joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005de0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
push rdi
sub rsp, 0x458
mov rax, qword [0x14000f010]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140005e1d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005e1d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rdi]
test ax, ax
je 0x140005f2e
mov qword [rsp + 0x480], rbp
mov rdx, rdi
mov rcx, rdi
cmp ax, 0x2f
je 0x140005e43
cmp ax, 0x5c
jne 0x140005e46
mov rdx, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140005e37
xor ebp, ebp
mov qword [rsp + 0x450], rsi
cmp rdx, rdi
je 0x140005ea4
sub rdx, rdi
lea rcx, [rsp + 0x230]
sar rdx, 1
lea rsi, [rdx + rdx]
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp rsi, 0x208
jae 0x140005f48
lea rdx, [rsp + 0x230]
mov word [rsp + rsi + 0x230], bp
mov rcx, rbx
call fcn.140005de0
mov word [rsp + 0x20], bp
test rbx, rbx
je 0x140005ed0
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140005ec0
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], bp
lea rcx, [rcx + 2]
jne 0x140005ee0
xor edx, edx
nop dword [rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140005ef0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140005f1e
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rsi, qword [rsp + 0x450]
mov rbp, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400081a0
add rsp, 0x458
pop rdi
pop rbx
ret
call fcn.140008338
int3
Function at 0x140006340
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, edx
mov r14, rcx
mov ecx, 0x458
call fcn.1400081c0
mov rsi, rax
mov qword [rsp + 0x58], rax
xor edx, edx
mov r8d, 0x458
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor r15d, r15d
mov qword [rsi], r15
mov rdi, 0xffffffffffffffff
mov dword [rsi + 8], edi
mov dword [rsi + 0x23c], edi
mov qword [rsi + 0x240], r15
mov qword [rsi + 0x248], r15
lea rbx, [rsi + 0x250]
mov rdx, rbx
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
lea rdi, [rdi + 1]
cmp word [rbx + rdi*2], 0
jne 0x1400063c0
movzx eax, word [rsi + rdi*2 + 0x24e]
cmp ax, 0x5c
je 0x1400063f5
cmp ax, 0x2f
je 0x1400063f5
sub rbx, 2
lea rbx, [rbx + 2]
cmp word [rbx], 0
jne 0x1400063e3
mov eax, dword [0x14000bfd8]
mov dword [rbx], eax
mov ecx, 0x30
call fcn.1400081c0
mov word [rax], 0x100
mov byte [rax + 0x18], 0
mov qword [rax + 0x20], r14
mov dword [rax + 0x28], ebp
mov dword [rax + 0x2c], r15d
mov dword [rax + 0x14], r15d
mov rcx, rax
call fcn.140004660
mov qword [rsi], rax
test rax, rax
jne 0x140006472
mov dword [0x14000f6e0], 0x200
mov rcx, qword [rsi + 0x240]
test rcx, rcx
je 0x140006442
call fcn.1400081fc
mov qword [rsi + 0x240], r15
mov rcx, qword [rsi + 0x248]
test rcx, rcx
je 0x14000645a
call fcn.1400081fc
mov qword [rsi + 0x248], r15
mov edx, 0x458
mov rcx, rsi
call fcn.1400081fc
xor eax, eax
jmp 0x14000648d
mov dword [0x14000f6e0], r15d
mov ecx, 0x10
call fcn.1400081c0
mov dword [rax], 1
mov qword [rax + 8], rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140006b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rbx, r8
mov ebp, edx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
cmp qword [rbx + 0x18], 8
jb 0x140006b5c
mov rbx, qword [rbx]
movzx edx, bp
mov r8, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140006bb4
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
test rax, rax
je 0x140006bb4
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r12d, eax
test eax, eax
je 0x140006bb4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
jne 0x140006bc5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140007030
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov rbp, rsi
cmp qword [rsi + 0x18], 8
jb 0x140006c10
mov rbp, qword [rsi]
mov rdi, qword [rsi + 0x10]
movabs rsi, 0x7ffffffffffffffe
cmp rdi, rsi
ja 0x140006d25
mov qword [rsp + 0x38], 7
cmp rdi, 8
jae 0x140006c49
mov qword [rsp + 0x30], rdi
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x20], xmm0
jmp 0x140006cf4
mov rax, rdi
or rax, 7
cmp rax, rsi
ja 0x140006c64
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
mov rcx, rsi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140006d2b
add rcx, rcx
cmp rcx, 0x1000
jb 0x140006cc4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006d2b
mov rcx, rax
call fcn.1400081c0
test rax, rax
je 0x140006cbd
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140006cd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140006cd1
call fcn.1400081c0
mov rbx, rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rsi
lea r8, [rdi*2 + 2]
mov rdx, rbp
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
mov edx, r12d
mov rcx, r15
call fcn.140006660
mov ebx, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400011b0
nop
call fcn.140001110
int3
Function at 0x140006d40
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14000f010]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
sub rcx, rbx
nop dword [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140006d80
lea rax, [rsp + 0x20]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140006da0
cmp rbx, 0x103
jbe 0x140006dc5
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140006e6b
movzx eax, word [rsp + rbx*2 + 0x1e]
mov qword [rsp + 0x250], rbp
mov qword [rsp + 0x258], rsi
mov esi, 0x5c
mov qword [rsp + 0x260], rdi
cmp ax, si
je 0x140006dfa
cmp ax, 0x2f
je 0x140006dfa
mov word [rsp + rbx*2 + 0x20], si
inc rbx
xor ebp, ebp
mov edi, ebp
test rbx, rbx
je 0x140006e4e
movzx eax, word [rsp + rdi*2 + 0x20]
cmp ax, si
je 0x140006e13
cmp ax, 0x2f
jne 0x140006e46
cmp rdi, 0x105
jae 0x140006e88
xor edx, edx
mov word [rsp + rdi*2 + 0x20], bp
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
test eax, eax
je 0x140006e41
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
test eax, eax
jne 0x140006e84
mov word [rsp + rdi*2 + 0x20], si
inc rdi
cmp rdi, rbx
jb 0x140006e03
mov eax, 1
mov rsi, qword [rsp + 0x258]
mov rbp, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400081a0
add rsp, 0x240
pop rbx
ret
xor eax, eax
jmp 0x140006e53
call fcn.140008338
int3

Function at 0x140008c54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008c9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008c9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008c9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008c9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140008c9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008ca0
xor al, al
add rsp, 0x28
ret
Function at 0x140001020
Capabilities:
Encode data using xor

Disassembly:
or edx, edx
je 0x140001074
movzx r10, byte [rcx + 0x100]
movzx r11, byte [rcx + 0x101]
add r8, rdx
neg rdx
xor r9d, r9d
nop dword [rax]
inc r10b
mov al, byte [r10 + rcx]
add r11b, al
mov r9b, byte [r11 + rcx]
mov byte [r10 + rcx], r9b
add r9b, al
mov byte [r11 + rcx], al
mov al, byte [r9 + rcx]
xor byte [rdx + r8], al
inc rdx
jne 0x140001040
mov byte [rcx + 0x100], r10b
mov byte [rcx + 0x101], r11b
ret
Function at 0x1400133dc
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov dword [rax + 0x20], r9d
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov rdi, rdx
mov r14, rcx
mov r10, qword [0x140148ea8]
lea r12, [0x140148ea8]
cmp r10, r12
je 0x14001343c
test byte [r10 + 0x1c], 1
je 0x14001343c
cmp byte [r10 + 0x19], 5
jb 0x14001343c
mov r9, rcx
mov rcx, qword [r10 + 0x10]
mov dword [rax - 0x40], r8d
mov qword [rax - 0x48], rdx
call fcn.140011fd0
mov r10, qword [0x140148ea8]
xor ebx, ebx
mov dword [rsp + 0x88], ebx
lea r13, [0x1400057f8]
cmp r10, r12
je 0x140013475
test byte [r10 + 0x1c], 2
je 0x140013475
cmp byte [r10 + 0x19], 5
jb 0x140013475
mov rcx, qword [r10 + 0x10]
lea edx, [rbx + 0x34]
mov r8, r13
call fcn.14000fcb0
mov r10, qword [0x140148ea8]
cmp dword [rdi + 4], 1
je 0x1400135f4
mov edx, 0x7530
mov ecx, dword [rdi + 0x18]
mov eax, edx
cmp ecx, edx
cmovb eax, ecx
cmp eax, 0x1f4
jae 0x14001349c
mov esi, 0x1f4
jmp 0x1400134a3
mov esi, edx
cmp ecx, edx
cmovb esi, ecx
cmp r10, r12
je 0x1400134ca
test byte [r10 + 0x1c], 2
je 0x1400134ca
cmp byte [r10 + 0x19], 5
jb 0x1400134ca
mov rcx, qword [r10 + 0x10]
mov edx, 0x35
mov r9d, esi
mov r8, r13
call fcn.14000fd64
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x88]
mov r9d, 0x24
mov r8, rdi
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1400135b7
cmp dword [rdi + 4], 1
je 0x140013586
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 0x7530
sub eax, ebp
cmp eax, edx
ja 0x14001352c
cmp dword [rdi + 4], 1
mov r10, qword [0x140148ea8]
jne 0x140013484
jmp 0x1400135f4
mov ebx, 0x5b4
mov r10, qword [0x140148ea8]
cmp r10, r12
je 0x140013629
test byte [r10 + 0x1c], 2
je 0x1400135f4
cmp byte [r10 + 0x19], 2
jb 0x1400135f4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140148ea8]
mov edx, 0x38
mov rcx, qword [rcx + 0x10]
mov r9d, ebp
mov r8, r13
mov dword [rsp + 0x28], 0x7530
mov dword [rsp + 0x20], eax
call fcn.140011ae0
jmp 0x1400135ed
mov r10, qword [0x140148ea8]
cmp r10, r12
je 0x140013629
test byte [r10 + 0x1c], 2
je 0x1400135f4
cmp byte [r10 + 0x19], 5
jb 0x1400135f4
mov rcx, qword [r10 + 0x10]
mov edx, 0x37
mov r8, r13
call fcn.14000fcb0
jmp 0x1400135ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r10, qword [0x140148ea8]
cmp r10, r12
je 0x140013629
test byte [r10 + 0x1c], 2
je 0x1400135f4
cmp byte [r10 + 0x19], 2
jb 0x1400135f4
mov rcx, qword [r10 + 0x10]
mov edx, 0x36
mov r9d, eax
mov r8, r13
call fcn.14000fd64
mov r10, qword [0x140148ea8]
cmp r10, r12
je 0x140013629
test byte [r10 + 0x1c], 1
je 0x140013629
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x140013629
mov rcx, qword [r10 + 0x10]
mov edx, 0x39
mov r9d, ebx
mov r8, r13
call fcn.14000fd64
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140013650
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov r9, rcx
mov rcx, qword [0x140148ea8]
lea rbp, [0x140148ea8]
cmp rcx, rbp
je 0x1400136a4
test byte [rcx + 0x1c], 1
je 0x1400136a4
cmp byte [rcx + 0x19], 5
jb 0x1400136a4
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
call fcn.140011f60
xor ebx, ebx
lea rcx, [rsp + 0x3c]
xor edx, edx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9d, [rbx + 0x24]
mov esi, eax
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea r14, [0x1400057f8]
test eax, eax
jne 0x140013733
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r10, qword [0x140148ea8]
cmp r10, rbp
je 0x1400137ed
test byte [r10 + 0x1c], 2
je 0x1400137b8
cmp byte [r10 + 0x19], 2
jb 0x1400137b8
mov rcx, qword [r10 + 0x10]
mov edx, 0x3b
mov r9d, eax
mov r8, r14
call fcn.14000fd64
jmp 0x1400137b1
cmp dword [rsp + 0x3c], 1
jne 0x14001376b
mov r10, qword [0x140148ea8]
cmp r10, rbp
je 0x1400137ed
test byte [r10 + 0x1c], 2
je 0x1400137b8
cmp byte [r10 + 0x19], 5
jb 0x1400137b8
mov rcx, qword [r10 + 0x10]
mov edx, 0x3c
mov r8, r14
call fcn.14000fcb0
jmp 0x1400137b1
cmp dword [rsp + 0x3c], 3
jne 0x140013811
mov rcx, qword [0x140148ea8]
cmp rcx, rbp
je 0x14001379f
test byte [rcx + 0x1c], 2
je 0x14001379f
cmp byte [rcx + 0x19], 5
jb 0x14001379f
mov rcx, qword [rcx + 0x10]
mov edx, 0x3d
mov r8, r14
call fcn.14000fcb0
lea rdx, [rsp + 0x38]
mov r8d, esi
mov rcx, rdi
call fcn.1400133dc
mov ebx, eax
mov r10, qword [0x140148ea8]
cmp r10, rbp
je 0x1400137ed
test byte [r10 + 0x1c], 1
je 0x1400137ed
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400137ed
mov rcx, qword [r10 + 0x10]
mov edx, 0x3f
mov r9d, ebx
mov r8, r14
call fcn.14000fd64
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140001000
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [0x140148ea8]
cmp rcx, rbp
je 0x14001383a
test byte [rcx + 0x1c], 2
je 0x14001383a
cmp byte [rcx + 0x19], 5
jb 0x14001383a
mov rcx, qword [rcx + 0x10]
mov edx, 0x3e
mov r8, r14
call fcn.14000fcb0
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14001379f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400137af
Function at 0x14001c758
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
call fcn.1400e56b8
lea rdx, [0x140005590]
xor ebx, ebx
and qword [rsp + 0x58], rbx
mov esi, eax
lea rax, [rsp + 0x58]
mov r9d, 0x2011f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14001c7aa
mov rbx, qword [rsp + 0x58]
mov rcx, qword [0x140148ea8]
lea rbp, [0x140148ea8]
mov r14d, 5
cmp rcx, rbp
je 0x14001c7f9
lea edx, [r14 - 3]
test byte [rcx + 0x1c], dl
je 0x14001c7f9
movzx eax, byte [rcx + 0x19]
test edi, edi
cmove edx, r14d
cmp eax, edx
jl 0x14001c7f9
mov rcx, qword [rcx + 0x10]
lea r8, [0x140005d50]
mov edx, SafeArrayPtrOfIndex
mov r9d, edi
call fcn.14000fd64
mov rcx, qword [0x140148ea8]
test edi, edi
jne 0x14001c82e
lea r9d, [rdi + 4]
lea rax, [rsp + 0x50]
lea rdx, [0x14001c880]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x140148ea8]
cmp rcx, rbp
je 0x14001c857
test byte [rcx + 0x1c], 1
je 0x14001c857
cmp byte [rcx + 0x19], r14b
jb 0x14001c857
mov rcx, qword [rcx + 0x10]
lea r8, [0x140005d50]
mov edx, SafeArrayPtrOfIndex
mov r9d, esi
call fcn.14000fd64
test rbx, rbx
je 0x14001c865
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov eax, esi
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14002586c
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rcx, qword [0x140148ea8]
lea rsi, [0x140148ea8]
cmp rcx, rsi
je 0x1400258b2
test byte [rcx + 0x1c], 1
je 0x1400258b2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140005d50]
mov edx, 0x13d
call fcn.14000fcb0
xor r13d, r13d
lea rax, [rbp + 0x48]
mov ebx, 1
lea r9, [rbp + 0x58]
xor edx, edx
xor ecx, ecx
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x58], r13
mov dword [rbp + 0x48], r13d
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov edi, eax
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x140025925
test byte [rcx + 0x1c], 2
je 0x140025925
cmp byte [rcx + 0x19], 5
jb 0x140025925
mov eax, dword [rbp + 0x48]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140005d50]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x58]
mov edx, 0x13e
mov r9d, edi
mov qword [rsp + 0x20], rax
call fcn.1400179a8
mov rcx, qword [0x140148ea8]
test edi, edi
je 0x140025a35
cmp dword [rbp + 0x48], r13d
jne 0x14002593b
mov ebx, r13d
jmp 0x140025a20
mov esi, r13d
mov r14d, r13d
mov edi, r13d
lea rbx, [0x140148ea8]
cmp edi, dword [rbp + 0x48]
jae 0x140025a09
mov rcx, qword [rbp + 0x58]
mov eax, edi
lea r15, [rax + rax*2]
mov eax, dword [rcx + r15*8 + 0x10]
test eax, eax
je 0x140025973
add eax, 0xfffffffd
cmp eax, 1
ja 0x1400259ff
mov qword [rbp + 0x60], r13
mov dword [rbp + 0x50], r13d
mov edx, dword [rcx + r15*8]
lea rax, [rbp + 0x50]
lea r9, [rbp + 0x60]
mov r8d, 5
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov r12d, eax
mov rcx, qword [0x140148ea8]
cmp rcx, rbx
je 0x1400259db
test byte [rcx + 0x1c], 2
je 0x1400259db
cmp byte [rcx + 0x19], 5
jb 0x1400259db
mov rax, qword [rbp + 0x60]
mov rcx, qword [rcx + 0x10]
mov r9d, edi
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x58]
mov dword [rsp + 0x28], r12d
mov edx, dword [rax + r15*8]
mov dword [rsp + 0x20], edx
call fcn.140017710
test r12d, r12d
je 0x1400259f9
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x1400259f9
cmp r13w, word [rcx]
je 0x1400259f1
inc esi
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
jmp 0x1400259ff
mov r14d, 1
inc edi
test esi, esi
je 0x14002594b
mov ebx, 1
test r14d, r14d
jne 0x140025a19
test esi, esi
cmove ebx, r13d
lea rsi, [0x140148ea8]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rcx, qword [0x140148ea8]
mov qword [rbp + 0x58], r13
cmp rcx, rsi
je 0x140025a5e
test byte [rcx + 0x1c], 1
je 0x140025a5e
cmp byte [rcx + 0x19], 5
jb 0x140025a5e
mov rcx, qword [rcx + 0x10]
lea r8, [0x140005d50]
mov edx, 0x140
mov r9d, ebx
call fcn.14000fd64
mov eax, ebx
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140045388
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov esi, ebp
mov edi, ebp
call fcn.140046810
test eax, eax
je 0x140045513
call fcn.140046bdc
test eax, eax
je 0x140045513
lea r14, [0x14014b390]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8d, [rbp + 0x20]
lea rcx, [0x14014cd90]
xor edx, edx
mov dword [0x14014d17c], ebp
call sub.msvcrt.dll_memset
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14014cda8], rax
test rax, rax
je 0x14004542c
lea r8, [0x140044f70]
lea rcx, [0x14014d180]
xor r9d, r9d
mov rdx, rax
mov dword [rsp + 0x28], ebp
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x140045436
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140045474
lea rdx, [0x14014cd90]
lea rcx, [0x14014d188]
mov esi, 1
call qword [sym.imp.IPHLPAPI.DLL_NotifyAddrChange]
mov ebx, eax
cmp eax, 0x3e5
jne 0x140045474
lea rcx, [0x14014d190]
mov edi, esi
call fcn.140044ef0
mov ebx, eax
test eax, eax
jne 0x14004547c
mov ebx, ebp
mov dword [0x14014d178], esi
test ebx, ebx
je 0x140045506
mov rcx, r14
mov dword [0x14014d17c], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x14014d180]
test esi, esi
cmovne rax, rbp
mov rcx, r14
mov qword [0x14014d180], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x1400454bd
lea rcx, [0x14014cd90]
call qword [sym.imp.IPHLPAPI.DLL_CancelIPChangeNotify]
mov rcx, qword [0x14014cda8]
test rcx, rcx
je 0x1400454cf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [0x14014cd90]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [0x14014d190]
test rcx, rcx
je 0x1400454f9
call sub.msvcrt.dll_free
mov qword [0x14014d190], rbp
mov qword [0x14014d188], rbp
mov dword [0x14014d178], ebp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x14004554c
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x140045547
test byte [rcx + 0x1c], 4
je 0x140045547
cmp byte [rcx + 0x19], 2
jb 0x140045547
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400060e8]
mov edx, SafeArrayAccessData
call fcn.14000fcb0
mov eax, 0x8000ffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140046c4c
Capabilities:
Check http status code

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov edi, edx
mov rsi, rcx
and dword [rax - 0x18], 0
lea rbp, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rbp
je 0x140046cac
test byte [rcx + 0x1c], 1
je 0x140046cac
cmp byte [rcx + 0x19], 5
jb 0x140046cac
mov edx, 0xa
mov r9d, edi
lea r8, [0x140006108]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x20], 1
cmp edi, 0x192
je 0x140046d1f
cmp edi, 0x194
je 0x140046d1f
cmp edi, 0x1f5
je 0x140046d1f
lea eax, [rdi - 0x2bd]
cmp eax, 0x13
ja 0x140046d05
mov ecx, 0x81fbf
bt ecx, eax
jb 0x140046d1f
cmp edi, 0x321
je 0x140046d1f
mov r8d, edi
mov edx, 0x67
mov rcx, rsi
call fcn.140047310
jmp 0x140046d39
mov ecx, edi
call fcn.1400111d0
test rax, rax
je 0x140046d39
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.140011310
mov rcx, qword [0x140148ea8]
cmp rcx, rbp
je 0x140046d69
test byte [rcx + 0x1c], 1
je 0x140046d69
cmp byte [rcx + 0x19], 5
jb 0x140046d69
mov edx, reloc.WSOCK32.dll_inet_ntoa
mov r9, qword [rsi]
lea r8, [0x140006108]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcd0
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret