qword [rbp - 0x19]
call fcn.1402b7350
nop
cmp dword [rbp + 7], 0
jle 0x14016fccb
mov rcx, qword [rbp - 1]
call fcn.1402b7350
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14016fab9
Capabilities:
Print debug messages
Write file on windows

Disassembly:
test rdx, rdx
je 0x14016fce4
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov ebx, ecx
lea rsi, [rbp + 0x77]
lea rcx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rax, str.INFO
lea rdi, str.WARN
cmp ebx, 2
cmovne rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rbp + 0x25]
movzx edx, word [rbp + 0x23]
movzx r10d, word [rbp + 0x21]
movzx r11d, word [rbp + 0x1f]
movzx ebx, word [rbp + 0x1d]
movzx r9d, word [rbp + 0x19]
movzx r8d, word [rbp + 0x17]
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
lea rdx, str._4d__02d__02dT_02d:_02d:_02d._03dZ___5u___ls
lea rcx, [rbp - 1]
call fcn.1401fcfe0
nop
mov r8, rsi
mov rdx, qword [rbp + 0x6f]
lea rcx, [rbp - 0x19]
call fcn.1401fd080
nop
mov r8, qword [rbp - 1]
lea rcx, [rbp - 0x19]
call fcn.1401fda10
lea rdx, [0x140347124]
lea rcx, [rbp - 0x19]
call fcn.1401fb190
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, dword [rbp - 0xd]
mov r8, qword [rbp - 0x19]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
test eax, eax
jle 0x14016fcac
mov rcx, rdi
call fcn.1402b7390
mov rbx, rax
test rax, rax
je 0x14016fcac
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp - 0xd]
mov r8, qword [rbp - 0x19]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
mov ecx, dword [0x14042b348]
test cl, 1
jne 0x14016fc4c
or ecx, 1
mov dword [0x14042b348], ecx
lea rdx, str.LogsSophosClean.log
lea rcx, [0x14042b350]
call fcn.1400f1930
lea rcx, [0x1402ff1b0]
call fcn.1402b8a74
nop
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
lea edx, [r9 + 4]
lea r8d, [r9 + 1]
mov rcx, qword [0x14042b350]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14016fca3
mov qword [rsp + 0x20], r14
lea r9, [rbp - 9]
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1402b7350
nop
cmp dword [rbp - 0x11], 0
jle 0x14016fcbc
mov rcx, qword [rbp - 0x19]
call fcn.1402b7350
nop
cmp dword [rbp + 7], 0
jle 0x14016fccb
mov rcx, qword [rbp - 1]
call fcn.1402b7350
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401700e0
Capabilities:
Set registry value
Terminate process

Disassembly:
push rbx
sub rsp, 0x60
lea r8, str.SophosClean.exe
lea rdx, str.Starting__ls...
mov ecx, 1
call fcn.14016fab0
mov rbx, qword [0x140428ca0]
lea rdx, [0x140346ce0]
lea rcx, [rbx + 0x40]
xor r8d, r8d
call fcn.1400ce180
lea rdx, str._clean__quiet
mov rcx, rbx
mov byte [rbx + 0xe8], 0
call fcn.1402afb40
test al, al
mov rax, qword [0x140428ca0]
jne 0x140170174
movups xmm0, xmmword [rax + 0x40]
movups xmm1, xmmword [rax + 0x50]
lea r8, [rsp + 0x40]
lea rdx, str.An_error_occurred:__ls
mov ecx, 2
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm1
call fcn.14016fab0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
add rsp, 0x60
pop rbx
ret
mov r9d, dword [rax + 0xa0]
lea r8, str.SophosClean.exe
lea rdx, str._ls_started__PID__u_.
mov ecx, 1
call fcn.14016fab0
xor ecx, ecx
call fcn.140170f10
mov rcx, qword [0x140428ca8]
lea rax, [rsp + 0x70]
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 8]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [0x140428ca0]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x140428cb8]
lea r8, str.SophosClean.exe
lea rdx, str.Waiting_for__ls_to_finish...
mov ecx, 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
call fcn.14016fab0
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x14017029d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov r9d, dword [rsp + 0x70]
lea r8, str.SophosClean.exe
lea rdx, str._ls_process_closed__exit_code__d_.
mov ecx, 1
call fcn.14016fab0
mov edx, dword [rsp + 0x70]
test edx, edx
je 0x14017025b
cmp edx, 5
jne 0x14017026e
mov ecx, 1
call fcn.140170f10
call fcn.1401728f0
mov edx, dword [rsp + 0x70]
lea eax, [rdx + 1]
test eax, 0xfffffffd
jne 0x140170286
mov ecx, 1
call fcn.140170f10
mov edx, dword [rsp + 0x70]
cmp edx, 5
jne 0x140170290
call fcn.140170dd0
call fcn.1401702d0
mov al, 1
add rsp, 0x60
pop rbx
ret
mov rax, qword [0x140428ca0]
lea rdx, str.Service_is_stopping._Terminating_PID__u.
mov ecx, 1
mov r8d, dword [rax + 0xa0]
call fcn.14016fab0
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x1401702d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x80
lea rax, [r11 + 0x18]
xor ebx, ebx
lea r9, [r11 - 0x58]
mov dword [rsp + 0x90], ebx
mov rcx, qword [0x140428ca8]
mov qword [r11 - 0x60], rax
mov rdx, qword [rcx + 0x20]
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
xor r8d, r8d
mov dword [r11 + 8], ebx
mov dword [r11 + 0x18], 4
mov qword [r11 - 0x68], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140170332
cmp dword [rsp + 0x90], ebx
setne al
test al, al
jne 0x1401704a6
mov rcx, qword [0x140428ca8]
lea rax, [rsp + 0xa8]
lea r9, [rsp + 0x34]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
lea rdx, str.UIScan
xor r8d, r8d
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0xa8], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401704a6
cmp dword [rsp + 0x98], ebx
setne al
test al, al
je 0x1401704a6
lea r8, str.SophosClean.exe
lea rdx, str.Scan_finished__Set_UIScan_value_and_LastUIScanTime.
mov ecx, 1
mov qword [rsp + 0x78], rdi
call fcn.14016fab0
lea rcx, [rsp + 0x50]
call fcn.1400e9be0
cmp dword [rax + 0x10], 1
je 0x1401703d7
lea rdx, [rsp + 0x38]
mov rcx, rax
mov ebx, 1
call fcn.14016fa50
mov rdi, qword [rax + 8]
lea rcx, vtable.Core::DateTime.0
test bl, 1
mov rax, rcx
mov qword [rsp + 0x50], rcx
mov rcx, qword [0x140428ca8]
cmove rax, qword [rsp + 0x38]
lea rdx, str.UIScan
mov r9d, 4
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x90]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movabs rcx, 0xfe624e212ac18000
add rcx, rdi
movabs rax, 0xd6bf94d5e57a42bd
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
imul rcx
add rdx, rcx
mov rcx, qword [0x140428ca8]
mov rcx, qword [rcx + 8]
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rax, [rsp + 0x98]
mov dword [rsp + 0x98], edx
lea rdx, str.LastUIScanTime
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x78]
add rsp, 0x80
pop rbx
ret