joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400324e8
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x420
mov rbx, rcx
mov rcx, qword [rcx + 0x50]
mov rbp, rdx
lea rdx, [0x1400985a4]
call fcn.1400774dc
xor edi, edi
mov rsi, rax
cmp rax, rdi
jne 0x14003254a
mov dword [rbx + 0x20], SafeArrayDestroyDescriptor
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x24], eax
mov rcx, qword [rbx + 0x190]
cmp rcx, rdi
je 0x140032629
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x140032629
mov dword [rsp + 0x430], 1
lea r9, [rsp + 0x430]
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
cmp eax, edi
je 0x1400325ff
cmp dword [rsp + 0x430], edi
je 0x1400325b0
mov edx, dword [rsp + 0x430]
lea rcx, [rsp + 0x20]
mov r9, rsi
mov r8d, 1
call fcn.140077844
mov eax, dword [rsp + 0x430]
add qword [rbx + 0x10], rax
cmp dword [rsp + 0x430], edi
jne 0x140032555
cmp qword [rbx + 0x10], rdi
jne 0x1400325da
mov dword [rbx + 0x20], SafeArrayDestroyDescriptor
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x24], eax
mov rcx, qword [rbx + 0x190]
cmp rcx, rdi
je 0x1400325f2
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400325f2
mov dword [rbx + 0x20], edi
mov rcx, qword [rbx + 0x190]
cmp rcx, rdi
je 0x1400325ef
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov dil, 1
mov rcx, rsi
call fcn.140077974
mov al, dil
jmp 0x14003262b
mov dword [rbx + SafeArrayDestroyDescriptor], 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x24], eax
mov rcx, qword [rbx + 0x190]
cmp rcx, rdi
je 0x140032621
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rsi
call fcn.140077974
xor al, al
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140032644
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov r12, rdx
mov rdi, rcx
lea rdx, [rax + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov dword [rax + 0x18], 1
mov qword [rax + 0x20], 1
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov rax, qword [rsp + 0x78]
mov r11d, 0x400
test rax, rax
cmovne r11, rax
cmp dword [rsp + 0x70], 0
mov qword [rsp + 0x78], r11
je 0x1400327ef
mov r15d, 4
test r11, r11
jne 0x1400326af
xor esi, esi
jmp 0x1400326bf
mov rcx, r11
call fcn.140075b98
mov r11, qword [rsp + 0x78]
mov rsi, rax
lea r9, [rsp + 0x70]
mov r8d, r11d
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400327ff
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x1400327e7
mov rbp, rcx
test rsi, rsi
je 0x1400327d3
test ecx, ecx
je 0x1400327d3
mov rcx, qword [rdi + 0x88]
and qword [rsp + 0x20], 0
and qword [rsp + 0x28], 0
cmp qword [rdi + 0x80], rcx
jne 0x14003276a
add rcx, rcx
mov eax, 8
cmp rcx, r15
cmovb rcx, r15
mov qword [rdi + 0x88], rcx
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140075b98
mov r8, qword [rdi + 0x80]
mov rdx, qword [rdi + 0x78]
shl r8, 3
mov rcx, rax
mov rbx, rax
call fcn.1400753d0
mov rcx, qword [rdi + 0x78]
call fcn.140075884
mov qword [rdi + 0x78], rbx
mov ecx, reloc.WSOCK32.dll_recv
call fcn.140075b98
mov r11, rax
test rax, rax
je 0x140032788
movdqu xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rax], xmm0
jmp 0x14003278b
xor r11d, r11d
mov rcx, qword [rdi + 0x80]
mov rax, qword [rdi + 0x78]
mov qword [rax + rcx*8], r11
inc qword [rdi + 0x80]
xor ecx, ecx
call fcn.140075884
mov rax, qword [rdi + 0x78]
mov rcx, qword [rdi + 0x80]
mov rcx, qword [rax + rcx*8 - 8]
mov qword [rcx], rsi
mov rcx, qword [rdi + 0x80]
mov rax, qword [rdi + 0x78]
mov rcx, qword [rax + rcx*8 - 8]
mov qword [rcx + 8], rbp
mov ecx, dword [rsp + 0x70]
mov eax, ecx
add qword [rdi + 0x10], rax
test ecx, ecx
je 0x1400327ef
mov r11, qword [rsp + 0x78]
jmp 0x1400326a6
mov rcx, rsi
call fcn.140075884
cmp qword [rdi + 0x10], 0
jne 0x14003282d
mov dword [rdi + 0x20], SafeArrayDestroyDescriptor
jmp 0x14003280e
mov rcx, rsi
call fcn.140075884
mov dword [rdi + SafeArrayDestroyDescriptor], 0x20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x24], eax
mov rcx, qword [rdi + 0x190]
test rcx, rcx
je 0x140032829
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
jmp 0x140032845
and dword [rdi + 0x20], 0
mov rcx, qword [rdi + 0x190]
test rcx, rcx
je 0x140032843
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140035d94
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov ecx, dword [rsp + 0x30]
mov eax, r9d
mov ebp, r9d
shl eax, 2
mov esi, r8d
mov edi, ecx
imul ebp, ecx
movsxd rbx, eax
or r10d, 0xffffffff
shl ebp, 2
add rsi, rdx
add rbx, rdx
mov r11, rdx
mov r9, rdx
lea r12, [0x1400a7ba0]
shl edi, 2
movzx eax, byte [r11 + 2]
movzx ecx, r10b
shr r10d, 8
xor rcx, rax
movzx eax, byte [r11 + 1]
mov edx, dword [r12 + rcx*4]
xor edx, r10d
movzx ecx, dl
shr edx, 8
xor rcx, rax
movzx eax, byte [r11]
add r11, rbp
mov r8d, dword [r12 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
mov r10d, dword [r12 + rcx*4]
xor r10d, r8d
cmp r11, rsi
jb 0x140035e30
mov eax, edi
add r9, rax
mov r11, r9
cmp r9, rbx
jb 0x140035dde
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pxor xmm0, xmm0
mov rdi, qword [rsp + 0x28]
not r10d
mov eax, r10d
cvtsi2sd xmm0, rax
pop r12
ret
Function at 0x140035e5c
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov eax, dword [r8 + 8]
mov rbx, r8
mov r8d, dword [r8]
mov r10d, dword [rbx + 0xc]
mov r11d, dword [rbx + 4]
cmp eax, r8d
setl dil
cmp r10d, r11d
mov r14, r9
setl sil
test dil, dil
je 0x140035ea1
mov dword [rbx], eax
mov dword [rbx + 8], r8d
test sil, sil
je 0x140035eae
mov dword [rbx + 4], r10d
mov dword [rbx + 0xc], r11d
mov r9, rdx
mov edx, dword [rcx + 0x1d0]
lea r8, [rsp + 0xd0]
call fcn.14003ac38
mov eax, dword [rsp + 0xd4]
mov r11, qword [rsp + 0xd0]
add dword [rbx + 0xc], eax
add dword [rbx + 4], eax
add dword [rbx + 8], r11d
mov ebp, dword [rbx + 8]
mov r12d, dword [rbx + 0xc]
add dword [rbx], r11d
sub ebp, dword [rbx]
sub r12d, dword [rbx + 4]
mov eax, 1
xor ecx, ecx
add ebp, eax
add r12d, eax
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, r12d
mov edx, ebp
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, r13
mov qword [rsp + 0xe0], rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
mov r15, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov qword [rsp + 0xe8], rax
test sil, sil
je 0x140035f48
mov r9d, dword [rbx + 0xc]
jmp 0x140035f4c
mov r9d, dword [rbx + 4]
test dil, dil
je 0x140035f57
mov r8d, dword [rbx + 8]
jmp 0x140035f5a
mov r8d, dword [rbx]
mov dword [rsp + 0x50], 0xcc0020
mov edx, r12d
mov eax, ebp
mov ecx, ebp
mov ebx, r12d
neg ebx
test sil, sil
cmovne edx, ebx
neg eax
test dil, dil
mov dword [rsp + 0x48], edx
cmovne ecx, eax
xor edx, edx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov r9d, ebp
mov rcx, r15
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r12d
call qword [sym.imp.GDI32.dll_StretchBlt]
mov rsi, qword [rsp + 0xe0]
mov eax, 1
mov dword [rsp + 0x64], ebp
mov word [rsp + 0x6c], ax
xor ebp, ebp
mov eax, SafeArrayAllocDescriptor
mov word [rsp + 0x6e], ax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
mov dword [rsp + 0x60], SafeArrayCreateEx
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x70], ebp
call qword [sym.imp.GDI32.dll_GetDIBits]
mov r11d, dword [rsp + 0x74]
mov rcx, r11
mov dword [r14], r11d
call fcn.140075b98
mov dword [rsp + 0x30], ebp
mov r9d, r12d
mov rdi, rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rsi
mov rcx, r15
mov qword [rsp + 0x20], rdi
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rdx, qword [rsp + 0xe8]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r15
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
cmp ebx, ebp
je 0x140036071
mov rax, rdi
jmp 0x14003607b
mov rcx, rdi
call fcn.140075884
xor eax, eax
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003b75c
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rdi, rcx
mov eax, 2
lea rcx, [r11 - 0x48]
mov ebp, r9d
mov r12, r8
mov rsi, rdx
mov word [rdx], ax
call fcn.140009ee4
mov r14, qword [r12 + 8]
mov r8, qword [r12]
xor r15d, r15d
lea r9d, [r14 + 1]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r13, eax
cmp r13d, r15d
jne 0x14003b7d7
lea rcx, [rsp + 0x40]
call fcn.14000a288
jmp 0x14003b825
mov rcx, r13
call fcn.140075b98
mov r8, qword [r12]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9d, [r14 + 1]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov rbx, rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x40]
dec eax
xor r8d, r8d
mov rdx, rbx
movsxd r9, eax
call fcn.14000a1d8
mov rcx, rbx
call fcn.140075884
mov rcx, qword [rsp + 0x40]
call sub.WSOCK32.dll_inet_addr
lea rcx, [rsp + 0x40]
mov ebx, eax
call fcn.140001e50
cmp ebx, 0xffffffff
jne 0x14003b87b
lea rdx, str.255.255.255.255
mov rcx, r12
call fcn.140006314
cmp al, r15b
jne 0x14003b87b
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
cmp byte [rcx + 0x19], r15b
je 0x14003b86e
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x30]
jmp 0x14003b872
mov rdx, qword [rcx + 0x10]
mov dword [rdx + 0x1c], 1
jmp 0x14003b8bd
lea eax, [rbp - 1]
mov dword [rsi + 4], ebx
cmp eax, 0xfffe
ja 0x14003b898
movzx ecx, bp
call sub.WSOCK32.dll_htons
mov word [rsi + 2], ax
mov al, 1
jmp 0x14003b8d7
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
cmp byte [rcx + 0x19], r15b
je 0x14003b8b2
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x30]
jmp 0x14003b8b6
mov rdx, qword [rcx + 0x10]
mov dword [rdx + 0x1c], 2
cmp byte [rcx + 0x19], r15b
je 0x14003b8cd
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x30]
jmp 0x14003b8d1
mov rcx, qword [rcx + 0x10]
xor al, al
mov byte [rcx + 0x20], r15b
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14003cac4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x2d0
mov rsi, rcx
lea rcx, [rsp + 0x48]
xor r12d, r12d
mov rbp, rdx
mov ebx, 0x80004002
mov dword [rax + 0x18], SafeArrayCreateEx
mov edi, r12d
call fcn.140001df0
lea r11, [rsp + 0x40]
lea rdx, str.interface
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x14003cc74
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x300]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x70]
mov edx, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r12d
jne 0x14003cc69
mov eax, dword [rsp + 0x300]
lea rdx, str.interface_
lea rcx, [rsp + 0x48]
mov word [rsp + rax*2 + 0x70], r12w
mov dword [rsp + 0x300], 0x1fe
call fcn.1400026d8
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140001ef4
mov rdx, qword [rsp + 0x48]
lea r11, [rsp + 0x308]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x14003cc52
mov rcx, qword [rsp + 0x308]
lea rax, [rsp + 0x300]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x14003cc44
mov eax, dword [rsp + 0x300]
lea rcx, [rsp + 0xc0]
mov rdx, rbp
shr eax, 1
mov dword [rsp + 0x300], eax
mov word [rsp + rax*2 + 0xc0], r12w
call fcn.140075a4c
cmp eax, r12d
jne 0x14003cc44
lea rcx, [rsp + 0x70]
mov rdx, rsi
call qword [sym.imp.ole32.dll_IIDFromString]
mov ebx, eax
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
je 0x14003cc69
inc edi
mov dword [rsp + 0x300], SafeArrayCreateEx
jmp 0x14003cb2c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x48]
call fcn.140001e50
lea r11, [rsp + 0x2d0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14003cc98
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x290
mov rsi, rcx
lea rcx, [rsp + 0x40]
movaps xmmword [rax - 0x28], xmm6
mov rbp, rdx
call fcn.140001df0
lea rdx, [rsp + 0x38]
movsd xmm6, qword [0x14009da48]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromIID]
xor r12d, r12d
cmp eax, r12d
mov edi, eax
jl 0x14003cebb
mov rcx, qword [rsp + 0x38]
call fcn.140013048
lea rdx, str.interface_
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.1400026d8
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140001ef4
lea rdx, str.TypeLib
lea rcx, [rsp + 0x40]
call fcn.140001ef4
mov rcx, rbx
call fcn.14007689c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x40]
lea r11, [rsp + 0x2c8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x14003cebb
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x14003cead
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.140013048
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.14007689c
cmp edi, r12d
jl 0x14003cead
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
lea rdx, str.Version
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x14003ce55
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.140077164
movapd xmm6, xmm0
movsd xmm1, qword [0x14009da48]
movapd xmm0, xmm6
call fcn.14007b270
lea rax, [rsp + 0x30]
cvttsd2si rdx, xmm6
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
cvttsd2si r8, xmm0
call qword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
cmp eax, r12d
mov edi, eax
jl 0x14003cead
mov rcx, qword [rsp + 0x30]
mov r8, rbp
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov edi, eax
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.140001e50
lea r11, [rsp + 0x290]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x14003cee4
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x2e0
mov rbx, rcx
xor r12d, r12d
lea rcx, [rsp + 0x58]
mov rsi, r9
mov rbp, r8
mov rdi, rdx
mov qword [rsp + 0x30], r12
mov qword [rax + 0x20], r12
call fcn.140001df0
lea rcx, [rsp + 0x38]
call fcn.140001df0
lea rcx, [rsp + 0x78]
call fcn.140001df0
lea rdx, str.SOFTWAREClasses_
lea rcx, [rsp + 0x58]
call fcn.1400026d8
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.140001ef4
lea rdx, str.CLSID
lea rcx, [rsp + 0x58]
call fcn.140001ef4
lea rdx, [0x1400956d0]
lea rcx, [rsp + 0x38]
call fcn.1400026d8
cmp rdi, r12
je 0x14003cfa0
cmp word [rdi], 0x5c
je 0x14003cfa0
cmp word [rdi + 2], 0x5c
je 0x14003cfa0
lea rdx, [0x14009bcf0]
lea rcx, [rsp + 0x38]
call fcn.1400026d8
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.140001ef4
cmp rsi, r12
je 0x14003d013
xor edx, edx
lea rcx, [rsp + 0x98]
lea r8d, [rdx + 0x30]
call fcn.1400761e0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x9c], r12d
call fcn.140001e80
lea rdx, str.IPC_
lea rcx, [rsp + 0x78]
call fcn.140001ef4
mov r11, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0xb0], r11
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp eax, r12d
jne 0x14003d100
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp eax, r12d
jne 0x14003d100
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x318]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x14003d0f5
mov rcx, qword [rsp + 0x318]
lea rax, [rsp + 0x308]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x308], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x14003d0e7
mov eax, dword [rsp + 0x308]
lea rcx, [rsp + 0xd0]
shr eax, 1
mov dword [rsp + 0x308], eax
mov word [rsp + rax*2 + 0xd0], r12w
call fcn.140013048
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.14007689c
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.140001e50
lea rcx, [rsp + 0x38]
call fcn.140001e50
lea rcx, [rsp + 0x58]
call fcn.140001e50
lea r11, [rsp + 0x2e0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140046a10
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
mov eax, 0x2060
call fcn.140090020
sub rsp, rax
lea rcx, [rsp + 0x20]
mov rbp, rdx
call fcn.140001df0
lea rcx, [rsp + 0x40]
call fcn.140001df0
mov rcx, rbp
call fcn.1400174a4
xor r12d, r12d
movzx ecx, word [rax]
mov rsi, rax
mov dil, r12b
mov rbx, r12
cmp cx, r12w
je 0x140046b94
lea r13d, [r12 + 0x25]
inc rbx
cmp cx, r13w
jne 0x140046b43
cmp word [rsi + rbx*2], r13w
jne 0x140046a9a
lea rcx, [rsp + 0x20]
mov edx, r13d
mov dil, 1
call fcn.140005188
inc rbx
jmp 0x140046b50
lea rdx, [0x1400956d0]
lea rcx, [rsp + 0x40]
call fcn.1400026d8
jmp 0x140046ac4
cmp r11w, r12w
je 0x140046acf
lea rcx, [rsp + 0x40]
movzx edx, r11w
call fcn.140005188
inc rbx
movzx r11d, word [rsi + rbx*2]
cmp r11w, r13w
jne 0x140046aad
cmp word [rsi + rbx*2], r12w
je 0x140046b5f
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0xfff
inc rbx
mov word [rsp + 0x60], r12w
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
cmp eax, r12d
je 0x140046b12
lea rdx, [rsp + 0x60]
call fcn.140001ef4
mov dil, 1
jmp 0x140046b50
lea rdx, [0x14009cbf4]
mov dil, 1
call fcn.140001ef4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140005264
lea rdx, [0x14009cbf4]
lea rcx, [rsp + 0x20]
call fcn.140001ef4
jmp 0x140046b50
movzx edx, cx
lea rcx, [rsp + 0x20]
call fcn.140005188
mov cx, word [rsi + rbx*2]
cmp cx, r12w
je 0x140046b82
jmp 0x140046a6e
lea rdx, [0x14009cbf4]
lea rcx, [rsp + 0x20]
mov dil, 1
call fcn.140001ef4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140005264
cmp dil, r12b
je 0x140046b94
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.14001800c
lea rcx, [rsp + 0x40]
call fcn.140001e50
lea rcx, [rsp + 0x20]
call fcn.140001e50
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x14004b190
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov edi, r9d
mov rbx, r8
mov r13b, dl
call fcn.140001df0
xor r15d, r15d
lea rcx, [rsp + 0x40]
xor edx, edx
lea r8d, [r15 + 0x70]
mov r12, r15
mov rbp, r15
lea r14d, [r15 + 1]
call fcn.1400761e0
cmp edi, 2
jb 0x14004b212
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.1400174a4
cmp word [rax], r15w
je 0x14004b212
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.1400174a4
mov rcx, rax
call fcn.140013048
mov r12, rax
cmp edi, 3
jb 0x14004b22f
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.1400174a4
mov rcx, rax
call fcn.140013048
mov rbp, rax
cmp edi, 4
jb 0x14004b26f
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call fcn.1400174a4
cmp word [rax], r15w
je 0x14004b26f
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
cmp dword [rcx + 8], 0xa
jne 0x14004b25d
mov rax, qword [rcx]
cmp dword [rax], 0x29
je 0x14004b26f
call fcn.1400174d4
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.140001e80
cmp edi, 5
jb 0x14004b285
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x20]
call fcn.140017618
movzx r14d, ax
mov edi, WSAStartup
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, rdi
call fcn.1400761e0
mov rax, qword [rsp + 0x20]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 8]
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], r15
mov rcx, qword [rax]
call fcn.1400174a4
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x58], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
cmp r12, r15
je 0x14004b2ee
mov rcx, r12
call fcn.140075884
cmp rbp, r15
je 0x14004b2fb
mov rcx, rbp
call fcn.140075884
cmp ebx, r15d
jne 0x14004b34e
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
cmp byte [rcx + 0x19], r15b
je 0x14004b31a
mov rax, qword [rcx + 0x10]
mov rdx, qword [rax + 0x30]
jmp 0x14004b31e
mov rdx, qword [rcx + 0x10]
mov dword [rdx + 0x1c], 1
cmp byte [rcx + 0x19], r15b
je 0x14004b335
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 0x30]
jmp 0x14004b339
mov rcx, qword [rcx + 0x10]
mov byte [rcx + 0x20], r15b
mov rcx, qword [rsp + 0x100]
xor edx, edx
call fcn.140017da8
jmp 0x14004b389
cmp r13b, r15b
je 0x14004b364
mov rax, qword [rsp + 0xa8]
mov qword [rsi + 0x7b8], rax
jmp 0x14004b389
mov rcx, qword [rsp + 0x100]
mov edx, 1
call fcn.140017da8
mov rcx, qword [rsp + 0xa8]
cmp rcx, r15
je 0x14004b389
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x20]
call fcn.140001e50
lea r11, [rsp + 0xb0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret