joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006c780
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp - 8], rax
and dword [rbp - 0x10], 0
mov r15, r9
xor ebx, ebx
mov dword [rbp - 0x1c], 0
mov qword [rbp - 0x18], rbx
mov rsi, r8
mov r13, rcx
test byte [0x1800b78f3], 0x20
je 0x18006c7e6
mov qword [rsp + 0x20], r8
lea ecx, [rbx + 0x19]
mov r8, r13
lea r9, str.Connections
lea rdx, [0x18009f2d0]
call fcn.180089d08
test rsi, rsi
je 0x18006c7ee
and qword [rsi], rbx
test r15, r15
je 0x18006c7f6
mov dword [r15], ebx
test rsi, rsi
jne 0x18006c80c
mov edi, 0x80070057
mov dword [rbp - 0x1c], 0x16e
jmp 0x18006c903
test r15, r15
jne 0x18006c822
mov edi, 0x80070057
mov dword [rbp - 0x1c], 0x16f
jmp 0x18006c903
lea rax, [rbp - 0x10]
mov r9d, 0x20
mov qword [rsp + 0x30], rax
lea r8, str.Connections
and qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], rbx
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
movzx r14d, ax
mov r12d, eax
or r14d, 0x80070000
mov edi, eax
test eax, eax
jle 0x18006c86a
mov edi, r14d
test edi, edi
jns 0x18006c87a
mov dword [rbp - 0x1c], 0x179
jmp 0x18006c903
mov ecx, dword [rbp - 0x10]
lea rdx, [rbp - 0x18]
add ecx, 2
call fcn.18006c428
mov rbx, qword [rbp - 0x18]
mov edi, eax
test eax, eax
jns 0x18006c89c
mov dword [rbp - 0x1c], 0x17b
jmp 0x18006c903
lea rax, [rbp - 0x10]
mov r9d, 0x20
mov qword [rsp + 0x30], rax
lea r8, str.Connections
mov qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x18006c8dd
mov dword [rbp - 0x1c], 0x183
jmp 0x18006c903
test r12d, r12d
mov edi, r14d
cmovle edi, r12d
test edi, edi
jns 0x18006c8f4
mov dword [rbp - 0x1c], 0x184
jmp 0x18006c903
mov eax, dword [rbp - 0x10]
mov qword [rsi], rbx
xor ebx, ebx
mov qword [rbp - 0x18], rbx
mov dword [r15], eax
test byte [0x1800b78f3], 0x20
je 0x18006c920
mov ecx, 0x1a
lea rdx, [0x18009f2d0]
mov r8d, edi
call fcn.1800876bc
test rbx, rbx
je 0x18006c92e
lea rcx, [rbp - 0x18]
call fcn.180030b30
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18002d5c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006c95c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r13d, r13d
lea rax, [0x18009dff0]
mov dword [rbp - 0x2c], r13d
mov rdi, r8
mov dword [rbp - 0x28], r13d
mov r14, rdx
mov qword [rbp - 0x20], rax
mov r15, rcx
mov qword [rbp - 0x18], r13
test byte [0x1800b78f3], 0x20
je 0x18006c9c8
mov qword [rsp + 0x20], r8
lea ecx, [r13 + 0x17]
mov r9, rdx
mov r8, r15
lea rdx, [0x18009f2d0]
call fcn.18008e3ac
test rdi, rdi
je 0x18006c9d5
mov rcx, rdi
call fcn.180026e74
test r14, r14
jne 0x18006c9eb
mov ebx, 0x80070057
mov dword [rbp - 0x2c], 0x135
jmp 0x18006cade
test rdi, rdi
jne 0x18006ca01
mov ebx, 0x80070057
mov dword [rbp - 0x2c], 0x136
jmp 0x18006cade
lea rax, [rbp - 0x28]
mov r9d, 6
mov qword [rsp + 0x30], rax
mov r8, r14
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x18006ca3d
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x18006ca4d
mov dword [rbp - 0x2c], 0x140
jmp 0x18006cade
mov edx, dword [rbp - 0x28]
lea rcx, [rbp - 0x20]
call fcn.180015988
mov ebx, eax
test eax, eax
jns 0x18006ca68
mov dword [rbp - 0x2c], 0x142
jmp 0x18006cade
mov rsi, qword [rbp - 0x20]
lea rax, [rbp - 0x28]
mov r12d, dword [rbp - 0x14]
mov r9d, 6
mov qword [rsp + 0x30], rax
mov r8, r14
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov dword [rbp - 0x28], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x18006cab0
mov dword [rbp - 0x2c], 0x14b
jmp 0x18006cade
lea rax, [0x18009dff0]
cmp rsi, rax
je 0x18006cad2
mov word [rsi + r12*2], r13w
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r13w
jne 0x18006cac5
mov dword [rbp - 0x18], eax
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.180082870
test byte [0x1800b78f3], 0x20
je 0x18006cafb
mov ecx, 0x18
lea rdx, [0x18009f2d0]
mov r8d, ebx
call fcn.1800876bc
lea rcx, [rbp - 0x20]
call fcn.180021be4
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18002d5c0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006cd30
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x180083b74
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
mov rsi, rcx
mov ebx, r12d
mov dword [rbp + 0x5c], r12d
mov qword [rbp + 0x50], rbx
mov r15d, r12d
mov qword [rbp - 0x10], r12
mov dword [rbp + 0x40], r12d
mov dword [rbp + 0x48], r12d
test byte [0x1800b78f3], 0x20
je 0x180083bc3
lea ecx, [r12 + 0x20]
mov r8, rsi
lea rdx, [0x18009f490]
call fcn.1800879b4
test rsi, rsi
je 0x180083bd2
xor eax, eax
mov rdi, rsi
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
lea r8, [rbp - 0x10]
mov edx, 1
mov ecx, 0x20019
call fcn.180085458
mov edi, eax
test eax, eax
jns 0x180083bf7
mov dword [rbp + 0x5c], 0x381
jmp 0x180083d09
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x58], r12
xor r9d, r9d
mov qword [rsp + 0x50], r12
xor r8d, r8d
mov qword [rsp + 0x48], r12
xor edx, edx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyA]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x180083c4a
movzx edi, ax
or edi, 0x80070000
test edi, edi
jns 0x180083c5a
mov dword [rbp + 0x5c], 0x383
jmp 0x180083d09
mov eax, dword [rbp + 0x40]
test eax, eax
jne 0x180083c69
mov edi, r12d
jmp 0x180083d09
imul ecx, eax, 0x82
lea rdx, [rbp + 0x50]
call fcn.18008330c
mov rbx, qword [rbp + 0x50]
mov edi, eax
test eax, eax
jns 0x180083c8b
mov dword [rbp + 0x5c], 0x38a
jmp 0x180083d09
mov r14d, r12d
cmp dword [rbp + 0x40], r12d
jbe 0x180083cfb
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x48]
mov qword [rsp + 0x38], r12
mov edx, r14d
mov eax, r15d
imul r8, rax, 0x82
mov qword [rsp + 0x30], r12
add r8, rbx
mov qword [rsp + 0x28], r12
mov dword [rbp + 0x48], 0x41
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
cmp eax, 0x103
je 0x180083cfb
test eax, eax
jg 0x180083ce2
mov edi, eax
jmp 0x180083ceb
movzx edi, ax
or edi, 0x80070000
test edi, edi
js 0x180083d64
inc r15d
inc r14d
cmp r14d, dword [rbp + 0x40]
jb 0x180083c94
mov qword [rsi + 8], rbx
mov rbx, r12
mov qword [rbp + 0x50], rbx
mov dword [rsi], r15d
test byte [0x1800b78f3], 0x20
je 0x180083d26
mov ecx, 0x21
lea rdx, [0x18009f490]
mov r8d, edi
call fcn.1800876bc
mov ecx, edi
call fcn.180011928
mov edi, eax
test rbx, rbx
je 0x180083d3d
lea rcx, [rbp + 0x50]
call fcn.180030b30
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x180083d52
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rbp + 0x5c], 0x394
jmp 0x180083d09
Function at 0x18006f580
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
test byte [0x1800b78f1], 4
mov rbx, rdx
je 0x18006f6ef
test rcx, rcx
lea r8, str.Adapter_Info:
cmovne r8, rcx
test rdx, rdx
jne 0x18006f5c9
lea ecx, [rdx + 0x78]
lea rdx, [0x18009f390]
call fcn.180087e84
jmp 0x18006f6ef
mov eax, dword [rdx + 0x58]
mov r9, rbx
mov dword [rsp + 0x88], eax
mov eax, dword [rdx + 0x54]
mov dword [rsp + 0x80], eax
mov eax, dword [rdx + 0x50]
mov dword [rsp + 0x78], eax
mov eax, dword [rdx + 0x4c]
mov dword [rsp + 0x70], eax
mov eax, dword [rdx + 0x48]
mov dword [rsp + 0x68], eax
mov eax, dword [rdx + 0x44]
mov dword [rsp + 0x60], eax
mov eax, dword [rdx + 0x40]
mov dword [rsp + 0x58], eax
mov eax, dword [rdx + 0x3c]
mov dword [rsp + 0x50], eax
mov eax, dword [rdx + 0x38]
mov dword [rsp + 0x48], eax
mov eax, dword [rdx + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rdx + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rdx + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rdx]
mov qword [rsp + 0x20], rax
call fcn.180090738
mov rdx, qword [rbx + 0x10]
lea rcx, str.Search_List:
call fcn.1800721b4
mov rdx, qword [rbx + 0x18]
lea rcx, str.Supplemental_Search_List:
call fcn.1800721b4
mov rsi, qword [rbx + 0x28]
test rsi, rsi
je 0x18006f6d3
xor edi, edi
cmp dword [rsi + 4], edi
jbe 0x18006f6d3
mov eax, edi
lea r8, [rsi + 0x20]
shl rax, 6
add r8, rax
test byte [0x1800b78f1], 4
je 0x18006f6cc
mov eax, dword [r8 + 0x2c]
mov edx, dword [r8 + 0x28]
movzx ecx, word [r8 + 2]
movzx r9d, word [r8]
mov dword [rsp + 0x58], eax
mov eax, dword [r8 + 0x30]
mov dword [rsp + 0x50], edx
mov dword [rsp + 0x48], eax
mov eax, dword [r8 + 0x24]
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], eax
mov eax, dword [r8 + 0x20]
mov r8d, edi
mov dword [rsp + 0x20], eax
call fcn.18008fb7c
inc edi
cmp edi, dword [rsi + 4]
jb 0x18006f670
mov r8, qword [rbx + 0x20]
test r8, r8
je 0x18006f6ef
lea rdx, str._tAddr
lea rcx, str._tLocal_Addrs
call fcn.18006f780
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1800723bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rsp + 0x90]
or r13, 0xffffffffffffffff
xor esi, esi
mov r14, r8
test rax, rax
mov rdi, rcx
cmovne r13, rax
cmp r13, r8
ja 0x180072401
xor eax, eax
jmp 0x180072543
lea rbp, [rcx + 0x1fe]
mov rbx, r14
lea rax, [rbp - 0x54]
cmp rcx, rax
jae 0x180072521
movzx eax, byte [rbx]
inc rbx
mov r15b, al
and r15b, 0xc0
test byte [0x1800b78f3], 1
mov r12d, eax
je 0x18007244b
movzx eax, r15b
mov r9d, r12d
mov dword [rsp + 0x28], eax
mov r8d, r12d
mov dword [rsp + 0x20], eax
call fcn.18008f7e8
mov al, r12b
mov rdx, rbp
mov rcx, rdi
sub rdx, rdi
test r15b, r15b
jne 0x1800724a3
mov r9d, r12d
lea r8, str.__d_
call fcn.18007ba7c
mov rdi, rax
movzx eax, r12b
test al, al
je 0x180072538
mov r15d, eax
mov rcx, rdi
add rax, rbx
mov qword [rsp + 0x78], rax
cmp rax, r13
jae 0x180072559
mov r8d, r15d
mov rdx, rbx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov rbx, qword [rsp + 0x78]
add rdi, r15
jmp 0x180072514
cmp r15b, 0xc0
jne 0x1800725ab
cmp rbx, r13
jae 0x18007259a
movzx r15d, al
lea r8, str.__04hX_
movzx eax, byte [rbx]
shl r15w, 8
or r15w, ax
movzx r9d, r15w
inc rbx
call fcn.18007ba7c
mov r9, qword [rsp + 0x88]
mov rdi, rax
test r9, r9
je 0x180072595
test rsi, rsi
movzx ecx, r15w
mov rax, rbx
cmovne rax, rsi
xor rcx, 0xc000
mov rsi, rax
add rcx, r9
lea rax, [rbx - 2]
cmp rcx, rax
jae 0x180072575
mov rbx, rcx
lea rax, [rbp - 0x54]
cmp rdi, rax
jb 0x180072418
lea r8, str.____ERROR_name_exceeds_safe_print_buffer_length__n
mov edx, 0x54
mov rcx, rax
call fcn.18007ba7c
mov rbx, r14
test rsi, rsi
cmove esi, ebx
sub esi, r14d
mov eax, esi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
sub rbp, rdi
mov qword [rsp + 0x20], rbx
mov rdx, rbp
lea r8, str._ERROR_length_byte:_0x_02X_at__p_leads_outside_message__n
mov r9d, r12d
call fcn.18007ba7c
jmp 0x180072535
sub rbp, rdi
mov qword [rsp + 0x20], rcx
mov rdx, rbp
lea r9, [rbx - 2]
lea r8, str._ERROR_offset_at__p_to_higher_byte_in_packet__p__n
mov rcx, rdi
call fcn.18007ba7c
jmp 0x180072538
mov byte [rax], 0
jmp 0x180072538
mov r9, rbx
lea r8, str._ERROR_compression_word_at__p_is_outside_message__n
call fcn.18007ba7c
jmp 0x180072535
mov r9d, r12d
lea r8, str._ERROR_length_byte:_0x_02X_
call fcn.18007ba7c
jmp 0x180072535
Function at 0x18007b4cc
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
xor r11d, r11d
mov rbx, rcx
test rcx, rcx
jne 0x18007b4e9
mov eax, 0x57
jmp 0x18007b5bb
test r9d, r9d
je 0x18007b5b5
add r8, 0xfffffffffffffffe
mov al, byte [r8 + 2]
dec r9d
cmp al, 0x61
jl 0x18007b509
cmp al, 0x7a
jg 0x18007b537
sub al, 0x47
jmp 0x18007b539
cmp al, 0x41
jl 0x18007b515
cmp al, 0x5a
jg 0x18007b537
sub al, 0x41
jmp 0x18007b539
cmp al, 0x30
jl 0x18007b529
cmp al, 0x39
jg 0x18007b521
add al, 4
jmp 0x18007b539
cmp al, 0x3d
jne 0x18007b537
xor al, al
jmp 0x18007b539
cmp al, 0x2b
jne 0x18007b531
mov al, 0x3e
jmp 0x18007b539
cmp al, 0x2f
mov al, 0x3f
je 0x18007b539
mov al, 0xff
inc r8
cmp al, 0x40
jae 0x18007b5ad
shl r10d, 6
inc r11d
movzx eax, al
or r10d, eax
cmp r11d, 4
jne 0x18007b59f
xor r11d, r11d
mov eax, r10d
shr eax, 0x10
mov byte [rcx], al
inc rcx
test r9d, r9d
jne 0x18007b58c
cmp byte [r8 + 1], 0x3d
jne 0x18007b58c
cmp byte [r8], 0x3d
je 0x18007b584
test r10b, r10b
jne 0x18007b5ad
shr r10d, 8
mov byte [rcx], r10b
inc rcx
jmp 0x18007b59c
test r10w, r10w
jne 0x18007b5ad
jmp 0x18007b59c
mov eax, r10d
shr eax, 8
mov byte [rcx], al
mov byte [rcx + 1], r10b
add rcx, 2
xor r10d, r10d
test r9d, r9d
jne 0x18007b4f6
test r11d, r11d
je 0x18007b5b5
mov byte [rcx], 0
jmp 0x18007b4df
sub ecx, ebx
mov dword [rdx], ecx
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x18007b5c8
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
xor r11d, r11d
mov rbx, rcx
test rcx, rcx
jne 0x18007b5ea
mov eax, 0x57
jmp 0x18007b6e4
test r9d, r9d
je 0x18007b6de
add r8, 0xfffffffffffffffc
mov edi, 4
movzx eax, word [r8 + 4]
dec r9d
cmp ax, 0x61
jb 0x18007b616
cmp ax, 0x7a
ja 0x18007b65b
sub ax, 0x47
jmp 0x18007b660
cmp ax, 0x41
jb 0x18007b628
cmp ax, 0x5a
ja 0x18007b65b
sub ax, 0x41
jmp 0x18007b660
cmp ax, 0x30
jb 0x18007b643
cmp ax, 0x39
ja 0x18007b639
add ax, di
jmp 0x18007b660
cmp ax, 0x3d
jne 0x18007b65b
xor eax, eax
jmp 0x18007b660
cmp ax, 0x2b
jne 0x18007b650
mov eax, 0x3e
jmp 0x18007b660
cmp ax, 0x2f
mov eax, 0x3f
je 0x18007b660
mov eax, 0xffff
add r8, 2
cmp al, 0x40
jae 0x18007b6d6
shl r10d, 6
inc r11d
movzx eax, al
or r10d, eax
cmp r11d, edi
jne 0x18007b6c8
xor r11d, r11d
mov eax, r10d
shr eax, 0x10
mov byte [rcx], al
inc rcx
test r9d, r9d
jne 0x18007b6b5
cmp word [r8 + 2], 0x3d
jne 0x18007b6b5
cmp word [r8], 0x3d
je 0x18007b6ad
test r10b, r10b
jne 0x18007b6d6
shr r10d, 8
mov byte [rcx], r10b
inc rcx
jmp 0x18007b6c5
test r10w, r10w
jne 0x18007b6d6
jmp 0x18007b6c5
mov eax, r10d
shr eax, 8
mov byte [rcx], al
mov byte [rcx + 1], r10b
add rcx, 2
xor r10d, r10d
test r9d, r9d
jne 0x18007b5fc
test r11d, r11d
je 0x18007b6de
mov byte [rcx], 0
jmp 0x18007b5e0
sub ecx, ebx
mov dword [rdx], ecx
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x180081f64
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov dword [rax + 0x18], r8d
push rdi
sub rsp, 0x50
and dword [rax + 0x18], 0
mov rdi, r9
mov rbx, rdx
mov dword [rsp + 0x44], 0
mov rsi, rcx
mov dword [rax + 0x20], 4
test byte [0x1800b78f3], 0x10
je 0x180081fac
mov qword [rax - 0x30], r9
mov r8, rcx
mov r9, rdx
call fcn.1800944e4
and dword [rdi], 0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov r9d, 0x10
lea rax, [rsp + 0x70]
mov r8, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
jne 0x180081ff4
xor eax, eax
mov dword [rsp + 0x70], eax
xor ebx, ebx
jmp 0x180081ff8
mov eax, dword [rsp + 0x70]
test ebx, ebx
jle 0x180082007
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x180082013
mov dword [rsp + 0x44], 0x2d1
jmp 0x180082015
mov dword [rdi], eax
test byte [0x1800b78f3], 0x10
je 0x180082032
mov ecx, 0xd
lea rdx, [0x18009f470]
mov r8d, ebx
call fcn.1800876bc
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x18008204c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r13d, r13d
lea rax, [0x18009dff0]
mov dword [rbp + 0x54], r13d
mov rdi, r8
mov dword [rbp + 0x48], r13d
mov r14, rdx
mov qword [rbp - 0x10], rax
mov r15, rcx
mov qword [rbp - 8], r13
test byte [0x1800b78f3], 0x10
je 0x1800820aa
mov qword [rsp + 0x20], r8
lea ecx, [r13 + 0xe]
mov r9, rdx
mov r8, r15
lea rdx, [0x18009f470]
call fcn.18008e3ac
test rdi, rdi
je 0x1800820b7
mov rcx, rdi
call fcn.180026e74
test r14, r14
jne 0x1800820cd
mov ebx, 0x80070057
mov dword [rbp + 0x54], 0x2ef
jmp 0x1800821cd
test rdi, rdi
jne 0x1800820e3
mov ebx, 0x80070057
mov dword [rbp + 0x54], 0x2f0
jmp 0x1800821cd
lea rax, [rbp + 0x48]
mov r9d, 6
mov qword [rsp + 0x30], rax
mov r8, r14
mov qword [rsp + 0x28], r13
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 2
jne 0x18008211f
mov ebx, r13d
jmp 0x1800821cd
test eax, eax
jle 0x18008212c
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x18008213c
mov dword [rbp + 0x54], 0x2ff
jmp 0x1800821cd
mov edx, dword [rbp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.180015988
mov ebx, eax
test eax, eax
jns 0x180082157
mov dword [rbp + 0x54], 0x301
jmp 0x1800821cd
mov rsi, qword [rbp - 0x10]
lea rax, [rbp + 0x48]
mov r12d, dword [rbp - 4]
mov r9d, 6
mov qword [rsp + 0x30], rax
mov r8, r14
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x48], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x18008219f
mov dword [rbp + 0x54], 0x30a
jmp 0x1800821cd
lea rax, [0x18009dff0]
cmp rsi, rax
je 0x1800821c1
mov word [rsi + r12*2], r13w
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r13w
jne 0x1800821b4
mov dword [rbp - 8], eax
mov rdx, rdi
lea rcx, [rbp - 0x10]
call fcn.180082870
test byte [0x1800b78f3], 0x10
je 0x1800821ea
mov ecx, 0xf
lea rdx, [0x18009f470]
mov r8d, ebx
call fcn.1800876bc
lea rcx, [rbp - 0x10]
call fcn.180021be4
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180082524
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rbx, r8
mov dword [rsp + 0x4c], ebp
mov rdi, rdx
mov rsi, rcx
test byte [0x1800b78f3], 0x10
je 0x18008255f
mov r9, rdx
mov qword [rax - 0x18], rbx
mov r8, rcx
call fcn.180094588
test rdi, rdi
jne 0x180082573
mov ebx, 0x80070057
mov dword [rsp + 0x4c], 0x328
jmp 0x1800825da
test rbx, rbx
jne 0x180082587
mov ebx, 0x80070057
mov dword [rsp + 0x4c], 0x329
jmp 0x1800825da
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x18008258b
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x1800825ce
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x1800825da
mov dword [rsp + 0x4c], 0x32c
test byte [0x1800b78f3], 0x10
je 0x1800825f7
mov ecx, 0x11
lea rdx, [0x18009f470]
mov r8d, ebx
call fcn.1800876bc
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x180082924
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x4c], 0
mov ecx, 0x7800
mov qword [rbp + 0x40], rbx
mov dword [rbp + 0x30], ecx
xor esi, esi
mov r15, rdx
test rbx, rbx
je 0x180082966
lea rcx, [rbp + 0x40]
call fcn.180030b30
mov ecx, dword [rbp + 0x30]
xor ebx, ebx
mov edx, ecx
mov qword [rbp + 0x40], rbx
mov dword [rbp + 0x4c], 0
call fcn.180030af8
mov qword [rbp - 0x10], rax
test rax, rax
jne 0x180082994
mov edi, 0x8007000e
mov dword [rbp + 0x4c], 0x59
mov r14d, edi
jmp 0x1800829a6
mov rbx, rax
mov qword [rbp + 0x40], rax
xor eax, eax
xor edi, edi
mov qword [rbp - 0x10], rax
xor r14d, r14d
test rax, rax
je 0x1800829b4
lea rcx, [rbp - 0x10]
call fcn.180030b30
test r14d, r14d
js 0x180082a48
lea rax, [rbp + 0x30]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8ae
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov edi, eax
cmp eax, 0x6f
jne 0x180082a21
mov ecx, dword [rbp + 0x30]
lea eax, [rcx - 1]
cmp eax, 0x1ffffffd
ja 0x180082a13
add ecx, 0x800
inc esi
mov dword [rbp + 0x30], ecx
cmp esi, 3
jb 0x180082955
cmp esi, 3
jb 0x180082a3b
mov edi, 0x8000ffff
mov dword [rbp + 0x4c], 0xb2
jmp 0x180082a4f
mov edi, 0x8000ffff
mov dword [rbp + 0x4c], 0xa5
jmp 0x180082a4f
test eax, eax
jle 0x180082a2e
movzx edi, ax
or edi, 0x80070000
test edi, edi
jns 0x180082a00
mov dword [rbp + 0x4c], 0x9c
jmp 0x180082a4f
xor edi, edi
mov qword [r15], rbx
xor ebx, ebx
mov qword [rbp + 0x40], rbx
jmp 0x180082a4f
mov dword [rbp + 0x4c], 0x94
test rbx, rbx
je 0x180082a5d
lea rcx, [rbp + 0x40]
call fcn.180030b30
mov rbx, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret