joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e090
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
call fcn.14000cf50
test al, al
je 0x14001e0c3
mov rcx, qword [rsi]
mov edx, 0x32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdi, qword [rsi + 0x38]
mov qword [rsi + 0x38], 0
test rdi, rdi
je 0x14001e0e4
mov rcx, rdi
call fcn.14001e2e0
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsi + 0x58]
test rcx, rcx
jne 0x14001e278
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x14001e100
call qword [sym.imp.mozglue.dll_free]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
jne 0x14001e2bc
mov rax, qword [rsi + 0x28]
inc rax
cmp rax, 2
jae 0x14001e14f
mov rax, qword [rsi + 0x20]
inc rax
cmp rax, 2
jae 0x14001e1b2
mov rax, qword [rsi + 0x18]
inc rax
cmp rax, 2
jae 0x14001e215
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400053b0
lea rdi, [rsi + 0x28]
call fcn.14000d440
mov rbx, rax
mov r14, qword [rsp + 0x58]
mov r15, qword [rdi]
call fcn.14000d450
mov rcx, qword [rax]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, r15
mov r8, rdi
mov r9, r14
mov rax, r10
call qword [0x14006a010]
mov rbx, qword [rdi]
call fcn.14000d450
mov rcx, qword [rax]
mov r8, qword [rcx]
mov rcx, rax
mov rdx, rbx
mov rax, r8
call qword [0x14006a010]
mov qword [rdi], 0
jmp 0x14001e11a
lea rdi, [rsi + 0x20]
call fcn.14000d440
mov rbx, rax
mov r14, qword [rsp + 0x58]
mov r15, qword [rdi]
call fcn.14000d450
mov rcx, qword [rax]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, r15
mov r8, rdi
mov r9, r14
mov rax, r10
call qword [0x14006a010]
mov rbx, qword [rdi]
call fcn.14000d450
mov rcx, qword [rax]
mov r8, qword [rcx]
mov rcx, rax
mov rdx, rbx
mov rax, r8
call qword [0x14006a010]
mov qword [rdi], 0
jmp 0x14001e12b
lea rdi, [rsi + 0x18]
call fcn.14000d440
mov rbx, rax
mov r14, qword [rsp + 0x58]
mov r15, qword [rdi]
call fcn.14000d450
mov rcx, qword [rax]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, r15
mov r8, rdi
mov r9, r14
mov rax, r10
call qword [0x14006a010]
mov rbx, qword [rdi]
call fcn.14000d450
mov rcx, qword [rax]
mov r8, qword [rcx]
mov rcx, rax
mov rdx, rbx
mov rax, r8
call qword [0x14006a010]
mov qword [rdi], 0
jmp 0x14001e13c
mov rdx, qword [rsi + 0x68]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14001e2a0
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14001e2d1
add rdx, 0x27
mov rcx, rax
lea rdi, [rsi + 0x58]
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64__unsigned_long_long_unsigned___int64__
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
jmp 0x14001e0f1
mov rcx, rdi
call fcn.14001e2e0
mov rcx, rdi
call sub.mozglue.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x14001e10d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001e7d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0x148], rax
mov ecx, dword [0x140064088]
cmp ecx, 0xffffffff
je 0x14001e807
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14001e80c
call fcn.14001e9b0
mov eax, dword [0x140066668]
mov ecx, dword [0x1400644c0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14001e866
lea rcx, [0x140066668]
call fcn.14002ef94
cmp dword [0x140066668], 0xffffffff
jne 0x14001e866
mov ecx, 8
call sub.mozglue.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rax], 0
mov qword [0x140066660], rax
lea rcx, [0x140066668]
call fcn.14002ef34
mov rbx, qword [0x140066660]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov rax, qword [0x140064e58]
inc rax
xor ecx, ecx
lea rdx, [0x140064e60]
lea r8d, [rax + rcx]
movzx r8d, r8b
lea r9, [r8 + r8*2]
cmp dword [rdx + r9*8], 0
jne 0x14001e907
lea rax, [rdx + r9*8]
mov dword [rax], 1
mov qword [rax + 8], rdi
mov qword [0x140064e58], r8
mov dword [rsi], r8d
mov eax, dword [rax + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x2c], eax
cmp eax, 0xffffffff
je 0x14001e919
mov eax, dword [rsi]
mov dword [rsp + 0x30], 0x100
mov dword [rsp + 0x2c], eax
cmp eax, 0xff
jg 0x14001e95e
mov rcx, qword [rsp + 0x148]
xor rcx, rsp
call fcn.140030100
nop
add rsp, 0x150
pop rbx
pop rdi
pop rsi
ret
inc rcx
cmp rcx, 0x100
jne 0x14001e889
jmp 0x14001e8ba
lea r8, str.slot____kInvalidSlotValue
lea rcx, [rsp + 0x2c]
lea rdx, [rsp + 0x30]
call fcn.14003b2e0
test rax, rax
je 0x14001e8d6
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x196
mov r9, rax
call fcn.14003af90
mov rcx, rdi
call fcn.14003b030
jmp 0x14001e8d6
lea r8, str.slot____kThreadLocalStorageSize
lea rcx, [rsp + 0x2c]
lea rdx, [rsp + 0x30]
call fcn.14003b2e0
test rax, rax
je 0x14001e8eb
lea rdx, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x197
mov r9, rax
call fcn.14003af90
mov rcx, rsi
call fcn.14003b030
jmp 0x14001e8eb
Function at 0x140039f10
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x860
mov qword [rsp + 0x888], rdx
mov qword [rsp + 0x890], r8
mov qword [rsp + 0x898], r9
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0x858], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140039fb5
lea rsi, [rsp + 0x888]
mov qword [rsp + 0x28], rsi
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.mozglue.dll_protected:_void___cdecl_mozilla::PrintfTarget::constructor_void____ptr64]
lea rax, [0x1400552b8]
mov qword [rdi], rax
lea rbx, [rsp + 0x50]
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0x800
lea rdx, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov rcx, rdi
mov r8, rsi
call qword [sym.imp.mozglue.dll_public:_bool___cdecl_mozilla::PrintfTarget::vprint_char_const____ptr64__char____ptr64____ptr64]
mov rax, qword [rdi + 8]
mov ecx, 0x7ff
cmp rax, rcx
cmovb rcx, rax
mov byte [rsp + rcx + 0x50], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
cmp eax, 0xfffffffe
je 0x14003a023
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__dup]
lea rdx, [0x140059366]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll__fdopen]
test rax, rax
je 0x14003a023
mov rsi, rax
lea rdi, [rsp + 0x888]
mov qword [rsp + 0x50], rdi
call fcn.14001a0d0
mov rcx, qword [rax]
mov qword [rsp + 0x20], rdi
lea r8, str._n_nBROWSERBROWSERBROWSERBROWSER_n__debug_me____lu_n_n
mov rdx, rsi
xor r9d, r9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vfprintf]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x858]
xor rcx, rsp
call fcn.140030100
nop
add rsp, 0x860
pop rbx
pop rdi
pop rsi
ret
Function at 0x140046d90
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x140046e74
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp qword [r8 + 0x18], 8
jb 0x140046df6
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x140046e8f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
lea rbx, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140030100
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x140046e65

Function at 0x140049230
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.14000d340
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14004929a
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14004c010
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x90]
mov edx, dword [rsp + 0x80]
mov r10, qword [rsp + 0x88]
mov qword [rsi], 0
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor r14d, r14d
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14004c0a8
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140052470
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14000cf50
test al, al
je 0x140052492
mov rcx, qword [rsi]
xor edx, edx
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x20
pop rsi
ret

Function at 0x140053dd0
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140064030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x140064d74]
mov ecx, dword [0x1400644c0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140053e73
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x140053e4f
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x140064d70]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x140053e36
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140030100
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140064d74]
call fcn.14002ef94
cmp dword [0x140064d74], 0xffffffff
jne 0x140053e10
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140064d70], eax
lea rcx, [0x140064d74]
call fcn.14002ef34
jmp 0x140053e10
Function at 0x1401535c4
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x14015364f
movsxd rcx, dword [0x14000003c]
lea rdx, [0x140000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x14015364f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14015364f
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x14015364b
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140153645
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jae 0x140153645
test rdx, rdx
je 0x14015364b
cmp dword [rdx + 0x24], 0
jge 0x140153641
xor al, al
jmp 0x140153655
mov al, 1
jmp 0x140153655
add rdx, 0x28
jmp 0x140153617
xor al, al
jmp 0x140153655
xor al, al
jmp 0x140153655
add rsp, 0x18
ret

Function at 0x1405670a3
Capabilities:
Check for software breakpoints

Disassembly:
je fcn.140562370
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.1405c3ea3
setbe r11b
lea r11, [r11*4 + 0x181f4980]
not r11
neg r11w
mov r11, qword [rsp + 0x10]
jno 0x14055084f
push r11
pushfq
movabs r11, 0x188a43df63c56553
lea r11, [r11 + r11 + 0x48cf4985]
mov r11w, 0x6288
not r11d
and r11, 0x24823e84
lea r11, [r11*4 + 0x6b78584e]
mov r11, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffe34f53ed
call fcn.140570446
invalid
xchg ebx, eax
add byte [rax], al
loopne 0x1405670fc
stosb byte [rdi], al
cdq
jae 0x1405670da
int3
Function at 0x140006d20
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140006d3c
xor al, al
add rsp, 0x20
pop rbx
ret
test al, 1
je 0x140006d6a
and eax, 0xfffffffe
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140006d6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR:_MakeWritable:_Unable_to_set_attribs__S__u._n
mov rdx, rbx
mov r8d, eax
call fcn.1400154e0
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x140006da0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140006dc4
test rdx, rdx
je 0x140006dc4
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
add rsp, 0x28
ret
lea rcx, str.ERROR:_InstallScheduleFileRename:_NULL_ptr_n
call fcn.1400154e0
xor al, al
add rsp, 0x28
ret

Function at 0x140006de0
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1400076a0
Capabilities:
Get file version info
Parse pe header

Disassembly:
mov r11, rsp
push rbp
push rdi
sub rsp, 0x138
mov rax, qword [0x14008b5a0]
xor rax, rsp
mov qword [rsp + 0x120], rax
test rcx, rcx
mov rdi, rdx
mov rbp, rcx
je 0x140007892
test rdx, rdx
je 0x140007892
xor edx, edx
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x18], r12
lea r8d, [rdx + 0x50]
mov rcx, rdi
xor r12b, r12b
call fcn.14004c980
mov rcx, rbp
call fcn.140039c70
test rax, rax
mov rsi, rax
je 0x14000787d
cmp rax, 0xffffffffffffffff
je 0x14000787d
mov ecx, 0x1000
mov qword [rsp + 0x160], rbx
call fcn.14004c8b0
test rax, rax
mov rbx, rax
je 0x1400077ad
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.14004c980
xor r9d, r9d
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rsi
call fcn.140039cc0
cmp word [rbx], 0x5a4d
mov r11, rbx
jne 0x140007770
movsxd rcx, dword [rbx + 0x3c]
lea rax, [rcx + 0xf8]
cmp rax, 0x1000
ja 0x140007770
lea r11, [rcx + rbx]
cmp dword [r11], 0x4550
jne 0x1400077a5
movzx eax, word [r11 + 0x18]
cmp eax, 0x10b
je 0x140007792
cmp eax, 0x20b
jne 0x1400077a5
add r11, 4
jmp 0x140007796
add r11, 4
test r11, r11
je 0x1400077a5
mov eax, dword [r11 + 4]
mov r12b, 1
mov dword [rdi + 0x10], eax
mov rcx, rbx
call fcn.14004ca6c
mov rcx, rsi
call fcn.140039c50
test r12b, r12b
je 0x140007875
lea rdx, [rsp + 0x48]
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov esi, eax
je 0x140007875
mov rcx, rsi
call fcn.14004c8b0
test rax, rax
mov rbx, rax
je 0x14000786d
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14000786d
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str.VarFileInfoTranslation
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14000786d
mov rax, qword [rsp + 0x38]
lea r8, str.StringFileInfo_04X_04XFileVersion
mov edx, 0x64
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x50]
call fcn.14004d718
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14000786d
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov r8, rdi
call fcn.1400075d0
mov rcx, rbx
call fcn.14004ca6c
mov rbx, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
mov al, r12b
mov r12, qword [rsp + 0x130]
jmp 0x1400078a0
lea rcx, str.ERROR:_InstallGetFileVersion:_NULL_ptr_n
call fcn.1400154e0
xor al, al
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14004c890
add rsp, 0x138
pop rdi
pop rbp
ret
Function at 0x1400083e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xe0
movzx edi, dl
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
call fcn.14004c980
xor eax, eax
lea rcx, str.Running__S..._n
mov rdx, rbx
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.1400154e0
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140008497
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Could_not_launch__S:__u_n
mov rdx, rbx
mov r8d, eax
call fcn.1400154e0
xor al, al
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rdi
ret
test dil, dil
je 0x1400084b9
lea rcx, str.Waiting_for__S_to_complete..._n
mov rdx, rbx
call fcn.1400154e0
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xf0]
mov al, 1
add rsp, 0xe0
pop rdi
ret
Function at 0x14000a620
Capabilities:
Modify service

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x10], edx
push rbp
push rdi
push r13
sub rsp, 0x80
mov qword [rax + 8], rbx
mov qword [rax - 0x20], rsi
mov rbp, rcx
xor ecx, ecx
mov qword [rax - 0x38], r15
mov esi, r8d
xor dil, dil
call fcn.14003c8b0
mov rcx, rbp
mov ebx, eax
mov dword [rsp + 0x30], eax
call fcn.14003b770
xor edx, edx
mov rcx, rbp
movzx r13d, al
call fcn.140024b70
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
mov r15, rax
je 0x14000a7d7
mov r8d, FDIDestroy
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x70], r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
mov r12, rax
je 0x14000a7b1
lea rcx, str.ConfigureServiceRecovery:_Will_attempt_to_set_service_recovery_actions_n
mov qword [rsp + 0x68], r14
call fcn.1400154e0
lea r14d, [rsi + 1]
mov ecx, r14d
shl rcx, 3
call fcn.14004c8b0
test rax, rax
mov rbx, rax
je 0x14000a791
test esi, esi
je 0x14000a703
mov edx, dword [rsp + 0xb8]
mov rcx, rsi
imul edx, edx, 0x3e8
nop
mov dword [rax], 1
mov dword [rax + 4], edx
add rax, 8
sub rcx, 1
jne 0x14000a6f0
mov eax, dword [rsp + 0xa8]
xor ecx, ecx
lea r8, [rsp + 0x38]
test eax, eax
lea edx, [rcx + 2]
mov dword [rbx + rsi*8], ecx
cmove r14d, ecx
mov dword [rbx + rsi*8 + 4], ecx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rcx
mov rcx, r12
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x58], rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x14000a75f
lea rcx, str.ConfigureServiceRecovery:_Recovery_actions_set._n
call fcn.1400154e0
mov rcx, rbx
mov dil, 1
call fcn.14004ca6c
jmp 0x14000a79d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [rsp + 0xb8]
mov edx, dword [rsp + 0xa8]
lea rcx, str.ERROR__ConfigureServiceRecovery:_Failed_to_write_recovery_actions:_____ResetPeriod:___d_n____RestartCount:__d_n____RestartDelay:__d_n____GetLastError_d_n
mov r8d, esi
mov dword [rsp + 0x20], eax
call fcn.1400154e0
mov rcx, rbx
call fcn.14004ca6c
jmp 0x14000a79d
lea rcx, str.ERROR__ConfigureServiceRecovery:_Failed_to_allocate_memory_for_service_recovery_actions_array_n
call fcn.1400154e0
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, dword [rsp + 0x30]
mov r14, qword [rsp + 0x68]
jmp 0x14000a7c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ERROR__ConfigureServiceRecovery:_Failed_to_open_service__S_to_change_config__u_n
mov rdx, rbp
mov r8d, eax
call fcn.1400154e0
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r12, qword [rsp + 0x70]
mov ecx, ebx
call fcn.14003c8b0
test r13b, r13b
mov r15, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0xa0]
je 0x14000a801
movzx edx, r13b
mov rcx, rbp
call fcn.140024b70
mov al, dil
add rsp, 0x80
pop r13
pop rdi
pop rbp
ret
Function at 0x14000aac0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
mov rbx, rcx
mov rdx, rcx
lea r8, [rsp + 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
mov esi, eax
je 0x14000ab26
lea rcx, str.Unable_to_open_safe_boot_key__S:__u_n
mov r8d, eax
mov rdx, rbx
call fcn.1400154e0
lea rcx, str.Unable_to_open_safe_boot_key__S:__u_n
mov r8d, esi
mov rdx, rbx
call fcn.14004d888
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
xor esi, esi
lea rcx, str..WGUARDNT
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000ab99
mov qword [rsp + 0x30], rsi
lea rcx, str..GlobalWGUARDNT
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
jne 0x14000ab99
mov rbx, rsi
jmp 0x14000abd0
test rbx, rbx
je 0x14000abd0
cmp rbx, 0xffffffffffffffff
je 0x14000abd0
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x9edb6510
mov rcx, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [rsp + 0x78]
lea r8, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
mov esi, eax
je 0x14000ac3e
lea rcx, str.Unable_to_create_safe_boot_key__S:__u_n
mov r8d, eax
mov rdx, rdi
call fcn.1400154e0
lea rcx, str.Unable_to_create_safe_boot_key__S:__u_n
mov r8d, esi
mov rdx, rdi
call fcn.14004d888
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000ac2c
cmp rbx, 0xffffffffffffffff
je 0x14000ac2c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
lea rcx, str.Driver
call fcn.140036f80
mov rcx, qword [rsp + 0x40]
xor edx, edx
add eax, eax
lea r8d, [rdx + 1]
lea r9, str.Driver
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
mov esi, eax
je 0x14000ac9f
lea rcx, str.Unable_to_set_safe_boot_value:__u_n
mov edx, eax
call fcn.1400154e0
lea rcx, str.Unable_to_set_safe_boot_value:__u_n
mov edx, esi
call fcn.14004d888
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
jmp 0x14000ac12
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14000acc9
cmp rbx, 0xffffffffffffffff
je 0x14000acc9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._S_enabled_for_SafeBoot_n
mov rdx, rdi
call fcn.1400154e0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov al, 1
add rsp, 0x50
pop rdi
ret