joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007d44
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
movzx ecx, word [r8 + 0xe]
lea rdi, [r8 + 0x10]
mov eax, 0x80000000
or rcx, rax
lea rax, [r11 + 0x20]
mov rbx, r8
mov r14, rdx
xor r15d, r15d
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov qword [r11 - 0x48], rax
mov qword [r11 + 0x20], r15
mov dword [r11 + 0x18], r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
je 0x180007dba
mov esi, 0x900
mov word [rbx + 4], si
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov word [rbx + 8], r15w
mov word [rbx + 0xe], ax
jmp 0x180007f4d
mov rcx, qword [rsp + 0x88]
lea r9, [rsp + 0x80]
mov r8, rdi
xor edx, edx
mov r12d, r15d
mov dword [rsp + 0x80], 0x400
call qword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
mov ecx, 1
cmp eax, r15d
jne 0x180007e69
mov esi, 0x900
jmp 0x180007df9
mov ecx, 1
mov eax, dword [rsp + 0x80]
mov r8d, 0x7530
mov rdx, rbx
mov word [rbx + rax*2 + 0x10], r15w
movzx eax, word [rsp + 0x80]
mov word [rbx + 4], si
add ax, cx
mov rcx, r14
mov word [rbx + 0xe], r15w
add ax, ax
mov word [rbx + 8], ax
call fcn.180006c30
mov rcx, qword [rsp + 0x88]
mov r13d, eax
cmp eax, r15d
jne 0x180007e7e
inc r12d
lea r9, [rsp + 0x80]
mov r8, rdi
mov edx, r12d
mov dword [rsp + 0x80], 0x400
call qword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
cmp eax, r15d
je 0x180007df4
mov r13d, r15d
lea rsi, [rdi + 0x414]
xor edx, edx
lea r15, [rdi + 0x418]
jmp 0x180007ed6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r13d
jmp 0x180007f5e
mov eax, dword [rsp + 0x80]
mov r8d, 0x7530
mov rdx, rbx
mov word [rdi + rax*2 + 0x20c], r12w
mov word [rbx + 4], cx
mov word [rbx + 0xe], r12w
movzx eax, word [rsi]
mov ecx, 0x418
add ax, cx
mov rcx, r14
mov word [rbx + 8], ax
call fcn.180006c30
mov r12d, eax
test eax, eax
jne 0x180007f76
inc r13d
mov edx, r13d
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x80]
lea r8, [rdi + 0x20c]
mov qword [rsp + 0x28], r15
mov dword [rsi], 0x400
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x80], 0x104
call qword [sym.imp.SHLWAPI.dll_SHEnumValueW]
xor r12d, r12d
mov ecx, 0x903
cmp eax, r12d
je 0x180007e8c
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x903
mov qword [rsp + 0x88], r12
mov word [rbx + 4], ax
mov word [rbx + 0xe], r12w
mov word [rbx + 8], r12w
mov r8d, 0x7530
mov rdx, rbx
mov rcx, r14
call fcn.180006c30
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r12d
jmp 0x180007f5e
Function at 0x180007f8c
Capabilities:
Delete registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
movzx edi, word [r8 + 0xe]
xor r14d, r14d
mov rsi, r8
mov eax, 0x80000000
mov r13, rdx
lea rdx, [rsi + 0x218]
or rdi, rax
lea rax, [r11 + 0x18]
xor r9d, r9d
mov qword [r11 - 0x38], rax
lea rax, [r11 + 0x20]
xor r8d, r8d
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r14
mov rcx, rdi
mov dword [rsp + 0x28], 0x20006
mov qword [r11 + 0x20], r14
mov dword [r11 + 0x18], r14d
mov dword [r11 - 0x58], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp eax, r14d
jne 0x180008058
cmp dword [rsp + 0x90], 1
je 0x18000800f
mov ebx, 0xb7
jmp 0x180008058
mov r8, qword [rsp + 0x98]
lea rdx, [rsi + 0x10]
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
mov rcx, qword [rsp + 0x98]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x98], r14
mov rcx, rdi
lea rdx, [rsi + 0x10]
cmp ebx, r14d
je 0x180008052
lea rdx, [rsi + 0x218]
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, 0x902
mov r8d, 0x7530
mov rdx, rsi
mov rcx, r13
mov word [rsi + 8], r14w
mov word [rsi + 0xe], bx
mov word [rsi + 4], ax
call fcn.180006c30
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180008094
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
movzx ecx, word [r8 + 0xe]
mov rdi, r8
xor r14d, r14d
mov eax, 0x80000000
mov r13, rdx
lea rdx, [rdi + 0x10]
or rcx, rax
lea rax, [r11 - 0x38]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [r11 - 0x38], r14
mov dword [r11 + 0x20], r14d
mov qword [r11 - 0x48], rax
mov dword [r11 + 0x18], r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r14d
jne 0x1800081c3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + 0x218]
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r14d
jne 0x1800081c3
mov ecx, dword [rsp + 0x80]
call fcn.180003a2c
mov rsi, rax
cmp rax, r14
jne 0x18000814b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1800081c3
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x88]
mov qword [rsp + 0x28], rax
lea rdx, [rdi + 0x218]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
lea rdx, [rdi + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [rsp + 0x80]
mov r9d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
mov dword [rsp + 0x28], eax
lea rdx, [rdi + 0x420]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call fcn.180003a54
mov rcx, qword [rsp + 0x30]
cmp rcx, r14
je 0x1800081d8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r14
mov eax, 0x905
mov r8d, 0x7530
mov rdx, rdi
mov rcx, r13
mov word [rdi + 8], r14w
mov word [rdi + 0xe], bx
mov word [rdi + 4], ax
call fcn.180006c30
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180008fa4
Capabilities:
Enumerate services

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov rbx, r8
mov r13, rdx
xor edx, edx
mov r8d, 0x80000000
xor ecx, ecx
mov edi, r15d
mov dword [rax - 0x48], r15d
mov dword [rax + 0x18], r15d
mov dword [rax + 0x20], r15d
mov rsi, r15
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov r12, rax
cmp rax, r15
jne 0x180008ffe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x180009193
mov r14d, 0x10000
mov rcx, r14
call fcn.180003a2c
mov edx, gethostbyname
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xa0]
lea r8d, [rdx - 0x2d]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov r9, rbp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
cmp eax, r15d
jne 0x180009064
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x180009170
mov ecx, 0x1000
call fcn.180003a2c
mov r14d, r15d
mov rsi, rax
cmp dword [rsp + 0xa0], r15d
jbe 0x180009170
mov r15, rbp
mov rbp, qword [rsp + 0x98]
lea rcx, [rbx + 0x18]
mov eax, dword [r15 + 0x14]
mov dword [rbx + 0x14], eax
mov rdx, qword [r15]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [r15 + 8]
lea rcx, [rbx + 0x220]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, qword [r15]
mov r8d, 1
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor edi, edi
mov r13, rax
cmp rax, rdi
je 0x1800090f8
lea r9, [rsp + 0xa8]
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
cmp eax, edi
je 0x1800090f8
mov ecx, dword [rsi + 4]
mov dword [rbx + 0x10], ecx
mov rdx, qword [rsi + 0x10]
jmp 0x1800090ff
lea rdx, [0x18001d7f0]
lea rcx, [rbx + 0x428]
call qword [sym.imp.USER32.dll_wsprintfW]
mov eax, 0x800
mov r8d, 0x7530
mov word [rbx + 4], ax
mov eax, 0x620
mov rdx, rbx
mov rcx, rbp
mov word [rbx + 0xe], di
mov word [rbx + 8], ax
call fcn.180006c30
mov edi, eax
test eax, eax
jne 0x180009152
inc r14d
add r15, 0x30
lea rcx, [rbx + 0x18]
cmp r14d, dword [rsp + 0xa0]
jb 0x180009091
mov rbp, qword [rsp + 0x48]
xor r15d, r15d
cmp r13, r15
je 0x180009168
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r13, qword [rsp + 0x98]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp rbp, r15
je 0x180009186
mov rcx, rbp
call fcn.180003a54
cmp rsi, r15
je 0x180009193
mov rcx, rsi
call fcn.180003a54
mov eax, 0x800
mov r8d, 0x7530
mov rdx, rbx
mov rcx, r13
mov word [rbx + 8], r15w
mov word [rbx + 0xe], di
mov word [rbx + 4], ax
call fcn.180006c30
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800091d0
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, r8
mov r12, rdx
xor ecx, ecx
xor edx, edx
mov r8d, 0x20000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor r13d, r13d
mov rsi, rax
cmp rax, r13
je 0x180009260
lea rdx, [rbp + 0x10]
lea r8d, [r13 + 0x10]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
cmp rax, r13
je 0x18000924d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp eax, r13d
je 0x18000923a
mov ebx, r13d
jmp 0x180009242
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180009255
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180009268
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, 0x801
mov r8d, 0x7530
mov rdx, rbp
mov rcx, r12
mov word [rbp + 8], r13w
mov word [rbp + 0xe], bx
mov word [rbp + 4], ax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
jmp fcn.180006c30

Function at 0x1800092a4
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov rbp, r8
mov r12, rdx
xor ecx, ecx
xor edx, edx
mov r8d, 0x20000000
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor r13d, r13d
mov rsi, rax
cmp rax, r13
je 0x180009338
lea rdx, [rbp + 0x10]
lea r8d, [r13 + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
cmp rax, r13
je 0x180009325
lea r8, [rsp + 0x20]
lea edx, [r13 + 1]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
cmp eax, r13d
je 0x180009312
mov ebx, r13d
jmp 0x18000931a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x18000932d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180009340
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, 0x802
mov r8d, 0x7530
mov rdx, rbp
mov rcx, r12
mov word [rbp + 8], r13w
mov word [rbp + 0xe], bx
mov word [rbp + 4], ax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r13
pop r12
pop rdi
jmp fcn.180006c30
Function at 0x18000937c
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, r8
mov r12, rdx
mov ebx, 0x10000000
xor edx, edx
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor r13d, r13d
mov rsi, rax
cmp rax, r13
je 0x180009408
lea rdx, [rbp + 0x10]
mov r8d, ebx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
cmp rax, r13
je 0x1800093f5
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
cmp eax, r13d
je 0x1800093e2
mov ebx, r13d
jmp 0x1800093ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1800093fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x180009410
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, 0x803
mov r8d, 0x7530
mov rdx, rbp
mov rcx, r12
mov word [rbp + 8], r13w
mov word [rbp + 0xe], bx
mov word [rbp + 4], ax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
jmp fcn.180006c30
Function at 0x180009488
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r13
sub rsp, 0x80
and dword [rax - 0x48], 0
xor ebx, ebx
mov rsi, rdx
lea edx, [rbx + 1]
mov dword [rax - 0x3c], 0xea60
mov dword [rax - 0x38], 0x1388
mov word [rax + 8], dx
mov dword [rax + 0x20], edx
mov dword [rax - 0x40], edx
lea eax, [rbx + 0xa]
movzx ebp, r8w
mov rdi, rcx
lea r13d, [rbx + 2]
xor r8d, r8d
mov word [rsp + 0xa2], ax
mov ecx, r13d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x1800094f9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1800095c4
call fcn.180002564
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180009515
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ebx, dword [rcx]
movzx ecx, bp
mov word [rsp + 0x68], r13w
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rdi + 0x78]
lea rdx, [rsp + 0x68]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x6a], ax
mov dword [rsp + 0x6c], ebx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1800094ee
mov rcx, qword [rdi + 0x78]
mov esi, 4
mov ebx, 0xffff
lea r8d, [rsi + 0x7c]
lea r9, [rsp + 0xa0]
mov edx, ebx
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x78]
lea r9, [rsp + 0xb8]
lea r8d, [rsi + 4]
mov edx, ebx
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_setsockopt]
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
mov rcx, qword [rdi + 0x78]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9d, [rsi + 8]
lea r8, [rsp + 0x58]
mov edx, 0x98000004
call qword [sym.imp.WS2_32.dll_WSAIoctl]
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret

Function at 0x1800095dc
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
sub rsp, 0x58
and qword [r11 - 0x28], 0
and dword [rsp + 0x70], 0
lea rax, [rcx + 0x30]
mov rcx, qword [rcx + 0x78]
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x10], rdx
lea rax, [r11 + 0x18]
mov dword [r11 - 0x18], r8d
lea r9, [r11 + 8]
lea rdx, [r11 - 0x18]
mov r8d, 1
mov qword [r11 - 0x38], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x180009636
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x180009636
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x180009638
xor eax, eax
add rsp, 0x58
ret
Function at 0x18000968c
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
sub rsp, 0x58
and qword [r11 - 0x28], 0
lea rax, [rcx + 0x10]
mov rcx, qword [rcx + 0x78]
mov qword [r11 - 0x10], rdx
mov dword [r11 - 0x18], r8d
mov qword [r11 - 0x30], rax
and dword [rsp + 0x20], 0
lea r9, [r11 + 0x18]
lea rdx, [r11 - 0x18]
mov r8d, 1
call qword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
je 0x1800096de
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x1800096de
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1800096e0
xor eax, eax
add rsp, 0x58
ret
Function at 0x18000ab00
Capabilities:
Create thread
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov r14, rcx
mov ebx, 0xf010
mov rbp, rdx
mov rcx, rbx
call fcn.18001216c
xor r15d, r15d
mov rsi, rax
cmp rax, r15
je 0x18000ab4c
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.180015710
jmp 0x18000ab4f
mov rsi, r15
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call fcn.18000af2c
mov ebx, eax
cmp eax, r15d
jne 0x18000ad6a
mov r8d, 0x2bf20
mov rdx, rsi
mov rcx, rbp
call fcn.180006aa4
mov ebx, eax
cmp eax, r15d
jne 0x18000ad6a
movzx ecx, word [rsi + 4]
sub ecx, 3
je 0x18000acd0
sub ecx, 1
je 0x18000ac42
sub ecx, 1
je 0x18000ac2f
sub ecx, 1
je 0x18000ad4a
cmp ecx, 1
je 0x18000abc9
call fcn.1800063dc
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.180006674
jmp 0x18000accc
movzx ebx, word [rsi + 0xe]
call fcn.180002564
lea r8, [0x180023100]
lea rdx, [0x18001d4d8]
lea rcx, [rsp + 0x30]
mov rdi, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [0x180023124]
lea rdx, [0x18001d578]
lea rcx, [rsp + 0x54]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov dword [rsp + 0x50], ebx
call fcn.180003724
mov ecx, 7
mov word [rsi + 4], cx
mov word [rsi + 8], r15w
mov word [rsi + 0xe], ax
jmp 0x18000acbb
mov r8, rsi
mov rdx, rbp
mov rcx, r14
call fcn.18000b298
jmp 0x18000accc
call fcn.1800063dc
mov r12b, r15b
mov r13d, 0x20
lea rbx, [rax + 0xc]
lea rdi, [rax + 0x18]
mov eax, 0xffff
cmp word [rbx], ax
je 0x18000ac94
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx eax, word [rbx]
movzx r11d, r12b
imul r11, r11, 0x42
lea rdx, [0x18001d4d8]
lea rcx, [r11 + rsi + 0x12]
mov r8, rdi
mov word [r11 + rsi + 0x10], ax
call qword [sym.imp.USER32.dll_wsprintfW]
inc r12b
add rdi, 0x50
add rbx, 0x50
sub r13, 1
jne 0x18000ac58
lea eax, [r13 + 4]
mov word [rsi + 0xe], r15w
mov word [rsi + 4], ax
movzx eax, r12b
imul ax, ax, 0x42
mov word [rsi + 8], ax
mov r8d, 0x7530
mov rdx, rsi
mov rcx, rbp
call fcn.180006c30
mov ebx, eax
jmp 0x18000ad42
mov ecx, 0x58
call fcn.18001216c
lea rdx, [r14 + 8]
mov r8d, 0x58
mov rcx, rax
mov rdi, rax
call fcn.180016360
movzx r11d, word [rsi + 0x10]
lea r8, [0x18000b180]
mov word [rdi + 2], r11w
movzx ecx, word [rsi + 0x12]
mov r9, rdi
mov word [rdi + 4], cx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, r15
jne 0x18000ad36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call fcn.180012098
jmp 0x18000ad42
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r15d
cmp ebx, r15d
jmp 0x18000ab62
lea rcx, [rsp + 0x198]
call fcn.180005200
call fcn.180002564
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov ebx, 0x4c7
cmp rsi, r15
je 0x18000ad77
mov rcx, rsi
call fcn.180012098
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x30]
lea r11, [rsp + 0x160]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000af2c
Capabilities:
Get hostname
Get session user name
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x270
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
call fcn.180002564
mov ebx, 0x103
lea rcx, [rsp + 0x51]
xor r12d, r12d
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x50], r12b
call fcn.180015710
lea rcx, [rsp + 0x161]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x160], r12b
call fcn.180015710
lea edx, [rbx + 1]
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostname]
lea r13d, [r12 + 1]
cmp eax, 0xffffffff
jne 0x18000afab
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000b002
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
cmp rax, r12
je 0x18000b002
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rdx, [0x18001d578]
lea rcx, [rsp + 0x160]
mov r8, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, r12
movsxd rdx, eax
cmp rdx, r12
jl 0x18000b002
movsx eax, byte [rsp + rcx + 0x160]
mov word [rdi + rcx*2 + 0x10], ax
add rcx, r13
cmp rcx, rdx
jle 0x18000afed
call fcn.180002564
lea rdx, [rsp + 0x290]
lea rcx, [rdi + 0x90]
mov dword [rsp + 0x290], 0x20
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, r12d
jne 0x18000b032
call qword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.180002564
lea rcx, [rdi + 0xd0]
lea rdx, [rsp + 0x290]
mov dword [rsp + 0x290], 0x20
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp eax, r12d
jne 0x18000b062
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rdi + 0x50]
lea rdx, [rdi + 0x90]
call qword [sym.imp.USER32.dll_wsprintfW]
movzx r11d, byte [rsi + 8]
lea rcx, [rdi + 0x110]
sub r11d, r13d
je 0x18000b0aa
sub r11d, r13d
je 0x18000b0a1
cmp r11d, 2
je 0x18000b098
lea rdx, str.UNKNOWN
jmp 0x18000b0b1
lea rdx, str.HTTPS
jmp 0x18000b0b1
lea rdx, [0x18001d978]
jmp 0x18000b0b1
lea rdx, [0x18001d970]
call qword [sym.imp.USER32.dll_wsprintfW]
call fcn.180002564
lea rdx, [rdi + 0x120]
mov rcx, rax
call fcn.180002920
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx edx, word [rsp + 0x48]
movzx r11d, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4a]
movzx r10d, word [rsp + 0x46]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edx
lea rcx, [rdi + 0x1a0]
lea rdx, str._04d__02d__02d__02d:_02d:_02d
mov dword [rsp + 0x20], r10d
call qword [sym.imp.USER32.dll_wsprintfW]
call fcn.180002564
lea rcx, [rdi + 0x1e0]
lea r8, [0x180023100]
lea rdx, [0x18001d4d8]
call qword [sym.imp.USER32.dll_wsprintfW]
mov eax, 0x1e2
mov r8d, 0x7530
mov rdx, rdi
mov rcx, rbp
mov word [rdi + 4], r13w
mov word [rdi + 8], ax
mov word [rdi + 0xe], r12w
call fcn.180006c30
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000c380
Capabilities:
Create thread
Get system information on windows
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov rdi, rcx
add rcx, 0xf0
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x1800252f8]
inc r11d
cmp r11d, 1
mov dword [0x1800252f8], r11d
jg 0x18000c4ef
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x50]
inc r11d
cmp r11d, 4
mov dword [rdi + 0xd8], r11d
jge 0x18000c3ee
mov dword [rdi + 0xd8], 4
cmp dword [rdi + 0xd8], 0x10
jle 0x18000c401
mov dword [rdi + 0xd8], reloc.WS2_32.dll_recv
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0xd0], rax
test rax, rax
jne 0x18000c42a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000c4cf
mov r9d, dword [rdi + 0xd8]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rdi], rax
test rax, rax
je 0x18000c41f
xor r13d, r13d
cmp dword [rdi + 0xd8], r13d
mov esi, r13d
jle 0x18000c4b7
lea rbp, [rdi + 0x50]
lea r14, [0x18000c8d0]
nop word [rax + rax]
lea rax, [rsp + 0x90]
lea r8, [0x18000cae0]
test esi, esi
cmove r8, r14
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp], rax
test rax, rax
je 0x18000c41f
inc esi
add rbp, 8
cmp esi, dword [rdi + 0xd8]
jl 0x18000c470
mov ecx, 0x101
mov rdx, r12
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18000c4ef
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 1
mov rcx, rdi
mov esi, eax
call fcn.18000c540
lea rcx, [rdi + 0xf0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x18000c519
mov eax, 0xfc00
lea rcx, [rdi + 0xf0]
mov word [r12 + 4], ax
mov eax, 0xb2c
mov word [r12 + 2], ax
mov word [r12], ax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret