joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000acc0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x50
movzx eax, byte [0x140256a90]
mov rsi, r9
mov r14, r8
mov r15d, edx
mov rbx, rcx
test al, al
jne 0x14000ad31
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
bt rbx, 0x1f
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
jb 0x14000ae62
test rdx, rdx
jne 0x14000ae62
test rcx, rcx
jne 0x14000ae62
test r14, r14
je 0x14000ae4b
test rsi, rsi
je 0x14000ae4b
mov eax, dword [r9]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
lea ebp, [rax*2 + 0x16]
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x14000adb3
lea eax, [rdi + 8]
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
lea rax, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov edx, r15d
mov dword [rsp + 0x20], ebp
mov rcx, rbx
call qword [0x1401e97e8]
mov ebp, eax
test eax, eax
js 0x14000ae25
mov eax, dword [rdi + 0xc]
mov ecx, eax
shr ecx, 1
cmp ecx, dword [rsi]
jae 0x14000ae1e
lfence
lea rdx, [rdi + 0x10]
mov r8d, eax
mov rcx, r14
mov ebx, eax
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0xa8]
xor eax, eax
shr rbx, 1
mov word [r14 + rbx*2], ax
mov eax, dword [rdi + 0xc]
shr eax, 1
mov dword [rsi], eax
test rcx, rcx
je 0x14000ae35
mov rax, qword [rdi]
mov qword [rcx], rax
jmp 0x14000ae35
mov ebp, 0x80000005
jmp 0x14000ae2c
cmp eax, 0x80000005
jne 0x14000ae35
mov eax, dword [rdi + 0xc]
shr eax, 1
inc eax
mov dword [rsi], eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, ebp
call qword [0x14024f040]
jmp 0x14000ad97
mov eax, 0x57
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rcx
mov rcx, rbx
mov qword [rsp + 0x28], rdx
mov edx, r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
Function at 0x140013a20
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebp, r9d
movzx ebx, r8b
mov rsi, rdx
mov r14, rcx
lea rdx, str.SeShutdownPrivilege
lea rcx, [rsp + 0x30]
call fcn.1400138c0
nop
mov eax, ebx
xor eax, 1
lea r8d, [rax*4 + 4]
test bpl, 1
je 0x140013a79
or r8d, 3
jmp 0x140013a83
test bpl, 8
je 0x140013a83
or r8d, 1
mov eax, ebp
mov ecx, r8d
bts ecx, 7
and al, 2
cmove ecx, r8d
mov edi, ecx
bts edi, 9
and bpl, 4
cmove edi, ecx
xor ebp, ebp
mov ebx, ebp
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x20], 0x80000000
mov r9d, edi
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
cmp eax, 0x57
jne 0x140013af1
test dil, dil
jns 0x140013b0c
mov r9d, edi
btr r9d, 7
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
test eax, eax
je 0x140013b10
cmp eax, 0x15
jne 0x140013b0c
lea ecx, [rax + 0x4f]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, qword [r14 + 8]
jbe 0x140013ab0
xor bl, bl
jmp 0x140013b12
mov bl, 1
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140013b48
cmp dword [rsp + 0x34], 1
jne 0x140013b42
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, [rsp + 0x34]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x48]
call qword [case.0x1401b9e8b.6]
cmp byte [rsp + 0x31], 0
je 0x140013b55
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
movzx eax, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401c5190
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140014f50
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbx, rcx
mov eax, 0xffffffff
mov rcx, qword [rcx + 0x40]
mov rsi, r8
mov rbp, rdx
cmp rcx, rax
jne 0x140014f88
xor al, al
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
lea rax, [rcx + r8]
cmp rax, 0x40
jbe 0x140014ff4
mov qword [rsp + 0x30], rdi
lfence
cmp qword [rbx + 0x40], 0x40
ja 0x140014fde
xor eax, eax
mov dword [rbx + 0x48], 0x67452301
mov qword [rbx + 0x60], rax
lea rcx, [rbx + 0x48]
mov qword [rbx + 0x68], rax
mov rdx, rbx
mov dword [rbx + 0x4c], 0xefcdab89
mov dword [rbx + 0x50], 0x98badcfe
mov dword [rbx + 0x54], 0x10325476
mov dword [rbx + 0x58], 0xc3d2e1f0
mov r8, qword [rbx + 0x40]
call fcn.140157410
mov r8, rsi
lea rcx, [rbx + 0x48]
mov rdx, rbp
call fcn.140157410
mov rdi, qword [rsp + 0x30]
jmp 0x140014ffc
add rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx + 0x40], rsi
mov al, 1
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140015020
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x40]
lea rdi, [rcx + 0x48]
mov qword [rsp + 0x30], rbx
mov rsi, r8
mov qword [rsp + 0x38], r14
mov rbp, rdx
mov r14d, 0xffffffff
mov rbx, rcx
cmp rax, r14
je 0x140015119
cmp rax, 0x40
jbe 0x140015084
mov rcx, rdi
call fcn.1401574f0
mov rcx, rdi
call fcn.140157610
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbx + 0x10], eax
mov eax, reloc.WS2_32.dll_sendto
mov qword [rbx + 0x40], rax
mov r8d, 0x40
lea rcx, [rax + rbx]
sub r8, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movdqu xmm0, xmmword [rbx]
xor eax, eax
mov rdx, rbx
movdqa xmm2, xmmword [str.66666666666666660123456789ABCDEF]
mov rcx, rdi
pxor xmm0, xmm2
movdqa xmm1, xmm2
movdqu xmmword [rbx], xmm0
lea r8d, [rax + 0x40]
movdqu xmm0, xmmword [rbx + 0x10]
pxor xmm0, xmm2
movdqu xmmword [rbx + 0x10], xmm0
movdqu xmm0, xmmword [rbx + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm0, xmmword [rbx + 0x30]
pxor xmm0, xmm2
movdqu xmmword [rbx + 0x30], xmm0
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
mov dword [rdi + 0x10], 0xc3d2e1f0
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x20], rax
call fcn.140157410
mov qword [rbx + 0x40], r14
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test rsi, rsi
je 0x140015136
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.140157410
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140026280
Capabilities:
Hash data using sha512

Disassembly:
sub rsp, 0x118
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rdx]
movabs rax, 0x6a09e667f3bcc908
mov dword [rsp + 0x70], 0x20
movups xmm1, xmmword [rdx + 0x10]
mov qword [rsp + 0x20], rax
mov rdx, rcx
movabs rax, 0xbb67ae8584caa73b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm1
call fcn.140025e70
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x118
ret
Function at 0x140026360
Capabilities:
Hash data using sha512

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rbp], rax
movups xmm0, xmmword [rdx]
mov r15, rcx
mov ebx, 0x20
movups xmm1, xmmword [rdx + 0x10]
mov ecx, 0x80
mov qword [rsp + 0x118], r14
sub ecx, ebx
mov dword [rsp + 0x70], ebx
mov r14, r8
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x20], rax
mov edi, ebx
movabs rax, 0xbb67ae8584caa73b
mov rdx, r14
mov qword [rsp + 0x28], rax
mov rsi, r9
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
cmp rcx, rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
cmovb edi, ecx
lea rcx, [rsp + 0x74]
add rcx, rbx
mov r8d, edi
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm1
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rsp + 0x70]
add edx, edi
mov dword [rsp + 0x70], edx
cmp edx, 0x80
jb 0x1400264c5
mov r8d, 1
lea rdx, [rsp + 0x74]
lea rcx, [rsp + 0x20]
add r14, rdi
sub rbx, rdi
call fcn.1400257e0
mov rdi, rbx
mov edx, ebx
and rdi, 0xffffffffffffff80
sub edx, edi
mov dword [rsp + 0x70], edx
test rdi, rdi
je 0x1400264ad
mov r8, rdi
lea rcx, [rsp + 0x20]
shr r8, 7
mov rdx, r14
call fcn.1400257e0
mov edx, dword [rsp + 0x70]
add r14, rdi
test edx, edx
je 0x1400264c5
mov r8d, edx
lea rcx, [rsp + 0x74]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rsp + 0x70]
mov rbx, qword [rbp + 0x70]
mov r14, qword [rsp + 0x118]
test edx, edx
je 0x140026527
mov ecx, 0x80
mov eax, edx
sub ecx, edx
mov rdi, rbx
cmp rcx, rbx
mov rdx, rsi
cmovb rdi, rcx
lea rcx, [rsp + 0x74]
add rcx, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x70]
add eax, edi
mov dword [rsp + 0x70], eax
cmp eax, 0x80
jb 0x140026568
add rsi, rdi
lea rdx, [rsp + 0x74]
sub rbx, rdi
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.1400257e0
mov rdi, rbx
and rdi, 0xffffffffffffff80
sub ebx, edi
mov dword [rsp + 0x70], ebx
test rdi, rdi
je 0x140026554
mov r8, rdi
lea rcx, [rsp + 0x20]
shr r8, 7
mov rdx, rsi
call fcn.1400257e0
mov ebx, dword [rsp + 0x70]
add rsi, rdi
test ebx, ebx
je 0x140026568
mov r8d, ebx
lea rcx, [rsp + 0x74]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140025e70
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x120
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140026590
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
sub rsp, 0x130
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov rbx, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140026280
movzx eax, byte [rsp + 0x3f]
lea rdx, [rsp + 0x20]
and byte [rsp + 0x20], 0xf8
lea rcx, [rsp + 0x100]
and al, 0x3f
mov r8d, 0x20
or al, 0x40
mov byte [rsp + 0x3f], al
call fcn.140016b50
lea r8, [rsp + 0x100]
lea rdx, [0x1401f2ce0]
lea rcx, [rsp + 0x60]
call fcn.140025110
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14001eb20
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.1401c5190
add rsp, 0x130
pop rbx
ret
Function at 0x140026a50
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
sub rsp, 8
mov rax, qword [rcx + 0x20]
mov r10, rcx
dec rax
cmp rax, 0x7e
ja 0x140026af1
lea r11, [rdx + r8]
cmp rdx, r11
jae 0x140026af1
mov qword [rsp], rbx
lea rbx, [0x1401f8ce0]
movzx r9d, byte [rdx]
movzx eax, word [r10 + 8]
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
sar ecx, 8
xor cl, r9b
mov byte [rdx], cl
mov ecx, r9d
mov r8d, dword [r10]
inc rdx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, r8d
movzx eax, cl
add eax, dword [r10 + 4]
imul eax, eax, 0x8088405
mov dword [r10], ecx
mov ecx, dword [r10 + 8]
inc eax
mov dword [r10 + 4], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
mov eax, dword [rbx + rax*4]
xor eax, ecx
mov dword [r10 + 8], eax
cmp rdx, r11
jb 0x140026a80
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x140027350
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140027382
lea ecx, [rdx + 0x12]
jmp 0x1400275aa
mov rax, qword [rdx]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x14003c8e9.0]
cmp rax, 0xffffffffffffffff
jne 0x1400273a5
lea ecx, [rax + 0x32]
jmp 0x1400275aa
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14003c8e9.0]
xorps xmm0, xmm0
mov qword [rbx + 8], rax
mov rax, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rdi
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [rax + 8]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [case.0x14003c8e9.0]
cmp rax, 0xffffffffffffffff
jne 0x1400273f9
lea ecx, [rax + 0x14]
jmp 0x1400275aa
cmp rax, 0x40
je 0x140027409
mov ecx, gethostbyaddr
jmp 0x1400275aa
mov eax, 0x5a4d
cmp ax, word [rsp + 0x20]
jne 0x1400273ff
mov eax, 0xffffffff
cmp qword [rbx + 8], rax
jle 0x14002742a
mov ecx, gethostbyaddr
jmp 0x1400275aa
movsxd rax, dword [rsp + 0x5c]
mov qword [rsp + 0x1a0], rsi
test eax, eax
je 0x14002759d
mov rsi, rax
mov rcx, rdi
mov rax, qword [rdi]
mov rax, qword [rax + 0x18]
call qword [case.0x14003c8e9.0]
cmp rax, rsi
jl 0x14002759d
lfence
mov rax, qword [rdi]
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x14003c8e9.0]
cmp rax, 0xffffffffffffffff
jne 0x140027482
lea ecx, [rax + 0x32]
jmp 0x1400275a2
lfence
mov esi, dword [rsp + 0x5c]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x108
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rdi]
lea rdx, [rsp + 0x60]
mov r8d, 0xf8
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14003c8e9.0]
cmp rax, 0xffffffffffffffff
jne 0x1400274c4
lea ecx, [rax + 0x14]
jmp 0x1400275a2
cmp rax, 0xf8
jne 0x14002759d
cmp dword [rsp + 0x60], 0x4550
jne 0x14002759d
xor ecx, ecx
cmp cx, word [rsp + 0x74]
je 0x14002759d
movzx eax, word [rsp + 0x78]
mov edx, 0x10b
cmp dx, ax
jne 0x14002752a
cmp dword [rsp + 0xd4], 5
jb 0x14002759d
mov eax, dword [rsp + 0xf8]
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0xfc]
mov dword [rbx + 0x14], eax
lea eax, [rsi + 0x58]
mov dword [rbx + 0x18], eax
lea eax, [rsi + 0x98]
jmp 0x14002755e
mov edx, 0x20b
cmp dx, ax
jne 0x140027599
cmp dword [rsp + 0xe4], 5
jb 0x14002759d
mov eax, dword [rsp + 0x108]
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x10c]
mov dword [rbx + 0x14], eax
lea eax, [rsi + 0x58]
mov dword [rbx + 0x18], eax
lea eax, [rsi + 0xa8]
mov rdx, qword [rsp + 0xbc]
mov dword [rbx + 0x1c], eax
mov eax, 1
cmp ax, dx
je 0x140027581
mov eax, 8
cmp ax, dx
je 0x140027581
xor dl, dl
jmp 0x140027583
mov dl, 1
movzx eax, word [rsp + 0xbe]
shr ax, 7
and al, 1
mov byte [rbx + 0x20], dl
mov byte [rbx + 0x21], al
jmp 0x1400275a2
mov word [rbx + 0x20], cx
mov ecx, gethostbyaddr
mov rsi, qword [rsp + 0x1a0]
test ecx, ecx
sete al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1401c5190
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x180
pop rdi
ret
Function at 0x1400369e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x48
cmp qword [rcx + 0x20], 0
mov r15d, r9d
mov r12d, r8d
mov r13, rdx
mov rdi, rcx
jne 0x140036a0d
xor al, al
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x40], r14
mov r14, qword [rsp + 0x90]
mov r9, qword [r14 + 8]
test r9, r9
je 0x140036a8e
xor edx, edx
add rcx, 0x38
nop dword [rax]
mov r8d, dword [rcx + 8]
test r8d, r8d
je 0x140036a54
mov rax, qword [r9 + 0xf8]
cmp qword [rcx], rax
je 0x140036b0b
inc edx
add rcx, 0x10
cmp edx, 0x20
jb 0x140036a30
mov ecx, dword [rdi + 0x238]
mov rax, qword [r9 + 0xf8]
add rcx, rcx
mov qword [rdi + rcx*8 + 0x38], rax
mov eax, dword [rdi + 0x238]
add rax, 4
add rax, rax
mov dword [rdi + rax*8], 1
mov eax, dword [rdi + 0x238]
inc eax
and eax, 0x1f
mov dword [rdi + 0x238], eax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rsp + 0x70]
mov rcx, rax
lea edx, [r8 + 4]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x140036af9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
je 0x140036b39
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 4
lea r9, [rsp + 0x70]
mov rcx, rax
lea r8d, [rdx - 3]
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x140036b39
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x140036b39
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x140036b3b
cmp r8d, 5
jae 0x140036b26
mov eax, edx
lea ecx, [r8 + 1]
add rax, 4
add rax, rax
mov dword [rdi + rax*8], ecx
jmp 0x140036a8e
mov r14, qword [rsp + 0x40]
mov al, 1
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
ret
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [rsp + 0x98], 0
mov sil, 1
mov ebp, eax
jne 0x140036b56
cmp dword [rdi + 0x28], 2
jne 0x140036b7c
mov byte [rsp + 0x30], sil
mov r9d, r15d
mov dword [rsp + 0x28], ebp
mov r8d, r12d
mov rdx, r13
mov qword [rsp + 0x20], r14
mov rcx, rdi
call fcn.140036bf0
movzx esi, al
and sil, 1
mov byte [rsp + 0x30], 0
mov r9d, r15d
mov dword [rsp + 0x28], ebp
mov r8d, r12d
mov rdx, r13
mov qword [rsp + 0x20], r14
mov rcx, rdi
call fcn.140036bf0
mov rbp, qword [rsp + 0x80]
and sil, al
test rbx, rbx
je 0x140036bbf
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov rcx, rbx
call qword [case.0x1401b9e8b.6]
mov rbx, qword [rsp + 0x78]
movzx eax, sil
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
ret
Function at 0x1400383b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
movzx ebp, dx
mov edi, r9d
mov rsi, r8
mov r14, rcx
mov ebx, r15d
test r8, r8
je 0x140038475
movzx r9d, word [rsp + 0x60]
lea edx, [r15 + 6]
movzx eax, bp
shr ax, 4
inc ax
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x14003845e
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x14003845e
movzx ecx, word [rax]
lea rax, [rax + 2]
mov edx, ebp
and edx, 0xf
je 0x140038440
nop
lea rax, [rax + rcx*2]
movzx ecx, word [rax]
add rax, 2
sub edx, 1
jne 0x140038430
test edi, edi
jle 0x14003846e
dec edi
mov rdx, rax
cmp ecx, edi
mov ebx, edi
cmovle ebx, ecx
mov rcx, rsi
movsxd r8, ebx
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebx
test edi, edi
jle 0x140038477
movsxd rcx, ebx
mov word [rsi + rcx*2], r15w
jmp 0x140038477
mov qword [rsi], rax
mov eax, ecx
jmp 0x140038477
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140038490
Capabilities:
Get proxy

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x870
mov rax, qword [0x14024fa28]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rsi, rcx
lea rdx, [rsp + 0x30]
xor ebp, ebp
mov ecx, 0x20019
mov qword [rsp + 0x30], rbp
mov r14, r8
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x1400384e2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1400386d9
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x20019
mov byte [rsp + 0x20], 1
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
call fcn.1401a5450
mov rcx, qword [rsp + 0x30]
movzx ebx, al
call qword [0x14024f048]
test bl, bl
jne 0x14003851c
xor al, al
jmp 0x1400386d9
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x898], rdi
lea rdx, str.ProxyEnable
xor dil, dil
call fcn.1401a5610
test al, al
je 0x1400386ba
cmp dword [rsp + 0x30], ebp
je 0x1400386ba
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rbp
xor r8d, r8d
mov word [rsp + 0x50], bp
lea rdx, str.ProxyServer
mov dword [rsp + 0x38], 0x802
call qword [0x14024f060]
test eax, eax
je 0x140038599
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400386ba
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x1400385b4
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400386ba
cmp dword [rsp + 0x38], 0x802
jbe 0x1400385ce
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400386ba
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
mov rcx, rbx
lea rdx, str.ProxyServer
mov qword [rsp + 0x20], rax
call qword [0x14024f060]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1400386ba
lea rdx, str.http
lea rcx, [rsp + 0x50]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
test rax, rax
jne 0x14003862d
lea rbx, [rsp + 0x50]
jmp 0x140038647
add rbx, 0xa
mov edx, 0x3b
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
je 0x140038647
mov word [rax], bp
mov r8d, 7
lea rdx, [0x1401f9e98]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140038665
add rbx, 0xe
mov edx, 0x3a
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov rdi, rax
test rax, rax
je 0x1400386a7
xor edx, edx
mov word [rax], bp
lea rcx, [rax + 2]
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
mov r8d, 0xa
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 2]
mov qword [rsp + 0x30], rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
mov dword [r14], eax
mov r8, rbx
mov edx, 0x81
mov rcx, rsi
call fcn.1401aec20
mov dil, 1
mov rcx, qword [rsp + 0x40]
call qword [0x14024f048]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
movzx eax, dil
mov rdi, qword [rsp + 0x898]
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1401c5190
mov rbx, qword [rsp + 0x8a8]
add rsp, 0x870
pop r14
pop rsi
pop rbp
ret