joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ade4
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15d, r9d
mov rdi, r8
mov r10, qword [section..data]
lea r12, section..data
mov r14d, dword [rbp + 0x58]
mov rsi, qword [rbp + 0x50]
cmp r10, r12
je 0x14004ae56
test byte [r10 + 0x1c], 1
je 0x14004ae56
cmp byte [r10 + 0x19], 5
jb 0x14004ae56
mov eax, dword [rsi]
mov rcx, qword [r10 + 0x10]
mov dword [r11 - 0x68], r14d
mov dword [rsp + 0x38], eax
mov dword [r11 - 0x78], r9d
mov qword [r11 - 0x80], r8
call fcn.140052d90
mov r10, qword [section..data]
xor ebx, ebx
mov rdx, 0xffffffff80000002
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
test rdi, rdi
je 0x14004af42
cmp bx, word [rdi]
je 0x14004af42
mov r9d, 0x2011f
mov dword [rsi], r15d
lea r8, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0
lea rcx, [rbp - 0x30]
call fcn.140005e00
mov ecx, eax
test eax, eax
jne 0x14004aee1
lea r8, [rbp + 0x38]
mov dword [rbp + 0x38], ebx
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.14003ac44
mov ecx, eax
test eax, eax
jne 0x14004aec6
mov eax, dword [rbp + 0x38]
mov dword [rsi], eax
cmp r14d, 1
jne 0x14004aee1
mov rcx, qword [rbp - 0x30]
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
nop dword [rax + rax]
mov ecx, eax
cmp ecx, 0x490
je 0x14004af81
cmp ecx, 2
je 0x14004af81
test ecx, ecx
je 0x14004af81
jg 0x14004af04
mov ebx, ecx
jmp 0x14004af0d
movzx ebx, cx
or ebx, 0x80070000
mov r10, qword [section..data]
cmp r10, r12
je 0x14004afc0
test byte [r10 + 0x1c], 2
je 0x14004af88
movzx eax, byte [r10 + 0x19]
mov ecx, ebx
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x14004af88
mov edx, 0x1c
mov r9d, ebx
jmp 0x14004af63
mov r9d, 0x80070057
mov ebx, r9d
cmp r10, r12
je 0x14004afc0
test byte [r10 + 0x1c], 2
je 0x14004af88
cmp byte [r10 + 0x19], 2
jb 0x14004af88
mov edx, reloc.OLEAUT32.dll_DispGetParam
mov eax, dword [rsi]
mov rcx, qword [r10 + 0x10]
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], rdi
call fcn.140052b58
mov r10, qword [section..data]
cmp r10, r12
je 0x14004afc0
test byte [r10 + 0x1c], 1
je 0x14004afc0
movzx ecx, byte [r10 + 0x19]
mov edx, ebx
sar edx, 0x1f
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x14004afc0
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400ae358]
mov edx, 0x1d
mov r9d, ebx
call fcn.140045d20
lea rcx, [rbp - 0x18]
call fcn.140006bec
lea rcx, [rbp - 0x30]
call fcn.140006bec
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14004e1ec
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x60
mov rdi, qword [0x1400cc688]
lea r13, section..data
lea r12, [0x1400ae358]
mov rcx, qword [section..data]
cmp rcx, r13
je 0x14004e242
test byte [rcx + 0x1c], 1
je 0x14004e242
mov edx, 0x4d
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.140045cf4
mov ebx, 1
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov r9d, 0x20119
lea r8, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x20]
call fcn.140005e00
test eax, eax
jne 0x14004e2cd
and dword [rbp + 0x30], eax
lea r8, [rbp + 0x30]
lea rdx, str.SkipFirewallCheckOnUPnPAction
lea rcx, [rbp - 0x20]
call fcn.14003ac44
test eax, eax
jne 0x14004e2cd
lea esi, [rbx + 4]
mov rcx, qword [section..data]
cmp rcx, r13
je 0x14004e3ed
test byte [rcx + 0x1c], 2
je 0x14004e3ed
cmp byte [rcx + 0x19], sil
jb 0x14004e3ed
lea edx, [rbx + 0x4d]
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.140045cf4
jmp 0x14004e3ed
lea rdx, [rdi + 0x288]
lea rcx, [rbp - 0x30]
call fcn.140049a40
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
nop dword [rax + rax]
sub rax, qword [rdi + 0x2c0]
mov ecx, dword [0x1400ca1ec]
mov esi, 5
cmp rax, rcx
jae 0x14004e30c
mov ebx, dword [rdi + 0x2b8]
jmp 0x14004e3e4
lea r14, [rdi + 0x2b0]
cmp qword [r14], 0
jne 0x14004e380
mov qword [rsp + 0x20], r14
lea r9, [0x1400ae218]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x1400ae228]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop dword [rax + rax]
mov r9d, eax
mov r10, qword [section..data]
cmp r10, r13
je 0x14004e380
test byte [r10 + 0x1c], 2
je 0x14004e380
mov ecx, 2
test eax, eax
cmovns ecx, esi
movzx eax, byte [r10 + 0x19]
cmp eax, ecx
jb 0x14004e380
mov rax, qword [r14]
mov edx, 0x4f
mov qword [rsp + 0x20], rax
mov r8, r12
mov rcx, qword [r10 + 0x10]
call fcn.140052b04
mov rcx, qword [r14]
test rcx, rcx
je 0x14004e3e4
lea r8, [rbp + 0x30]
call fcn.140034940
test eax, eax
js 0x14004e39e
mov eax, dword [rbp + 0x30]
neg eax
sbb ecx, ecx
and ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
nop dword [rax + rax]
mov qword [rdi + 0x2c0], rax
mov dword [rdi + 0x2b8], ebx
mov rcx, qword [section..data]
cmp rcx, r13
je 0x14004e3e4
test byte [rcx + 0x1c], 2
je 0x14004e3e4
cmp byte [rcx + 0x19], sil
jb 0x14004e3e4
mov edx, 0x50
mov r9d, ebx
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.140045d20
nop
lea rcx, [rbp - 0x30]
call fcn.140049f84
lea rcx, [rdi + 0x70]
mov rdx, qword [rdi + 0x2c0]
call fcn.140040cec
mov rcx, qword [section..data]
cmp rcx, r13
je 0x14004e42a
test byte [rcx + 0x1c], 1
je 0x14004e42a
cmp byte [rcx + 0x19], sil
jb 0x14004e42a
mov edx, 0x51
mov r9d, ebx
mov r8, r12
mov rcx, qword [rcx + 0x10]
call fcn.140045d20
nop
lea rcx, [rbp - 0x20]
call fcn.140006bec
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x140051810
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
sub rsp, 0x38
mov rcx, qword [rcx]
lea rax, [r11 + 0x18]
mov r9d, 4
xor r8d, r8d
mov dword [r11 - 0x10], r9d
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
add rsp, 0x38
ret

Function at 0x140051a3c
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
xor r9d, r9d
test r8, r8
jne 0x140051a53
mov ecx, 0x80004005
call fcn.1400407c4
int3
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r9w
jne 0x140051a57
mov rcx, qword [rcx]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
add rsp, 0x38
ret
Function at 0x14006532c
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov esi, ebp
mov edi, ebp
call fcn.140065a5c
test eax, eax
je 0x140065507
call fcn.1400659e4
test eax, eax
je 0x140065507
lea r14, [0x1400cac90]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
xorps xmm0, xmm0
mov dword [0x1400cc8b0], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
movups xmmword [0x1400cc630], xmm0
movups xmmword [0x1400cc640], xmm0
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [0x1400cc648], rax
test rax, rax
jne 0x140065485
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
je 0x14006546f
mov rcx, r14
mov dword [0x1400cc8b0], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, qword [0x1400cc8b8]
test esi, esi
mov rcx, r14
cmovne rax, rbp
mov qword [0x1400cc8b8], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
test edi, edi
je 0x140065421
lea rcx, [0x1400cc630]
call qword [sym.imp.IPHLPAPI.DLL_CancelIPChangeNotify]
nop dword [rax + rax]
mov rcx, qword [0x1400cc648]
test rcx, rcx
je 0x140065439
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [0x1400cc8c8]
xorps xmm0, xmm0
movups xmmword [0x1400cc630], xmm0
movups xmmword [0x1400cc640], xmm0
test rcx, rcx
je 0x140065462
call fcn.140044524
mov qword [0x1400cc8c8], rbp
mov qword [0x1400cc8c0], rbp
mov dword [0x1400cc8ac], ebp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140065540
mov dword [rsp + 0x28], ebp
lea r8, [0x14003e480]
or dword [rsp + 0x20], 0xffffffff
lea rcx, [0x1400cc8b8]
xor r9d, r9d
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x1400653b8
lea rdx, [0x1400cc630]
mov esi, 1
lea rcx, [0x1400cc8c0]
call qword [sym.imp.IPHLPAPI.DLL_NotifyAddrChange]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0x3e5
jne 0x1400653c6
lea rcx, [0x1400cc8c8]
mov edi, esi
call fcn.140065680
mov ebx, eax
test eax, eax
jne 0x1400653c6
mov ebx, ebp
mov dword [0x1400cc8ac], esi
jmp 0x14006546f
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x14006553b
test byte [rcx + 0x1c], 4
je 0x14006553b
cmp byte [rcx + 0x19], 2
jb 0x14006553b
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400afb78]
mov edx, SafeArrayUnlock
call fcn.140045cf4
mov eax, 0x8000ffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140069a5c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x140069a7f
mov eax, 0x8000ffff
jmp 0x140069bd2
add rcx, 0x38
call fcn.14003d1c4
test eax, eax
js 0x140069bd2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x140069ac2
lea rcx, [rbx + 0x38]
call fcn.14006aa10
call fcn.14004ac90
jmp 0x140069bd2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x140069b01
call fcn.14004ac90
mov rcx, rbx
mov edi, eax
call fcn.14006a87c
test eax, eax
jns 0x140069bd0
test edi, edi
cmovns edi, eax
jmp 0x140069bd0
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.1400686c8
mov esi, eax
test eax, eax
jns 0x140069b33
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rbx
call fcn.14006a87c
mov eax, esi
jmp 0x140069bd2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140069ae0
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.1400686c8
mov edi, eax
test eax, eax
jns 0x140069b7e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rbx
call fcn.14006a87c
jmp 0x140069bd0
lea rax, [rbx + 8]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14006aa40]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov qword [rbx], rax
test rax, rax
je 0x140069ae0
mov rcx, qword [rbx + 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x140069bd0
call fcn.14004ac90
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007c07c
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r15
push rbp
lea rbp, [rax - 0x1c8]
sub rsp, 0x2c0
mov rax, qword [0x1400ca1c0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor ebx, ebx
lea rdi, [0x1400aab10]
lea r15, [0x1400ca460]
lea rcx, [rsp + 0x40]
call fcn.1400096e0
nop
lea r8, [rsp + 0x40]
mov rdx, qword [rbx + rdi + 8]
mov rcx, r15
call fcn.14002fbe0
cmp al, 1
jne 0x14007c0ef
mov edx, 0x2c
lea rcx, [rsp + 0x40]
call fcn.14000d320
mov rdx, qword [rbx + rdi]
lea rcx, [rsp + 0x40]
call fcn.14000ee80
mov r8, qword [rsp + 0x40]
mov rdx, qword [rbx + rdi + 8]
mov rcx, r15
call fcn.140016d20
nop
lea rcx, [rsp + 0x40]
call fcn.1400043f0
add rbx, 0x10
cmp rbx, 0x100
jb 0x14007c0bf
and qword [rsp + 0x78], 0
and qword [rbp - 0x80], 0
and qword [rbp - 0x78], 0
mov r9d, 0x20019
lea r8, str.SoftwareMicrosoftMultimediaWMPlayerExtensions_
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x78]
call fcn.140005e00
test eax, eax
jne 0x14007c2b5
xor edi, edi
mov dword [rsp + 0x58], 0x104
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x60]
mov edx, edi
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14007c2ab
lea rsi, [rbp - 0x5e]
lea rcx, [rbp - 0x60]
lea eax, [rbx + 0x2e]
cmp ax, word [rbp - 0x60]
cmovne rsi, rcx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x40]
mov rdx, rsi
mov rcx, r15
call fcn.14002a010
test rax, rax
jne 0x14007c2ab
and qword [rsp + 0x60], rax
and qword [rsp + 0x68], rax
and qword [rsp + 0x70], rax
mov r9d, 0x20019
lea r8, [rbp - 0x60]
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x60]
call fcn.140005e00
mov ebx, eax
test eax, eax
jne 0x14007c2a1
lea rcx, [rsp + 0x50]
call fcn.1400096e0
nop
lea r8, [rsp + 0x50]
lea rdx, str.Content_Type
lea rcx, [rsp + 0x60]
call fcn.140005978
mov ebx, eax
test eax, eax
jne 0x14007c296
lea rcx, [rsp + 0x48]
call fcn.1400096e0
nop
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.14002fbe0
cmp al, 1
jne 0x14007c26b
lea edx, [rbx + 0x2c]
lea rcx, [rsp + 0x48]
call fcn.14000d320
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14000ee80
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140016d20
nop
lea rcx, [rsp + 0x48]
call fcn.1400043f0
nop
lea rcx, [rsp + 0x50]
call fcn.1400043f0
nop
lea rcx, [rsp + 0x60]
call fcn.140006bec
inc edi
test ebx, ebx
je 0x14007c15f
lea rcx, [rsp + 0x78]
call fcn.140006bec
xor eax, eax
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140044080
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400881fc
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
lea rdx, str.SELECT_System.ItemNameDisplay__System.FileAttributes_FROM_SystemIndex_WHERE_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_stream__AND_NOT_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_hidden__AND_NOT_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_link__AND_System.Shell.OmitFromView___true_AND_System.ContentType_IS_NOT_NULL
lea rcx, [rsp + 0x70]
call fcn.140017070
nop
lea rcx, [rdi + 8]
lea r8, [rsp + 0x70]
mov edx, 7
call fcn.140036b14
mov ebx, eax
test eax, eax
js 0x1400882e3
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
movabs r10, 0xf791a6dd10db7370
mov r8, qword [rsp + 0x70]
lea rdx, [0x1400aff78]
mov rax, qword [rax + 0x38]
call qword [case.0x140028cb6.0]
mov ebx, eax
test eax, eax
js 0x1400882e3
and qword [rsp + 0x60], 0
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
movabs r10, 0xa2c927ca3ed3c970
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, [0x1400b8778]
xor edx, edx
mov rax, qword [rax + 0x20]
call qword [case.0x140028cb6.0]
mov ebx, eax
test eax, eax
js 0x1400882d8
lea r9, [rdi + 0x30]
mov r8, rsi
mov rdx, qword [rsp + 0x60]
call fcn.14008cfa8
mov ebx, eax
test eax, eax
js 0x1400882d8
lea rcx, [rdi + 0x28]
mov rdx, qword [rsp + 0x60]
cmp qword [rcx], rdx
je 0x1400882d8
call fcn.14000a0a0
nop
lea rcx, [rsp + 0x60]
call fcn.1400216ec
nop
lea rcx, [rsp + 0x70]
call fcn.1400043f0
mov eax, ebx
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140088300
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rsi, rdx
mov rbx, rcx
lea rcx, [rbp + 0x30]
call fcn.1400096e0
nop
lea r8, [rbp + 0x30]
mov edx, dword [rbx + 0x18]
call fcn.1400369d8
lea r8, [rbp + 0x30]
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.140036b14
mov edi, eax
test eax, eax
js 0x140088488
cmp qword [rbx + 0x28], 0
je 0x140088368
lea rdx, [0x1400ae628]
lea rcx, [rbp + 0x30]
call fcn.14000ee80
mov rdx, qword [rbx + 0x28]
lea rcx, [rbp + 0x30]
call fcn.14000ee80
lea rcx, [rbp + 0x20]
call fcn.1400096e0
nop
mov r8, qword [rbx + 0x20]
mov qword [rsp + 0x20], r8
mov r9, r8
lea rdx, str.GROUP_ON__s_AGGREGATE_ChildCount___ORDER_BY__s_ASC_OVER__SELECT__s_FROM_SystemIndex_WHERE_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_stream__AND_NOT_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_hidden__AND_NOT_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_link__AND_System.Shell.OmitFromView___true
lea rcx, [rbp + 0x20]
call fcn.14001c8e0
mov edx, 0x20
lea rcx, [rbp + 0x20]
call fcn.14000d320
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x20]
call fcn.14000d234
mov edx, 0x29
lea rcx, [rbp + 0x20]
call fcn.14000d320
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
movabs r10, 0xf791a6dd10db7370
mov r8, qword [rbp + 0x20]
lea rdx, [0x1400aff78]
mov rax, qword [rax + 0x38]
call qword [case.0x140028cb6.0]
mov edi, eax
test eax, eax
js 0x140088441
and qword [rbp + 0x38], 0
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
movabs r10, 0xa2c927ca3ed3c970
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, [0x1400b8778]
xor edx, edx
mov rax, qword [rax + 0x20]
call qword [case.0x140028cb6.0]
mov edi, eax
test eax, eax
js 0x140088438
mov r8, rsi
mov rdx, qword [rbp + 0x38]
mov rcx, rbx
call fcn.140005fa0
mov edi, eax
lea rcx, [rbp + 0x38]
call fcn.1400216ec
lea rax, section..data
mov rcx, qword [section..data]
cmp rcx, rax
je 0x14008847e
test byte [rcx + 0x1c], 2
je 0x14008847e
cmp byte [rcx + 0x19], 5
jb 0x14008847e
mov eax, dword [rsi + 8]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x10]
call fcn.14008d688
nop
lea rcx, [rbp + 0x20]
call fcn.1400043f0
nop
lea rcx, [rbp + 0x30]
call fcn.1400043f0
mov eax, edi
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400884a8
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rdx, [rbp - 0x18]
mov rcx, qword [rcx]
call fcn.14003b208
nop
lea rcx, [rbp + 0x38]
call fcn.1400096e0
nop
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x18]
call fcn.14008a438
mov ebx, eax
test eax, eax
js 0x1400885c1
lea rdx, str.SELECT_System.ItemNameDisplay__System.ItemUrl_FROM_SystemIndex_WHERE_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_stream__AND_NOT_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_hidden__AND_System.Shell.OmitFromView___true_AND__System.ItemType__.wpl_OR_System.ItemType__.m3u_
lea rcx, [rbp + 0x20]
call fcn.140017070
nop
lea rdx, [0x1400ae628]
lea rcx, [rbp + 0x20]
call fcn.14000ee80
lea rdx, [rbp + 0x38]
lea rcx, [rbp + 0x20]
call fcn.14000d234
lea rdx, str._ORDER_BY_System.ItemNameDisplay_ASC
lea rcx, [rbp + 0x20]
call fcn.14000ee80
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
movabs r10, 0xf791a6dd10db7370
mov r8, qword [rbp + 0x20]
lea rdx, [0x1400aff78]
mov rax, qword [rax + 0x38]
call qword [case.0x140028cb6.0]
mov ebx, eax
test eax, eax
js 0x1400885b7
and qword [rbp + 0x30], 0
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
movabs r10, 0xa2c927ca3ed3c970
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, [0x1400b8778]
xor edx, edx
mov rax, qword [rax + 0x20]
call qword [case.0x140028cb6.0]
mov ebx, eax
test eax, eax
js 0x1400885ad
mov r8, rsi
mov rdx, qword [rbp + 0x30]
mov rcx, rdi
call fcn.140005fa0
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.1400216ec
nop
lea rcx, [rbp + 0x20]
call fcn.1400043f0
nop
lea rcx, [rbp + 0x38]
call fcn.1400043f0
nop
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x14008cee8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ca1c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rdx
mov rcx, r9
mov rdx, r8
mov rdi, r9
call fcn.14000d234
lea rdx, [0x1400b2b24]
mov rcx, rdi
call fcn.14000ee80
mov r10, qword [rbx]
or r8, 0xffffffffffffffff
xor r9d, r9d
inc r8
cmp word [r10 + r8*2], r9w
jne 0x14008cf2e
mov ecx, 0x811c9dc5
add r8, r8
je 0x14008cf57
movzx edx, byte [r9 + r10]
inc r9
imul ecx, ecx, 0x1000193
xor ecx, edx
cmp r9, r8
jb 0x14008cf42
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x11]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__ultow_s]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000ee80
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140044080
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x14008cfa8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14, r9
mov r15, r8
mov rsi, rdx
and qword [rbp - 8], 0
lea rax, section..data
mov rcx, qword [section..data]
cmp rcx, rax
je 0x14008d002
test byte [rcx + 0x1c], 2
je 0x14008d002
cmp byte [rcx + 0x19], 5
jb 0x14008d002
mov edx, SafeArrayGetDim
lea r8, [0x1400b87e0]
mov rcx, qword [rcx + 0x10]
call fcn.140045cf4
mov rax, qword [rsi]
movabs r10, 0xdee01e7974d59970
lea r8, [rbp - 8]
lea rdx, [0x1400b87b8]
mov rcx, rsi
mov rax, qword [rax]
call qword [case.0x140028cb6.0]
mov ebx, eax
test eax, eax
js 0x14008d1af
lea rcx, [rbp + 0x30]
call fcn.1400865f8
mov ebx, eax
test eax, eax
js 0x14008d1af
mov rdi, qword [rbp + 0x30]
mov rax, qword [rdi]
movabs r10, 0xfd41b67356dad870
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x140028cb6.0]
mov rdx, qword [rbp - 8]
xor ebx, ebx
mov qword [rdi + 0x48], r15
lea rcx, [rdi + 0x50]
cmp qword [rcx], rdx
je 0x14008d079
call fcn.14000a0a0
lea rax, [rdi + 0x68]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x14003e720]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop dword [rax + rax]
mov qword [rdi + 0x60], rax
test rax, rax
jne 0x14008d0c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14008d0c4
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x14008d194
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8d, 1
lea rdx, [0x1400b87f0]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_ConnectToConnectionPoint]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x14008d194
and dword [rbp - 0x10], 0
and dword [rbp + 0x30], 0
and dword [rbp + 0x38], 0
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
movabs r10, 0xec259e0230532870
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x10]
mov rax, qword [rax + 0x28]
call qword [case.0x140028cb6.0]
cmp dword [rbp + 0x30], 0
jne 0x14008d16c
cmp dword [rbp + 0x38], 0
jne 0x14008d16c
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r14
mov r9, rsi
xor r8d, r8d
lea rdx, [0x1400b87f0]
xor ecx, ecx
call qword [sym.imp.SHLWAPI.dll_ConnectToConnectionPoint]
nop dword [rax + rax]
mov ebx, 0x80070490
jmp 0x14008d194
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
movabs r10, 0x8a19bee810dc5370
mov edx, 2
mov r8d, 0x3e8
mov rax, qword [rax + 0x18]
call qword [case.0x140028cb6.0]
mov ebx, eax
mov rax, qword [rdi]
movabs r10, 0xbaac1f10365eb170
mov rcx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x140028cb6.0]
nop
lea rcx, [rbp - 8]
call fcn.1400216ec
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret