joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400614b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
xor ebx, ebx
mov r14, r8
mov r13, rdx
lea r15d, [rbx + 1]
mov rsi, rcx
mov r12d, ebx
mov bpl, r15b
lea edi, [rbx + 4]
mov r9, qword [rsi]
lea rcx, [rsp + 0x24]
mov r8, rdi
mov rdx, r15
call fcn.140019a28
lea rdx, [rsp + 0x24]
mov r9d, 0x6688a645
mov r8d, edi
mov rcx, rsi
call fcn.140058f00
lea rdx, [0x14009e84c]
lea rcx, [rsp + 0x24]
mov byte [rsp + 0x28], bl
call fcn.140019a60
cmp eax, ebx
jne 0x14006166f
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r15
mov rdx, rdi
add r12d, r15d
call fcn.140019a28
mov edi, dword [rsp + 0x20]
mov r9, qword [rsi]
xor edi, 0x44246260
lea rcx, [rsp + 0x30]
mov rdx, r15
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.140019a28
lea r9d, [rdi + 0x73fc57b5]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.140058f00
movsxd r11, edi
xor eax, eax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov word [rsp + r11*2 + 0x30], ax
call fcn.140016e4c
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r15
mov edx, 4
call fcn.140019a28
mov edi, dword [rsp + 0x20]
mov r9, qword [rsi]
xor edi, 0xe826c947
lea rcx, [rsp + 0x30]
mov rdx, r15
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.140019a28
lea r9d, [rdi - 0x406f7c03]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.140058f00
movsxd r11, edi
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov rcx, r14
mov word [rsp + r11*2 + 0x30], bx
call fcn.140016e4c
lea rcx, [rsp + 0x240]
mov rdx, r13
call fcn.140017790
cmp eax, ebx
je 0x1400616a1
lea rdx, [0x14009e840]
mov rcx, r13
call fcn.140017790
cmp eax, ebx
jne 0x14006162b
cmp r12d, ebx
je 0x1400616a1
mov rcx, qword [rsi]
mov r8d, r15d
mov edx, r15d
call fcn.140019e98
mov r9, qword [rsi]
mov edi, 4
lea rcx, [rsp + 0x2c]
mov rdx, rdi
mov r8, r15
call fcn.140019a28
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsi]
xor edx, 0x87bc
mov r8d, r15d
mov dword [rsp + 0x2c], edx
add edx, 0x18
call fcn.140019e98
jmp 0x140061672
mov bpl, bl
cmp bpl, r15b
je 0x1400614e7
mov eax, 6
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x140061680
Function at 0x1400616b0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d0
xor r15d, r15d
mov rbx, rdx
mov edx, dword [rcx + 8]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r15w
mov r13, rcx
mov rcx, qword [rcx]
mov r14, r8
lea r12d, [r15 + 1]
xor r8d, r8d
mov rbp, r9
mov word [rax - 0x486], r15w
mov qword [rax - 0x258], r15
mov dword [rsp + 0x24], r12d
call fcn.140019e98
lea r8, [rsp + 0x4c0]
xor r9d, r9d
mov rdx, rbx
mov rcx, r13
call fcn.1400614b0
cmp eax, r15d
je 0x14006175b
lea eax, [r15 + 6]
jmp 0x1400618d1
mov r9, qword [r13]
lea rcx, [rsp + 0x700]
mov r8, r12
mov rdx, r12
call fcn.140019a28
mov r9, qword [r13]
mov edi, 4
lea rcx, [rsp + 0x20]
mov rdx, rdi
mov r8, r12
call fcn.140019a28
mov esi, dword [rsp + 0x20]
mov r9, qword [r13]
lea rcx, [rsp + 0x20]
mov ebx, 0x87bc
mov r8, r12
mov rdx, rdi
xor esi, ebx
call fcn.140019a28
mov r11d, dword [rsp + 0x20]
mov r9, qword [r13]
xor r11d, ebx
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, rdi
mov dword [rbp], r11d
call fcn.140019a28
mov edi, dword [rsp + 0x20]
mov rcx, qword [r13]
mov r8d, r12d
mov edx, reloc.WSOCK32.dll_recv
xor edi, 0xa685
call fcn.140019e98
mov ecx, dword [rbp]
call fcn.140017ca8
movsxd rbx, esi
mov rcx, rbx
mov rbp, rax
call fcn.140017ca8
mov r9, qword [r13]
mov r8d, 1
mov rcx, rax
mov rdx, rbx
mov r12, rax
call fcn.140019a28
mov r9d, dword [r13 + 0xc]
mov r8d, esi
mov rdx, r12
mov rcx, r13
add r9d, 0x14226ed4
call fcn.140058f00
lea rcx, [rsp + 0x24]
mov r8d, esi
mov rdx, r12
call fcn.14003f370
cmp edi, dword [rsp + 0x24]
je 0x140061859
mov rcx, rbp
call fcn.140017ec8
mov rcx, r12
call fcn.140017ec8
mov eax, 0xa
jmp 0x1400618d1
cmp byte [rsp + 0x700], 1
jne 0x1400618c1
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r15w
mov word [rsp + 0x272], r15w
mov qword [rsp + 0x4a0], r15
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbp
call fcn.140059110
mov rcx, r12
call fcn.140017ec8
jmp 0x1400618cc
mov rcx, rbp
call fcn.140017ec8
mov rbp, r12
mov qword [r14], rbp
xor eax, eax
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400626e0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xac0
mov rbx, rdx
lea rdx, [rsp + 0x280]
mov dil, r8b
call fcn.1400151d0
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400151d0
lea rcx, [rsp + 0x280]
call fcn.140040ec0
xor ebx, ebx
cmp al, bl
jne 0x140062727
xor al, al
jmp 0x1400628be
lea rcx, [rsp + 0x70]
call fcn.140040ec0
cmp al, bl
je 0x1400627f8
cmp dil, bl
je 0x140062720
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea rcx, [rsp + 0x280]
cmp eax, ebx
jne 0x14006278f
lea rdx, [rsp + 0x70]
call fcn.140017790
cmp eax, ebx
je 0x140062788
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
setne al
jmp 0x1400628be
mov al, 1
jmp 0x1400628be
lea rax, [rsp + 0x490]
lea r9, [rsp + 0x6a0]
lea r8, [rsp + 0x8b0]
lea rdx, [rsp + 0xae8]
mov qword [rsp + 0x20], rax
call fcn.14001823c
lea rdx, [0x14009bd8c]
lea rcx, [rsp + 0x70]
call fcn.140016e20
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x70]
call fcn.140016e20
cmp word [rsp + 0x490], bx
je 0x1400627f8
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x70]
call fcn.140016e20
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call fcn.140040e10
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
cmp al, bl
je 0x140062841
mov r8b, 1
call fcn.140059cd0
cmp al, bl
je 0x140062720
lea rcx, [rsp + 0x280]
mov dl, 1
call fcn.140059c20
cmp al, bl
jmp 0x140062780
call fcn.140017790
cmp eax, ebx
je 0x140062720
lea rcx, [rsp + 0x280]
call fcn.140016a44
lea rcx, [rsp + 0x70]
mov word [rsp + rax*2 + 0x282], bx
call fcn.140016a44
lea rcx, [rsp + 0x30]
mov word [rsp + rax*2 + 0x72], bx
lea rax, [rsp + 0x280]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x48], rax
mov eax, 0x614
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 1
mov word [rsp + 0x50], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
sete al
mov rbx, qword [rsp + 0xad0]
add rsp, 0xac0
pop rdi
ret
Function at 0x140063040
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edi, r8d
call fcn.1400518b0
lea rcx, [rsp + 0x20]
call fcn.14005a810
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov byte [rsp + 0x40], 0
mov byte [rsp + 0x41], 0
mov byte [rsp + 0x42], 0
mov byte [rsp + 0x43], 0
mov byte [rsp + 0x44], 0
mov byte [rsp + 0x45], 0
call fcn.140062dc0
lea rdx, [rbx + 0x18]
mov rcx, rbx
call fcn.1400513f0
test edi, edi
je 0x1400630b6
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14005a740
sub edi, 1
jne 0x1400630a4
lea rdx, [rbx + 0x18]
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140051190

Function at 0x140063170
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rax, r8
mov r12, rdx
mov r8b, 1
mov rdx, rax
mov rbx, rcx
mov qword [rcx + 0x28], rax
call fcn.140041e50
xor r13d, r13d
cmp byte [rbx + 8], 1
mov bpl, r13b
mov byte [rsp + 0x50], r13b
mov byte [rsp + 0x51], r13b
mov byte [rsp + 0x52], r13b
mov byte [rsp + 0x53], r13b
mov byte [rsp + 0x54], r13b
mov byte [rsp + 0x55], r13b
jne 0x1400631ec
xor r8d, r8d
mov dl, reloc.WSOCK32.dll_sendto
mov rcx, rbx
call fcn.140042050
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov bpl, al
call fcn.140051640
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140042100
mov edi, r13d
movsxd rdx, edi
mov rcx, r12
call fcn.140043480
movzx esi, word [rax]
cmp si, r13w
je 0x140063238
mov rcx, rbx
inc edi
call fcn.140051050
mov r8d, 1
movzx edx, si
mov rcx, rbx
call fcn.1400630e0
mov byte [rbx + 0x18], r13b
mov byte [rbx + 0x19], r13b
mov byte [rbx + 0x1a], r13b
mov byte [rbx + 0x1b], r13b
mov byte [rbx + 0x1c], r13b
mov byte [rbx + 0x1d], r13b
jmp 0x1400631ef
cmp byte [rbx + 8], 1
jne 0x140063258
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400513f0
mov r8b, bpl
mov dl, reloc.WSOCK32.dll_sendto
mov rcx, rbx
call fcn.140042050
mov rdx, qword [rbx + 0x28]
xor r8d, r8d
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.140041e50
Function at 0x140065d80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rbx, qword [rdx]
mov rbp, rcx
lea rcx, [rsp + 0x50]
mov esi, r8d
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x54]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov dword [rdi + 0x274], r11d
mov dword [rdi + 0x278], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
cmp eax, dword [rdi + 0x27c]
jne 0x140065de6
cmp ecx, dword [rdi + 0x280]
je 0x140065e0e
cmp esi, 1
mov dword [rdi + 0x27c], eax
mov dword [rdi + 0x280], ecx
jl 0x140065e0e
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8, rdi
mov rcx, rbp
mov edx, 0xfffffff5
call fcn.1400608f0
mov ecx, dword [rbp + 0x18]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rbp + 0x1c]
movzx r12d, ax
shr r12d, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
cmp r12d, dword [rdi + 0x284]
je 0x140065eb4
cmp esi, 1
jl 0x140065eb4
cmp byte [rdi + 0x2c0], 0
je 0x140065eb4
mov eax, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x50]
mov r8, rdi
mov rcx, rbp
mov dword [rsp + 0x20], eax
test r12d, r12d
je 0x140065e64
mov edx, 0xfffffff9
jmp 0x140065ea8
mov edx, 0xfffffff8
call fcn.1400608f0
cmp byte [rdi + 0x28c], 0
je 0x140065ead
mov rcx, qword [rdi]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9d, dword [rsp + 0x50]
mov r8, rdi
bt eax, 0x18
mov eax, dword [rsp + 0x54]
mov rcx, rbp
mov dword [rsp + 0x20], eax
mov edx, 0xfffffffa
jb 0x140065ea8
mov edx, 0xfffffff4
call fcn.1400608f0
mov byte [rdi + 0x28c], 0
test esi, esi
je 0x140065ebf
mov dword [rdi + 0x284], r12d
cmp ebx, dword [rdi + 0x288]
je 0x140065ef2
cmp esi, 1
jl 0x140065ef2
mov eax, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x50]
mov r8, rdi
mov rcx, rbp
mov edx, 0xfffffff7
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140065eed
mov edx, 0xfffffff6
call fcn.1400608f0
test esi, esi
je 0x140065efc
mov dword [rdi + 0x288], ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140067c10
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rbp, rcx
lea rcx, [rsp + 0x20]
mov edi, r9d
mov rbx, r8
mov r14b, dl
call fcn.14000fd50
xor r12d, r12d
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [r12 + 0x70]
mov r13, r12
mov rsi, r12
lea r15d, [r12 + 1]
call fcn.140017520
cmp edi, 2
jb 0x140067c94
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.140062190
cmp word [rax], r12w
je 0x140067c94
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.140062190
mov rcx, rax
call fcn.140015220
mov r13, rax
cmp edi, 3
jb 0x140067cb1
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.140062190
mov rcx, rax
call fcn.140015220
mov rsi, rax
cmp edi, 4
jb 0x140067cfa
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call fcn.140062190
cmp word [rax], r12w
je 0x140067cfa
mov rax, qword [rbx + 8]
mov edx, reloc.OLEAUT32.dll_SafeArrayCreateEx
mov r12, qword [rax + 0x18]
mov rcx, r12
call fcn.140058ca0
test al, al
jne 0x140067cf7
mov rcx, r12
call fcn.140011960
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.140012600
xor r12d, r12d
cmp edi, 5
jb 0x140067d10
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x20]
call fcn.140010880
movzx r15d, ax
mov edi, WSAStartup
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, rdi
call fcn.140017520
mov rax, qword [rsp + 0x20]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 8]
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], r12
mov rcx, qword [rax]
call fcn.140062190
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x58], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
cmp r13, r12
je 0x140067d79
mov rcx, r13
call fcn.140016a60
cmp rsi, r12
je 0x140067d86
mov rcx, rsi
call fcn.140016a60
cmp ebx, r12d
jne 0x140067dbc
mov rax, qword [rbp]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
lea edi, [r8 + 1]
add rcx, rbp
mov edx, edi
call fcn.14000fca0
mov rbx, qword [rsp + 0x100]
mov rcx, rbx
call fcn.140007a40
mov dword [rbx + 8], edi
mov dword [rbx], r12d
jmp 0x140067dff
cmp r14b, r12b
je 0x140067dd2
mov rax, qword [rsp + 0xa8]
mov qword [rbp + 0x7a8], rax
jmp 0x140067dff
mov rbx, qword [rsp + 0x100]
mov rcx, rbx
call fcn.140007a40
mov rcx, qword [rsp + 0xa8]
mov edi, 1
mov dword [rbx + 8], edi
mov dword [rbx], edi
cmp rcx, r12
je 0x140067dff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x20]
call fcn.140002610
lea r11, [rsp + 0xb0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140067fa0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
mov eax, 0x2060
call fcn.140030cb0
sub rsp, rax
lea rcx, [rsp + 0x20]
mov rbp, rdx
call fcn.14000fd50
lea rcx, [rsp + 0x40]
call fcn.14000fd50
mov rcx, rbp
call fcn.140062190
xor r12d, r12d
movzx ecx, word [rax]
mov rsi, rax
mov dil, r12b
mov rbx, r12
cmp cx, r12w
je 0x140068125
lea r13d, [r12 + 0x25]
inc rbx
cmp cx, r13w
jne 0x1400680d3
cmp word [rsi + rbx*2], r13w
jne 0x14006802a
lea rcx, [rsp + 0x20]
mov edx, r13d
mov dil, 1
call fcn.1400037e0
inc rbx
jmp 0x1400680e0
lea rdx, [0x14009b6c0]
lea rcx, [rsp + 0x40]
call fcn.1400107e0
jmp 0x140068054
cmp r11w, r12w
je 0x14006805f
lea rcx, [rsp + 0x40]
movzx edx, r11w
call fcn.1400037e0
inc rbx
movzx r11d, word [rsi + rbx*2]
cmp r11w, r13w
jne 0x14006803d
cmp word [rsi + rbx*2], r12w
je 0x1400680f0
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0xfff
inc rbx
mov word [rsp + 0x60], r12w
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
cmp eax, r12d
je 0x1400680a2
lea rdx, [rsp + 0x60]
call fcn.140011830
mov dil, 1
jmp 0x1400680e0
lea rdx, [0x1400a2e04]
mov dil, 1
call fcn.140011830
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140004740
lea rdx, [0x1400a2e04]
lea rcx, [rsp + 0x20]
call fcn.140011830
jmp 0x1400680e0
movzx edx, cx
lea rcx, [rsp + 0x20]
call fcn.1400037e0
mov cx, word [rsi + rbx*2]
cmp cx, r12w
jne 0x140067ffe
jmp 0x140068113
lea rdx, [0x1400a2e04]
lea rcx, [rsp + 0x20]
mov dil, 1
call fcn.140011830
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140004740
cmp dil, r12b
je 0x140068125
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140013120
lea rcx, [rsp + 0x40]
call fcn.140002610
lea rcx, [rsp + 0x20]
call fcn.140002610
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x1400681a0
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x2e0
mov rbx, rcx
xor r12d, r12d
lea rcx, [rsp + 0x58]
mov rsi, r9
mov rbp, r8
mov rdi, rdx
mov qword [rsp + 0x30], r12
mov qword [rax + 0x20], r12
call fcn.14000fd50
lea rcx, [rsp + 0x38]
call fcn.14000fd50
lea rcx, [rsp + 0x78]
call fcn.14000fd50
lea rdx, str.SOFTWAREClasses_
lea rcx, [rsp + 0x58]
call fcn.1400107e0
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.140011830
lea rdx, str.CLSID
lea rcx, [rsp + 0x58]
call fcn.140011830
lea rdx, [0x14009b6c0]
lea rcx, [rsp + 0x38]
call fcn.1400107e0
cmp rdi, r12
je 0x14006825c
cmp word [rdi], 0x5c
je 0x14006825c
cmp word [rdi + 2], 0x5c
je 0x14006825c
lea rdx, [0x1400a1ef8]
lea rcx, [rsp + 0x38]
call fcn.1400107e0
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.140011830
cmp rsi, r12
je 0x1400682cf
xor edx, edx
lea rcx, [rsp + 0x98]
lea r8d, [rdx + 0x30]
call fcn.140017520
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x9c], r12d
call fcn.140012600
lea rdx, str.IPC_
lea rcx, [rsp + 0x78]
call fcn.140011830
mov r11, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0xb0], r11
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp eax, r12d
jne 0x1400683bc
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp eax, r12d
jne 0x1400683bc
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x318]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x1400683b1
mov rcx, qword [rsp + 0x318]
lea rax, [rsp + 0x308]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x308], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x1400683a3
mov eax, dword [rsp + 0x308]
lea rcx, [rsp + 0xd0]
shr eax, 1
mov dword [rsp + 0x308], eax
mov word [rsp + rax*2 + 0xd0], r12w
call fcn.140015220
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.140017be8
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.140002610
lea rcx, [rsp + 0x38]
call fcn.140002610
lea rcx, [rsp + 0x58]
call fcn.140002610
lea r11, [rsp + 0x2e0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140068400
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x290
mov rsi, rcx
lea rcx, [rsp + 0x40]
movaps xmmword [rax - 0x28], xmm6
mov rbp, rdx
call fcn.14000fd50
lea rdx, [rsp + 0x38]
movsd xmm6, qword [0x1400a3c88]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromIID]
xor r12d, r12d
cmp eax, r12d
mov edi, eax
jl 0x140068623
mov rcx, qword [rsp + 0x38]
call fcn.140015220
lea rdx, str.interface_
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.1400107e0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140011830
lea rdx, str.TypeLib
lea rcx, [rsp + 0x40]
call fcn.140011830
mov rcx, rbx
call fcn.140017be8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x40]
lea r11, [rsp + 0x2c8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x140068623
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x140068615
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.140015220
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.140017be8
cmp edi, r12d
jl 0x140068615
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
lea rdx, str.Version
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x1400685bd
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.1400184a4
movapd xmm6, xmm0
movsd xmm1, qword [0x1400a3c88]
movapd xmm0, xmm6
call fcn.14001be00
lea rax, [rsp + 0x30]
cvttsd2si rdx, xmm6
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
cvttsd2si r8, xmm0
call qword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
cmp eax, r12d
mov edi, eax
jl 0x140068615
mov rcx, qword [rsp + 0x30]
mov r8, rbp
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov edi, eax
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.140002610
lea r11, [rsp + 0x290]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140068650
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x2d0
mov rsi, rcx
lea rcx, [rsp + 0x48]
xor r12d, r12d
mov rbp, rdx
mov ebx, 0x80004002
mov dword [rax + 0x18], SafeArrayCreateEx
mov edi, r12d
call fcn.14000fd50
lea r11, [rsp + 0x40]
lea rdx, str.interface
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x140068800
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x300]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x70]
mov edx, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r12d
jne 0x1400687f5
mov eax, dword [rsp + 0x300]
lea rdx, str.interface_
lea rcx, [rsp + 0x48]
mov word [rsp + rax*2 + 0x70], r12w
mov dword [rsp + 0x300], 0x1fe
call fcn.1400107e0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140011830
mov rdx, qword [rsp + 0x48]
lea r11, [rsp + 0x308]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x1400687de
mov rcx, qword [rsp + 0x308]
lea rax, [rsp + 0x300]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x1400687d0
mov eax, dword [rsp + 0x300]
lea rcx, [rsp + 0xc0]
mov rdx, rbp
shr eax, 1
mov dword [rsp + 0x300], eax
mov word [rsp + rax*2 + 0xc0], r12w
call fcn.140016d8c
cmp eax, r12d
jne 0x1400687d0
lea rcx, [rsp + 0x70]
mov rdx, rsi
call qword [sym.imp.ole32.dll_IIDFromString]
mov ebx, eax
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
je 0x1400687f5
inc edi
mov dword [rsp + 0x300], SafeArrayCreateEx
jmp 0x1400686b8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x48]
call fcn.140002610
lea r11, [rsp + 0x2d0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret