joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006c80
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov dword [rax + 0x20], r9d
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov rdi, rdx
mov r14, rcx
mov r10, qword [0x14014dd40]
lea r12, [0x14014dd40]
cmp r10, r12
je 0x140006ce0
test byte [r10 + 0x1c], 1
je 0x140006ce0
cmp byte [r10 + 0x19], 5
jb 0x140006ce0
mov r9, rcx
mov dword [rax - 0x40], r8d
mov rcx, qword [r10 + 0x10]
mov qword [rax - 0x48], rdx
call fcn.1400058e8
mov r10, qword [0x14014dd40]
xor ebx, ebx
mov dword [rsp + 0x88], ebx
lea r13, [0x14011a3d8]
cmp r10, r12
je 0x140006d19
test byte [r10 + 0x1c], 2
je 0x140006d19
cmp byte [r10 + 0x19], 5
jb 0x140006d19
mov rcx, qword [r10 + 0x10]
lea edx, [rbx + 0x34]
mov r8, r13
call fcn.140003614
mov r10, qword [0x14014dd40]
cmp dword [rdi + 4], 1
je 0x140006e98
mov edx, 0x7530
mov ecx, dword [rdi + 0x18]
mov eax, edx
cmp ecx, edx
cmovb eax, ecx
cmp eax, 0x1f4
jae 0x140006d40
mov esi, 0x1f4
jmp 0x140006d47
cmp ecx, edx
mov esi, edx
cmovb esi, ecx
cmp r10, r12
je 0x140006d6e
test byte [r10 + 0x1c], 2
je 0x140006d6e
cmp byte [r10 + 0x19], 5
jb 0x140006d6e
mov rcx, qword [r10 + 0x10]
mov edx, 0x35
mov r9d, esi
mov r8, r13
call fcn.1400036d4
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x88]
mov r9d, 0x24
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140006e5b
cmp dword [rdi + 4], 1
je 0x140006e2a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
mov edx, 0x7530
cmp eax, edx
ja 0x140006dd0
cmp dword [rdi + 4], 1
mov r10, qword [0x14014dd40]
jne 0x140006d28
jmp 0x140006e98
mov ebx, 0x5b4
mov r10, qword [0x14014dd40]
cmp r10, r12
je 0x140006ecd
test byte [r10 + 0x1c], 2
je 0x140006e98
cmp byte [r10 + 0x19], 2
jb 0x140006e98
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x14014dd40]
mov edx, 0x38
mov dword [rsp + 0x28], 0x7530
mov r9d, ebp
mov r8, r13
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.1400053f0
jmp 0x140006e91
mov r10, qword [0x14014dd40]
cmp r10, r12
je 0x140006ecd
test byte [r10 + 0x1c], 2
je 0x140006e98
cmp byte [r10 + 0x19], 5
jb 0x140006e98
mov rcx, qword [r10 + 0x10]
mov edx, 0x37
mov r8, r13
call fcn.140003614
jmp 0x140006e91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r10, qword [0x14014dd40]
cmp r10, r12
je 0x140006ecd
test byte [r10 + 0x1c], 2
je 0x140006e98
cmp byte [r10 + 0x19], 2
jb 0x140006e98
mov rcx, qword [r10 + 0x10]
mov edx, 0x36
mov r9d, eax
mov r8, r13
call fcn.1400036d4
mov r10, qword [0x14014dd40]
cmp r10, r12
je 0x140006ecd
test byte [r10 + 0x1c], 1
je 0x140006ecd
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x140006ecd
mov rcx, qword [r10 + 0x10]
mov edx, 0x39
mov r9d, ebx
mov r8, r13
call fcn.1400036d4
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140006eec
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x14014d030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov r9, rcx
mov rcx, qword [0x14014dd40]
lea rbp, [0x14014dd40]
cmp rcx, rbp
je 0x140006f40
test byte [rcx + 0x1c], 1
je 0x140006f40
cmp byte [rcx + 0x19], 5
jb 0x140006f40
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
call fcn.14000587c
xor ebx, ebx
lea rcx, [rsp + 0x3c]
xor edx, edx
mov dword [rsp + 0x38], ebx
lea r8d, [rbx + 0x20]
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r9d, [rbx + 0x24]
mov dword [rsp + 0x30], ebx
mov esi, eax
lea r8, [rsp + 0x38]
lea rax, [rsp + 0x30]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea r14, [0x14011a3d8]
test eax, eax
jne 0x140006fcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r10, qword [0x14014dd40]
cmp r10, rbp
je 0x140007089
test byte [r10 + 0x1c], 2
je 0x140007054
cmp byte [r10 + 0x19], 2
jb 0x140007054
mov rcx, qword [r10 + 0x10]
mov edx, 0x3b
mov r9d, eax
mov r8, r14
call fcn.1400036d4
jmp 0x14000704d
cmp dword [rsp + 0x3c], 1
jne 0x140007007
mov r10, qword [0x14014dd40]
cmp r10, rbp
je 0x140007089
test byte [r10 + 0x1c], 2
je 0x140007054
cmp byte [r10 + 0x19], 5
jb 0x140007054
mov rcx, qword [r10 + 0x10]
mov edx, 0x3c
mov r8, r14
call fcn.140003614
jmp 0x14000704d
cmp dword [rsp + 0x3c], 3
jne 0x1400070ad
mov rcx, qword [0x14014dd40]
cmp rcx, rbp
je 0x14000703b
test byte [rcx + 0x1c], 2
je 0x14000703b
cmp byte [rcx + 0x19], 5
jb 0x14000703b
mov rcx, qword [rcx + 0x10]
mov edx, 0x3d
mov r8, r14
call fcn.140003614
mov r8d, esi
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140006c80
mov ebx, eax
mov r10, qword [0x14014dd40]
cmp r10, rbp
je 0x140007089
test byte [r10 + 0x1c], 1
je 0x140007089
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x140007089
mov rcx, qword [r10 + 0x10]
mov edx, 0x3f
mov r9d, ebx
mov r8, r14
call fcn.1400036d4
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140106ed0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [0x14014dd40]
cmp rcx, rbp
je 0x1400070d6
test byte [rcx + 0x1c], 2
je 0x1400070d6
cmp byte [rcx + 0x19], 5
jb 0x1400070d6
mov rcx, qword [rcx + 0x10]
mov edx, 0x3e
mov r8, r14
call fcn.140003614
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x14000703b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14000704b
Function at 0x140010084
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
call fcn.1400e80b0
mov esi, eax
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0
lea rax, [rsp + 0x58]
xor ebx, ebx
and qword [rsp + 0x58], rbx
mov r9d, 0x2011f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400100d6
mov rbx, qword [rsp + 0x58]
mov rcx, qword [0x14014dd40]
lea rbp, [0x14014dd40]
mov r14d, 5
cmp rcx, rbp
je 0x140010125
lea edx, [r14 - 3]
test byte [rcx + 0x1c], dl
je 0x140010125
movzx eax, byte [rcx + 0x19]
test edi, edi
cmove edx, r14d
cmp eax, edx
jl 0x140010125
mov rcx, qword [rcx + 0x10]
lea r8, [0x14011b7b0]
mov edx, SysStringByteLen
mov r9d, edi
call fcn.1400036d4
mov rcx, qword [0x14014dd40]
test edi, edi
jne 0x14001015a
lea r9d, [rdi + 4]
mov dword [rsp + 0x50], esi
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.WakeOnMagicPacketEnabled
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x14014dd40]
cmp rcx, rbp
je 0x140010183
test byte [rcx + 0x1c], 1
je 0x140010183
cmp byte [rcx + 0x19], r14b
jb 0x140010183
mov rcx, qword [rcx + 0x10]
lea r8, [0x14011b7b0]
mov edx, SysStringByteLen
mov r9d, esi
call fcn.1400036d4
test rbx, rbx
je 0x140010191
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14001871c
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rcx, qword [0x14014dd40]
lea rsi, [0x14014dd40]
cmp rcx, rsi
je 0x140018762
test byte [rcx + 0x1c], 1
je 0x140018762
mov rcx, qword [rcx + 0x10]
lea r8, [0x14011b7b0]
mov edx, 0x13d
call fcn.140003614
xor r13d, r13d
lea rax, [rbp + 0x48]
mov ebx, 1
mov qword [rbp + 0x58], r13
mov r8d, ebx
mov dword [rbp + 0x48], r13d
lea r9, [rbp + 0x58]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov edi, eax
mov rcx, qword [0x14014dd40]
cmp rcx, rsi
je 0x1400187d5
test byte [rcx + 0x1c], 2
je 0x1400187d5
cmp byte [rcx + 0x19], 5
jb 0x1400187d5
mov eax, dword [rbp + 0x48]
lea r8, [0x14011b7b0]
mov rcx, qword [rcx + 0x10]
mov edx, 0x13e
mov dword [rsp + 0x28], eax
mov r9d, edi
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.14000b45c
mov rcx, qword [0x14014dd40]
test edi, edi
je 0x1400188e5
cmp dword [rbp + 0x48], r13d
jne 0x1400187eb
mov ebx, r13d
jmp 0x1400188d0
mov esi, r13d
lea rbx, [0x14014dd40]
mov r14d, r13d
mov edi, r13d
cmp edi, dword [rbp + 0x48]
jae 0x1400188b9
mov rcx, qword [rbp + 0x58]
mov eax, edi
lea r15, [rax + rax*2]
mov eax, dword [rcx + r15*8 + 0x10]
test eax, eax
je 0x140018823
add eax, 0xfffffffd
cmp eax, 1
ja 0x1400188af
mov qword [rbp + 0x60], r13
lea rax, [rbp + 0x50]
mov dword [rbp + 0x50], r13d
lea r9, [rbp + 0x60]
mov edx, dword [rcx + r15*8]
mov r8d, 5
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov r12d, eax
mov rcx, qword [0x14014dd40]
cmp rcx, rbx
je 0x14001888b
test byte [rcx + 0x1c], 2
je 0x14001888b
cmp byte [rcx + 0x19], 5
jb 0x14001888b
mov rax, qword [rbp + 0x60]
mov r9d, edi
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x58]
mov dword [rsp + 0x28], r12d
mov edx, dword [rax + r15*8]
mov dword [rsp + 0x20], edx
call fcn.14000b1b0
test r12d, r12d
je 0x1400188a9
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x1400188a9
cmp r13w, word [rcx]
je 0x1400188a1
inc esi
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
jmp 0x1400188af
mov r14d, 1
inc edi
test esi, esi
je 0x1400187fb
mov ebx, 1
test r14d, r14d
jne 0x1400188c9
test esi, esi
cmove ebx, r13d
lea rsi, [0x14014dd40]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rcx, qword [0x14014dd40]
mov qword [rbp + 0x58], r13
cmp rcx, rsi
je 0x14001890e
test byte [rcx + 0x1c], 1
je 0x14001890e
cmp byte [rcx + 0x19], 5
jb 0x14001890e
mov rcx, qword [rcx + 0x10]
lea r8, [0x14011b7b0]
mov edx, 0x140
mov r9d, ebx
call fcn.1400036d4
mov eax, ebx
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400376c0
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov esi, ebp
mov edi, ebp
call fcn.140038b70
test eax, eax
je 0x14003784c
call fcn.140038f28
test eax, eax
je 0x14003784c
lea r14, [0x14014f170]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov dword [0x1401510f0], ebp
lea r8d, [rbp + 0x20]
lea rcx, [0x140150ce0]
call sub.msvcrt.dll_memset
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140150cf8], rax
test rax, rax
je 0x140037764
mov dword [rsp + 0x28], ebp
lea r8, [0x140037290]
or dword [rsp + 0x20], 0xffffffff
lea rcx, [0x1401510f8]
xor r9d, r9d
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x14003776e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x1400377ac
lea rdx, [0x140150ce0]
mov esi, 1
lea rcx, [0x140151100]
call qword [sym.imp.IPHLPAPI.DLL_NotifyAddrChange]
mov ebx, eax
cmp eax, 0x3e5
jne 0x1400377ac
lea rcx, [0x140151108]
mov edi, esi
call fcn.140037204
mov ebx, eax
test eax, eax
jne 0x1400377b4
mov ebx, ebp
mov dword [0x1401510ec], esi
test ebx, ebx
je 0x14003783f
mov rcx, r14
mov dword [0x1401510f0], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1401510f8]
test esi, esi
mov rcx, r14
cmovne rax, rbp
mov qword [0x1401510f8], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x1400377f5
lea rcx, [0x140150ce0]
call qword [sym.imp.IPHLPAPI.DLL_CancelIPChangeNotify]
mov rcx, qword [0x140150cf8]
test rcx, rcx
je 0x140037807
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [0x140150ce0]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [0x140151108]
test rcx, rcx
je 0x140037832
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [0x140151108], rbp
mov qword [0x140151100], rbp
mov dword [0x1401510ec], ebp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x140037885
mov rcx, qword [0x14014dd40]
lea rax, [0x14014dd40]
cmp rcx, rax
je 0x140037880
test byte [rcx + 0x1c], 4
je 0x140037880
cmp byte [rcx + 0x19], 2
jb 0x140037880
mov rcx, qword [rcx + 0x10]
lea r8, [0x14011c758]
mov edx, SafeArrayAccessData
call fcn.140003614
mov eax, 0x8000ffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140038fa0
Capabilities:
Check http status code

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov edi, edx
mov rsi, rcx
and dword [rax - 0x18], 0
lea rbp, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rbp
je 0x140039000
test byte [rcx + 0x1c], 1
je 0x140039000
cmp byte [rcx + 0x19], 5
jb 0x140039000
mov edx, 0xa
mov r9d, edi
lea r8, [0x14011c7a8]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
mov rax, qword [0x14014e920]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140009050]
lea rcx, [0x14014e920]
call rbx
add rax, 0x18
mov qword [rsi], rax
mov dword [rsp + 0x20], 1
cmp edi, 0x192
je 0x140039073
cmp edi, 0x194
je 0x140039073
cmp edi, 0x1f5
je 0x140039073
lea eax, [rdi - 0x2bd]
cmp eax, 0x13
ja 0x140039059
mov ecx, 0x81fbf
bt ecx, eax
jb 0x140039073
cmp edi, 0x321
je 0x140039073
mov r8d, edi
mov edx, 0x67
mov rcx, rsi
call fcn.140039670
jmp 0x14003908d
mov ecx, edi
call fcn.140004a9c
test rax, rax
je 0x14003908d
mov r8d, edi
mov rdx, rax
mov rcx, rsi
call fcn.140004bd4
mov rcx, qword [0x14014dd40]
cmp rcx, rbp
je 0x1400390bd
test byte [rcx + 0x1c], 1
je 0x1400390bd
cmp byte [rcx + 0x19], 5
jb 0x1400390bd
mov edx, reloc.WSOCK32.dll_inet_ntoa
mov r9, qword [rsi]
lea r8, [0x14011c7a8]
mov rcx, qword [rcx + 0x10]
call fcn.140003638
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400446f8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x14004471b
mov eax, 0x8000ffff
jmp 0x140044857
add rcx, 0x38
call fcn.140004604
test eax, eax
js 0x140044857
xor r9d, r9d
mov byte [rbx + 0x60], 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x140044765
cmp byte [rbx + 0x60], al
je 0x14004475b
lea rcx, [rbx + 0x38]
mov byte [rbx + 0x60], al
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.14001ced0
jmp 0x140044857
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
jne 0x14004479e
call fcn.14001ced0
mov rcx, rbx
mov edi, eax
call fcn.140044ca0
test eax, eax
jns 0x140044855
test edi, edi
cmovns edi, eax
jmp 0x140044855
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140044870
mov esi, eax
test eax, eax
jns 0x1400447cd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140044ca0
mov eax, esi
jmp 0x140044857
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
je 0x14004477d
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140044870
mov edi, eax
test eax, eax
jns 0x14004480f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140044ca0
jmp 0x140044855
lea rax, [rbx + 8]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140044d80]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
test rax, rax
je 0x14004477d
mov rcx, qword [rbx + 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140044855
call fcn.14001ced0
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140048410
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x14014dd40]
lea rsi, [0x14014dd40]
cmp rcx, rsi
je 0x14004845b
test byte [rcx + 0x1c], 1
je 0x14004845b
cmp byte [rcx + 0x19], 5
jb 0x14004845b
mov eax, dword [rdi]
lea r8, [0x14011cfc8]
mov rcx, qword [rcx + 0x10]
mov edx, 0x2c
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.140026264
mov rcx, qword [rbx]
lea rax, [rsp + 0x60]
and dword [rsp + 0x50], 0
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [0x14011cec8]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400484a8
mov eax, dword [rsp + 0x68]
sub eax, 4
neg eax
sbb ebx, ebx
and ebx, 0xd
mov r10, qword [0x14014dd40]
cmp r10, rsi
je 0x1400484e9
test byte [r10 + 0x1c], 2
je 0x1400484e9
cmp byte [r10 + 0x19], 5
jb 0x1400484e9
mov eax, dword [rsp + 0x50]
lea r8, [0x14011cfc8]
mov rcx, qword [r10 + 0x10]
mov edx, 0x2d
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.14000574c
mov r10, qword [0x14014dd40]
test ebx, ebx
jne 0x14004852b
cmp r10, rsi
je 0x14004851e
test byte [r10 + 0x1c], 2
je 0x14004851e
cmp byte [r10 + 0x19], 4
jb 0x14004851e
mov eax, dword [rsp + 0x50]
lea edx, [rbx + 0x2e]
mov r9d, dword [rdi]
lea r8, [0x14011cfc8]
mov rcx, qword [r10 + 0x10]
mov dword [rsp + 0x20], eax
call fcn.14000574c
mov eax, dword [rsp + 0x50]
mov dword [rdi], eax
mov r10, qword [0x14014dd40]
cmp r10, rsi
je 0x14004856a
test byte [r10 + 0x1c], 1
je 0x14004856a
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x14004856a
mov ecx, dword [rdi]
lea r8, [0x14011cfc8]
mov dword [rsp + 0x20], ecx
mov edx, 0x2f
mov rcx, qword [r10 + 0x10]
mov r9d, ebx
call fcn.14000574c
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x140070ab8
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov r12, r9
mov rdi, r8
mov r15, rdx
and qword [rbp - 0x18], 0
lea rax, [0x14014dd40]
mov rcx, qword [0x14014dd40]
cmp rcx, rax
je 0x140070b20
test byte [rcx + 0x1c], 2
je 0x140070b20
cmp byte [rcx + 0x19], 5
jb 0x140070b20
mov edx, reloc.Cabinet.dll_FCIDestroy
lea r8, [0x140123ef0]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov rax, qword [r15]
mov rbx, qword [rax]
mov rcx, rbx
call qword [fcn.140009050]
lea r8, [rbp - 0x18]
lea rdx, [0x140122f10]
mov rcx, r15
call rbx
mov esi, eax
test eax, eax
js 0x140070c9d
lea rcx, [rbp + 0x30]
call fcn.14007969c
mov esi, eax
test eax, eax
js 0x140070c9d
mov r14, qword [rbp + 0x30]
mov rax, qword [r14]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
mov rcx, r14
call rbx
mov rdx, qword [rbp - 0x18]
xor esi, esi
mov qword [r14 + 0x48], rdi
lea rcx, [r14 + 0x50]
cmp qword [rcx], rdx
je 0x140070b8d
call fcn.14001bcb0
and qword [rsp + 0x28], rsi
and dword [rsp + 0x20], esi
mov r9, r14
lea r8, [0x14006ffc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14 + 0x60], rax
test rax, rax
jne 0x140070bc7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140070c87
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r12
mov r9, r15
mov r8d, 1
lea rdx, [0x140123f30]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_ConnectToConnectionPoint]
mov esi, eax
test eax, eax
js 0x140070c87
and dword [rbp - 0x20], 0
and dword [rbp + 0x30], 0
and dword [rbp + 0x38], 0
mov rbx, qword [rbp - 0x18]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [fcn.140009050]
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call rdi
cmp dword [rbp + 0x30], 0
jne 0x140070c61
cmp dword [rbp + 0x38], 0
jne 0x140070c61
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r12
mov r9, r15
xor r8d, r8d
lea rdx, [0x140123f30]
xor ecx, ecx
call qword [sym.imp.SHLWAPI.dll_ConnectToConnectionPoint]
mov esi, 0x80070490
jmp 0x140070c87
mov rbx, qword [rbp - 0x18]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [fcn.140009050]
mov edx, 2
mov r8d, 0x3e8
mov rcx, rbx
call rdi
mov esi, eax
mov rax, qword [r14]
mov rbx, qword [rax + 0x10]
mov rcx, rbx
call qword [fcn.140009050]
mov rcx, r14
call rbx
nop
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x140070cbb
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140009050]
mov rcx, rbx
call rdi
mov eax, esi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140071344
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r15, rdx
mov rsi, rcx
lea rdx, [rbp - 0x18]
call fcn.1400702d0
nop
mov rax, qword [0x14014e920]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140009050]
lea rcx, [0x14014e920]
call rbx
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x18]
call fcn.1400702f4
mov r14d, eax
test eax, eax
js 0x1400714ca
lea rdx, str.SELECT_System.ItemNameDisplay__System.ItemUrl_FROM_SystemIndex_WHERE_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_stream__AND_NOT_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_hidden__AND_System.Shell.OmitFromView___true_AND__System.ItemType__.wpl_OR_System.ItemType__.m3u_
lea rcx, [rbp + 0x40]
call fcn.140004d1c
nop
mov r8d, 5
lea rdx, [0x140122e10]
lea rcx, [rbp + 0x40]
call fcn.1400046e8
mov rdx, qword [rbp - 0x30]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x40]
call fcn.1400046e8
mov r8d, 0x24
lea rdx, str._ORDER_BY_System.ItemNameDisplay_ASC
lea rcx, [rbp + 0x40]
call fcn.1400046e8
mov rdi, qword [rsi + 0x10]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x38]
mov rcx, rbx
call qword [fcn.140009050]
mov r8, qword [rbp + 0x40]
lea rdx, [0x140127778]
mov rcx, rdi
call rbx
mov r14d, eax
test eax, eax
js 0x14007149b
and qword [rbp + 0x48], 0
mov rdi, qword [rsi + 0x10]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x20]
mov rcx, rbx
call qword [fcn.140009050]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.:s_f
xor edx, edx
mov rcx, rdi
call rbx
mov r14d, eax
test eax, eax
js 0x14007147c
mov r8, r15
mov rdx, qword [rbp + 0x48]
mov rcx, rsi
call fcn.14007046c
mov r14d, eax
mov rbx, qword [rbp + 0x48]
test rbx, rbx
je 0x14007149b
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [fcn.140009050]
mov rcx, rbx
call rdi
nop
mov rsi, qword [rbp + 0x40]
or eax, 0xffffffff
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x1400714ca
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rbp - 0x30]
or eax, 0xffffffff
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x1400714f9
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, r14d
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret