joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400090b0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400090d6
mov r8, rdx
mov rdx, qword [rbx]
call fcn.14000cef8
jmp 0x14000913d
cmp byte [0x14007a7e0], 0
jne 0x14000911a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000910a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007a7d8], rax
jmp 0x140009111
mov rax, qword [0x14007a7d8]
mov byte [0x14007a7e0], 1
jmp 0x140009121
mov rax, qword [0x14007a7d8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140009137
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x14000913d
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140009b88
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rdx
mov rdi, rcx
lea r14, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
mov qword [rbp - 0x49], r14
xor esi, esi
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x41], esi
lea rax, vtable.CDPAnyBlob.0
mov qword [rbp - 0x49], rax
lea eax, [rsi + 0x19]
mov qword [rbp - 0x31], rax
lea r15, vtable.CDPGUIDBlob.0
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x31], rax
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140009c04
call fcn.140009660
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x41], esi
lea r8, [rbp - 0x41]
lea rdx, str.HostId
mov rcx, rdi
call fcn.1400098c4
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.140005394
mov r8d, 0x10
lea rdx, [0x1400580e0]
mov rcx, rbx
call fcn.1400345d0
test eax, eax
jne 0x140009d54
lea rcx, [rbp - 1]
call fcn.1400033e0
nop
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x29]
call fcn.140003280
nop
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140009c91
mov eax, dword [rbp - 0x21]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
lea rdx, str.HostId
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140009cc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x140009cad
cmp eax, 0x80000000
jb 0x140009cc5
mov ecx, eax
call fcn.140032390
int3
test eax, eax
je 0x140009cc5
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
int3
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140009cd3
call fcn.140009660
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x41], esi
lea r8, [rbp - 0x41]
lea rdx, str.HostId
mov rcx, rdi
call fcn.1400098c4
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x49]
call fcn.140005394
movups xmm0, xmmword [rax]
movdqu xmmword [rbx], xmm0
mov r8d, 0x10
lea rdx, [0x1400580e0]
mov rcx, rbx
call fcn.1400345d0
test eax, eax
jne 0x140009d25
mov ecx, 0x80004005
call fcn.140032390
nop
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x29], r14
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x140009d3b
call fcn.140009660
mov qword [rbp - 0x19], rsi
mov dword [rbp - 0x21], esi
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x140009d54
call fcn.140009640
mov qword [rbp + 0xf], rsi
mov qword [rbp - 0x49], r15
mov qword [rbp - 0x49], r14
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140009d6a
call fcn.140009660
mov qword [rbp - 0x39], rsi
mov dword [rbp - 0x41], esi
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140033cb0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000bd28
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15d, r9d
mov r14, r8
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov qword [rbp - 0x69], r12
mov dword [rbp - 0x61], r12d
mov qword [rbp - 0x59], r12
mov r9d, 0xf023f
lea rcx, [rbp - 0x69]
call fcn.14000bad4
movsxd rbx, eax
test eax, eax
jne 0x14000bf0d
mov qword [rbp - 0x51], r12
mov ecx, dword [rbp - 0x61]
mov rdx, qword [rbp - 0x59]
mov rax, qword [rbp - 0x69]
mov qword [rbp - 0x69], r12
mov dword [rbp - 0x61], r12d
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x49], r12d
mov qword [rbp - 0x41], r12
mov dword [rbp - 0x49], ecx
mov qword [rbp - 0x41], rdx
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x51]
call fcn.140009b88
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.140003374
nop
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.1400081d0
mov ebx, 0x80000000
mov esi, 0x1fff0000
test esi, eax
je 0x14000be11
cmp eax, ebx
jb 0x14000be29
mov ecx, eax
call fcn.140032390
int3
test eax, eax
je 0x14000be29
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
int3
mov edx, 0x20019
mov r8d, 1
mov rcx, qword [rdi]
call fcn.14000c8c8
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x39]
call fcn.140003280
nop
mov rdx, qword [rbp - 0x29]
test rdx, rdx
je 0x14000be7c
mov eax, dword [rbp - 0x31]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, 3
xor r8d, r8d
lea rdx, str.HostId
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000beaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
test esi, eax
je 0x14000be92
cmp eax, ebx
jb 0x14000beaa
mov ecx, eax
call fcn.140032390
int3
test eax, eax
je 0x14000beaa
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
int3
xor edx, edx
lea rcx, [rbp - 0x69]
call fcn.14000cca4
mov rbx, r12
lea rax, vtable.CDPGUIDBlob.0
mov qword [rbp - 0x39], rax
lea rax, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
mov qword [rbp - 0x39], rax
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x14000bedc
call fcn.140009660
mov qword [rbp - 0x29], r12
mov dword [rbp - 0x31], r12d
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x14000bef6
call fcn.140009640
mov qword [rbp - 1], r12
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x14000bf09
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x51], r12
mov dword [rbp - 0x49], r12d
mov rcx, qword [rbp - 0x69]
test rcx, rcx
je 0x14000bf20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x69], r12
mov dword [rbp - 0x61], r12d
mov rax, rbx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140033cb0
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000ca70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor esi, esi
mov rdi, r9
mov rbx, r8
test r8, r8
je 0x14000ca97
cmp dword [r9], 2
jae 0x14000ca97
lea eax, [rsi + 0x7a]
jmp 0x14000cb09
mov eax, dword [r9]
xor r8d, r8d
add eax, eax
mov dword [r9], esi
mov rcx, qword [rcx]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000cb09
cmp dword [rsp + 0x30], 7
je 0x14000cad5
mov eax, 0xd
jmp 0x14000cb09
mov eax, dword [rsp + 0x60]
test rbx, rbx
je 0x14000cb03
test al, 1
jne 0x14000cace
mov ecx, eax
shr ecx, 1
cmp ecx, 1
jb 0x14000cace
mov edx, eax
shr rdx, 1
cmp word [rbx + rdx*2 - 2], si
jne 0x14000cace
cmp ecx, 1
jbe 0x14000cb03
cmp word [rbx + rdx*2 - 4], si
jne 0x14000cace
shr eax, 1
mov dword [rdi], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14000cca4
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
mov r9d, dword [rcx + 8]
or r9d, 0x2001f
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [rsp + 0x48]
call fcn.14000bad4
jmp 0x14000cd18
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000cca4
test eax, eax
mov ebx, eax
jne 0x14000cd82
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], 0x100
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14000cd09
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000cd71
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov rdx, rsi
mov rcx, rdi
call fcn.1400090b0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000cd98
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140033cb0
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000cef8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000cf5b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000cf6f
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000cf6f
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call rax
jmp 0x14000cf74
cmp dword [rcx + 8], 0
je 0x14000cf6f
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x14000cf74
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14000d230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x70], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000d2bd
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000d2bd
call fcn.140007048
mov ebx, eax
jmp 0x14000d3cc
mov r8, r15
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14000d2de
call fcn.140007048
jmp 0x14000d3bb
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d2d4
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x14000d319
mov ebx, 0x8007000e
jmp 0x14000d3bd
mov ecx, eax
test eax, eax
je 0x14000d351
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x14000d347
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x14000d351
lea rcx, [rsp + 0x70]
call fcn.140006d2c
jmp 0x14000d35b
mov ecx, 0x80070216
call fcn.140007b38
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x14000d36d
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14000d30f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14000d2d4
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4e0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000d03c
mov ebx, eax
test rsi, rsi
je 0x14000d3cc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x14000d3e3
lea rcx, [rsp + 0x70]
call fcn.140009678
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.140033cb0
add rsp, 0x490
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000f6e4
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x60
mov qword [r11 - 0x28], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov rbp, r9
mov rsi, r8
and qword [r11 - 0x20], 0
and dword [rsp + 0x50], 0
and qword [r11 - 0x10], 0
mov eax, dword [rcx + 8]
or eax, 0x2001f
and qword [r11 - 0x30], 0
and qword [r11 - 0x38], 0
mov dword [rsp + 0x28], eax
and dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdx
mov rdx, qword [rcx]
lea rcx, [r11 - 0x20]
call fcn.1400081d0
mov ebx, eax
test eax, eax
jne 0x14000f77f
test rsi, rsi
jne 0x14000f74e
lea ebx, [rax + 0xd]
jmp 0x14000f77f
mov rcx, rsi
call fcn.140037f9c
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
cmp qword [rsp + 0x48], 0
je 0x14000f798
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x48], 0
and dword [rsp + 0x50], 0
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x60
pop rsi
ret

Function at 0x14000f7b0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
mov r14, rcx
test r8, r8
jne 0x14000f7de
lea eax, [rbx + 0xd]
jmp 0x14000f813
mov rsi, rdi
mov rcx, rsi
call fcn.140037f9c
inc eax
lea rsi, [rsi + rax*2]
lea ebx, [rbx + rax*2]
cmp eax, 1
jne 0x14000f7e1
mov rcx, qword [r14]
lea r9d, [rax + 6]
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400136e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
lea rax, vtable.CDPCacheNameTranslator.0
mov qword [rcx], rax
lea rsi, [rcx + 8]
mov dword [rsi], 0x15180
lea r14, [rcx + 0xc]
mov dword [r14], 0x12c
lea r15, [rcx + 0x10]
mov dword [r15], 0x1e
xor r8d, r8d
lea rdx, str.CDPCacheNameTranslator::CDPCacheNameTranslator
lea rcx, [rbp - 0x39]
call fcn.14002de00
nop
and qword [rbp - 0x61], 0
and dword [rbp - 0x59], 0
and qword [rbp - 0x51], 0
mov ebx, 0x2001f
mov r9d, ebx
lea r8, str.SOFTWAREDigitalPersonaDPHOSTNameTranslator
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x61]
call fcn.14000bad4
test eax, eax
je 0x1400137d1
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], ebx
and dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.SOFTWAREDigitalPersonaDPHOSTNameTranslator
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x61]
call fcn.1400081d0
xor r8d, r8d
xor edx, edx
mov rbx, qword [rbp - 0x61]
mov rcx, rbx
call fcn.14000c8c8
jmp 0x1400137d5
mov rbx, qword [rbp - 0x61]
mov dword [rbp - 0x69], 4
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x65]
xor r8d, r8d
lea rdx, str.PositiveCacheTime
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x69], 4
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x65]
xor r8d, r8d
lea rdx, str.NegativeCacheTime
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp - 0x69], 4
lea rax, [rbp - 0x69]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x65]
xor r8d, r8d
lea rdx, str.NetFailureCacheTime
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [r15]
mov dword [rsp + 0x28], eax
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsi]
lea r8, str.Positive_interval__d__Negative_interval__d__Failed_interval__d
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140030824
nop
test rbx, rbx
je 0x140013890
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x61], 0
and dword [rbp - 0x59], 0
lea rcx, [rbp - 0x39]
call fcn.14002e7a8
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140033cb0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140013f04
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov edi, edx
mov rbx, rcx
lea rax, vtable._mem_alloc_t_wchar_t__class__heap_allocator_.0
mov qword [rcx], rax
and qword [rcx + 8], 0
mov ecx, 0x208
call fcn.1400331f0
test rax, rax
jne 0x140013f4a
mov ecx, 0x8007000e
call fcn.140032390
int3
mov qword [rbx + 8], rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140034b00
nop
lea rax, vtable.CHostName.0
mov qword [rbx], rax
mov dword [rsp + 0x50], 0x104
lea r8, [rsp + 0x50]
mov rdx, qword [rbx + 8]
mov ecx, edi
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
jne 0x140014019
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x140013fc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x140013fad
cmp eax, 0x80000000
jb 0x140013fc5
mov ecx, eax
call fcn.140032390
int3
test eax, eax
je 0x140013fc5
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
int3
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov edx, eax
mov r8b, 1
mov rcx, rbx
call fcn.14001d734
lea r8, [rsp + 0x50]
mov rdx, qword [rbx + 8]
mov ecx, edi
call sub.Secur32.dll_GetComputerObjectNameW
test al, al
jne 0x140014019
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x140014005
mov ecx, eax
call fcn.140032390
int3
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
nop
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140014028
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov edi, edx
mov rbx, rcx
lea rax, vtable._mem_alloc_t_wchar_t__class__heap_allocator_.0
mov qword [rcx], rax
and qword [rcx + 8], 0
mov ecx, 0x208
call fcn.1400331f0
test rax, rax
jne 0x14001406e
mov ecx, 0x8007000e
call fcn.140032390
int3
mov qword [rbx + 8], rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call fcn.140034b00
nop
lea rax, vtable.CHostName.0
mov qword [rbx], rax
mov dword [rsp + 0x50], 0x104
lea r8, [rsp + 0x50]
mov rdx, qword [rbx + 8]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14001413f
mov eax, dword [rsp + 0x50]
test eax, eax
jne 0x1400140ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x1400140d2
cmp eax, 0x80000000
jb 0x1400140ea
mov ecx, eax
call fcn.140032390
int3
test eax, eax
je 0x1400140ea
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
int3
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov edx, eax
mov r8b, 1
mov rcx, rbx
call fcn.14001d734
lea r8, [rsp + 0x50]
mov rdx, qword [rbx + 8]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14001413f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, 0x1fff0000
je 0x14001412b
mov ecx, eax
call fcn.140032390
int3
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
nop
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140014230
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
and qword [rcx], 0
lea rdi, [rcx + 8]
and qword [rdi], 0
and dword [rcx + 0x10], 0
and qword [rcx + 0x18], 0
mov rdx, rcx
mov rcx, r8
call fcn.14001b370
test rsi, rsi
je 0x14001428b
mov rdx, rsi
jmp 0x1400142be
mov dword [rsp + 0x20], 0x104
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.140034b00
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x1400142c6
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140008024
mov rcx, rbx
call fcn.14001c44c
nop
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140033cb0
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x14001a988
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x330
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov r14, rdx
mov rdi, rcx
mov r8d, 0xa
lea rdx, str.CDPDBRegSet::EnumKeys
lea rcx, [r11 - 0x2a8]
call fcn.14002de00
nop
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x58], rbx
cmp qword [rdi + 0x20], 8
jb 0x14001a9f2
mov r8, qword [rdi + 8]
jmp 0x14001a9f6
lea r8, [rdi + 8]
mov r9d, dword [rdi + 0x50]
or r9d, 0xf003f
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14000bad4
test eax, 0x1fff0000
je 0x14001aa27
cmp eax, 0x80000000
jb 0x14001aa3e
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14001aa3e
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x110]
call fcn.140034b00
mov dword [rsp + 0x40], 0x104
mov esi, ebx
mov dword [rsp + 0x44], ebx
mov rdi, qword [rsp + 0x48]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x110]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14001aaf7
inc esi
mov dword [rsp + 0x44], esi
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x78]
call fcn.140002f30
nop
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.1400129f0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x78]
call fcn.140011b58
nop
mov edx, 1
lea r8d, [rdx + 0xf]
mov rcx, qword [rsp + 0x78]
call fcn.140011434
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x40], 0x104
jmp 0x14001aa66
test rdi, rdi
je 0x14001ab0a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
jmp 0x14001ab14
mov r8d, ebx
lea rdx, [0x14004ee5e]
lea rcx, [rsp + 0xa0]
call fcn.140030b9c
nop
lea rcx, [rsp + 0xa0]
call fcn.14002e7a8
mov eax, ebx
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140033cb0
mov rbx, qword [rsp + 0x360]
add rsp, 0x330
pop r14
pop rdi
pop rsi
ret
Function at 0x14001c4dc
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rdi, r8
mov rcx, qword [rdx]
xor r9d, r9d
mov edx, 0x8004
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
xor ebx, ebx
test eax, eax
jne 0x14001c517
call fcn.140007048
jmp 0x14001c548
test rdi, rdi
je 0x14001c546
mov rcx, rdi
call fcn.140037f9c
mov rcx, qword [rsi]
xor r9d, r9d
mov rdx, rdi
lea r8d, [rax + rax]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x14001c542
call fcn.140007048
mov ebx, eax
mov eax, ebx
jmp 0x14001c548
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret