joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027ad0
Capabilities:
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
mov rdi, rcx
mov dword [rsp + 0x24], 1
test edx, edx
jne 0x140027c73
lea ecx, [rdx + 0x38]
mov qword [rsp + 0x50], rbx
call fcn.140044708
mov rbx, rax
test rax, rax
je 0x140027c49
xor eax, eax
xor ecx, ecx
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rsp + 0x28], rax
mov qword [rbx + 0x30], rdi
mov edi, 2
mov dword [rbx], eax
mov word [rsp + 0x28], di
mov qword [rsp + 0x30], rax
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x2c], eax
movzx eax, word [rsi]
lea edx, [rdi - 1]
xor r8d, r8d
mov ecx, edi
mov word [rsp + 0x2a], ax
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x140027b92
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x140027c28
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x140027c28
lea rdx, [rsp + 0x28]
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x140027bbe
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x140027c28
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x140027c28
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x140027be9
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x140027c28
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jne 0x140027c28
xor eax, eax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x140027c66
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x140027c28
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x140027c66
mov rcx, rdi
cmp rdi, 0xffffffffffffffff
je 0x140027c3f
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx + 8], 0xffffffffffffffff
mov rcx, rbx
call fcn.1400447c0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140043980
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
movzx eax, word [rsp + 0x2a]
mov word [rsi], ax
mov rax, rbx
jmp 0x140027c49
xor eax, eax
jmp 0x140027c4e
Function at 0x140027c80
Capabilities:
Connect socket

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dword [rdx], 4
mov rbx, rcx
je 0x140027cc3
lea rdx, str.ERROR:_mDNSPlatformTCPConnect___attempt_to_connect_to_an_IPv6_address:_operation_not_supported
xor ecx, ecx
call fcn.140025bd0
mov eax, 0xfffeffff
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140043980
add rsp, 0x40
pop rbx
ret
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x68], rdi
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x80]
mov qword [rcx + 0x20], rax
mov rcx, qword [rcx + 8]
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov eax, 2
mov word [rsp + 0x20], ax
mov eax, dword [rdx + 4]
mov word [rsp + 0x22], r8w
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_connect]
mov edi, eax
test eax, eax
je 0x140027d2f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x140027d2f
mov eax, 0xfffeff04
jmp 0x140027d66
mov rcx, qword [rbx + 8]
xor eax, eax
test edi, edi
sete al
lea r8, [0x140025f60]
mov r9, rbx
mov edx, 0x31
mov dword [rbx + 0x10], eax
call fcn.14002b9c0
test eax, eax
jne 0x140027d66
cmp dword [rbx + 0x10], 0
mov eax, 0xfffeff05
mov ecx, 0xfffeff03
cmovne eax, ecx
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140043980
add rsp, 0x40
pop rbx
ret
Function at 0x140028420
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x568
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
xor ebp, ebp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [rsp + 0x38], rbp
mov ebx, ebp
mov esi, ebp
mov edi, ebp
nop dword [rax]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x140028496
mov edx, dword [rsp + 0x40]
mov rcx, rsi
call fcn.140044ff0
mov rsi, rax
test rax, rax
je 0x14002865f
inc edi
cmp edi, 0x64
jl 0x140028460
jmp 0x140028645
test eax, eax
jne 0x140028645
call fcn.140026c80
mov r11d, eax
mov rax, rsi
test rsi, rsi
je 0x14002865f
lea rcx, [rax + 0x1c0]
test rcx, rcx
je 0x1400284e0
cmp byte [rcx], bl
je 0x1400284e0
lea rcx, [rax + 0x1f0]
test rcx, rcx
je 0x1400284e0
cmp byte [rcx], bl
je 0x1400284e0
test r11d, r11d
je 0x1400284ed
cmp dword [rax + 0x1a0], r11d
je 0x1400284ed
mov rax, qword [rax]
test rax, rax
jne 0x1400284b2
jmp 0x140028645
add rax, 0xc
lea r9, str.SYSTEMCurrentControlSetServicesTcpipParametersInterfaces_
lea r8, str._s_s
lea rcx, [rsp + 0x150]
mov edx, 0x400
mov qword [rsp + 0x20], rax
call fcn.140045594
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x150]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140028645
mov qword [rsp + 0x560], r12
mov r12, qword [rsp + 0x38]
mov dword [rsp + 0x30], 0x3f1
mov edi, ebp
nop
test rbx, rbx
je 0x14002855d
mov rcx, rbx
call fcn.1400447c0
mov ecx, dword [rsp + 0x30]
call fcn.140044708
mov rbx, rax
test rax, rax
je 0x1400285b0
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
lea rdx, str.Domain
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rbx
inc edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x1400285a3
cmp edi, 0x64
jl 0x140028550
cmp byte [rbx], bpl
jne 0x140028613
mov rcx, rbx
call fcn.1400447c0
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x30], 0x3f1
mov rbx, rbp
test rbx, rbx
je 0x1400285cd
mov rcx, rbx
call fcn.1400447c0
mov ecx, dword [rsp + 0x30]
call fcn.140044708
mov rbx, rax
test rax, rax
je 0x14002863d
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x44]
lea rdx, str.DhcpDomain
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rbx
inc ebp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x140028613
cmp ebp, 0x64
jl 0x1400285c0
cmp byte [rbx], 0
je 0x14002863d
lea rcx, [rsp + 0x50]
mov rdx, rbx
call fcn.140001a10
test rax, rax
je 0x14002863d
cmp byte [rsp + 0x50], 0
je 0x14002863d
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140034710
mov r12, qword [rsp + 0x560]
test rsi, rsi
je 0x140028652
mov rcx, rsi
call fcn.1400447c0
test rbx, rbx
je 0x14002865f
mov rcx, rbx
call fcn.1400447c0
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x588]
mov rsi, qword [rsp + 0x580]
mov rbp, qword [rsp + 0x578]
mov rbx, qword [rsp + 0x570]
test rcx, rcx
je 0x14002868f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.140043980
add rsp, 0x568
ret
Function at 0x140029200
Capabilities:
Get networking parameters

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x70
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor r13d, r13d
mov r12, rcx
mov esi, r13d
mov edi, r13d
mov dword [rsp + 0x40], r13d
call fcn.140026c80
mov ebx, r13d
mov ebp, eax
test eax, eax
je 0x140029296
mov dword [rsp + 0x40], r13d
nop dword [rax + rax]
lea r8, [rsp + 0x40]
mov rdx, rsi
mov ecx, ebp
call sub.IPHLPAPI.DLL_GetPerAdapterInfo
cmp eax, 0x6f
jne 0x140029288
mov edx, dword [rsp + 0x40]
mov rcx, rsi
call fcn.140044ff0
mov rsi, rax
test rax, rax
je 0x140029369
inc ebx
cmp ebx, 0x64
jl 0x140029250
jmp 0x14002934e
test eax, eax
jne 0x14002934e
lea rbx, [rsi + 0x10]
jmp 0x1400292ef
mov dword [rsp + 0x40], 0x258
nop
test rdi, rdi
je 0x1400292ae
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [rsp + 0x40]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140029369
lea rdx, [rsp + 0x40]
mov rcx, rax
call sub.IPHLPAPI.DLL_GetNetworkParams
cmp eax, 0x6f
jne 0x1400292e4
inc ebx
cmp ebx, 0x64
jl 0x1400292a0
jmp 0x14002935b
test eax, eax
jne 0x14002935b
lea rbx, [rdi + 0x110]
test rbx, rbx
je 0x14002934e
nop word [rax + rax]
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x48]
call fcn.140028ee0
test eax, eax
jne 0x140029346
movzx eax, word [0x1400506b0]
mov r8, qword [0x140050680]
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], 0x1e
lea r9, [rsp + 0x48]
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x28], r13d
mov word [rsp + 0x20], ax
call fcn.14002f370
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140029300
test rsi, rsi
je 0x14002935b
mov rcx, rsi
call fcn.1400447c0
test rdi, rdi
je 0x140029369
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140043980
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x140029390
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov eax, dword [0x140050728]
xor edi, edi
mov r13, r9
mov dword [r8], eax
mov eax, dword [0x14005072c]
mov r14, rdx
mov dword [r8 + 4], eax
mov eax, dword [0x140050730]
mov r15, rcx
mov dword [r8 + 8], eax
mov eax, dword [0x140050734]
mov dword [rsp + 0x60], edi
mov dword [r8 + 0xc], eax
mov eax, dword [0x140050738]
mov ebx, edi
mov dword [r8 + 0x10], eax
mov qword [rsp + 0x58], r12
nop dword [rax + rax]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov ebp, eax
cmp eax, 0x6f
jne 0x14002942e
mov edx, dword [rsp + 0x60]
mov rcx, rdi
call fcn.140044ff0
mov rdi, rax
test rax, rax
je 0x140029424
inc ebx
cmp ebx, 0x64
jl 0x1400293f0
jmp 0x1400294c9
mov eax, 0xffffe5b8
jmp 0x1400294d8
test eax, eax
jne 0x1400294c9
call fcn.140026c80
mov rbx, rdi
mov r12d, eax
test rdi, rdi
je 0x1400294d6
mov qword [rsp + 0x50], rsi
nop
lea rdx, [rbx + 0x1c0]
test rdx, rdx
je 0x14002949b
cmp byte [rdx], 0
je 0x14002949b
lea rsi, [rbx + 0x1f0]
test rsi, rsi
je 0x14002949b
cmp byte [rsi], 0
je 0x14002949b
mov rcx, r14
call fcn.140028ee0
test eax, eax
jne 0x14002949b
mov rdx, rsi
mov rcx, r13
call fcn.140028ee0
test eax, eax
jne 0x14002949b
test r12d, r12d
je 0x1400294a5
cmp dword [rbx + 0x1a0], r12d
je 0x1400294a5
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140029450
jmp 0x1400294c4
cmp dword [rbx + 0x194], 6
jne 0x1400294c4
mov eax, dword [rbx + 0x198]
mov dword [r15 + 0x20], eax
movzx eax, word [rbx + 0x19c]
mov word [r15 + 0x24], ax
mov rsi, qword [rsp + 0x50]
test rdi, rdi
je 0x1400294d6
mov rcx, rdi
call fcn.1400447c0
mov eax, ebp
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x14002adf0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x168
mov rax, qword [0x14006a110]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r8, [rsp + 0x38]
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14002af53
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
mov rsi, qword [rsp + 0x38]
xor ebx, ebx
mov qword [rsp + 0x160], rdi
mov dword [rsp + 0x30], 0x3f1
mov edi, ebx
test rbx, rbx
je 0x14002ae60
mov rcx, rbx
call fcn.1400447c0
mov ecx, dword [rsp + 0x30]
call fcn.140044708
mov rbx, rax
test rax, rax
je 0x14002af3b
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea rdx, str.SearchList
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc edi
cmp eax, 0xea
jne 0x14002aeaf
cmp edi, 0x64
jl 0x14002ae53
jmp 0x14002af33
test eax, eax
jne 0x14002af33
lea rdx, [0x140059a84]
mov rcx, rbx
call fcn.140045790
test rax, rax
je 0x14002af33
nop dword [rax + rax]
lea rdi, [0x140050a52]
mov rsi, rax
mov ecx, 1
repe cmpsb byte [rsi], byte [rdi]
je 0x14002af20
lea rdi, [0x140059a80]
mov rsi, rax
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x14002af20
test rax, rax
je 0x14002af20
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140001a10
test rax, rax
je 0x14002af20
cmp byte [rsp + 0x50], 0
je 0x14002af20
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.140034710
lea rdx, [0x140059a84]
xor ecx, ecx
call fcn.140045790
test rax, rax
jne 0x14002aed0
mov rcx, rbx
call fcn.1400447c0
mov rsi, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002af63
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140028420
call fcn.14002a750
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140043980
add rsp, 0x168
ret
Function at 0x14002b470
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov rdx, rcx
lea rcx, [0x140071d40]
call fcn.14000a5d0
inc dword [0x140071d58]
cmp dword [0x140071d84], 0x40
jae 0x14002b4d4
lea rcx, [0x140071d60]
lea r8, [0x140071d30]
mov qword [rsi + 0x20], rcx
mov edx, dword [0x140071d84]
mov qword [r8 + rdx*8 + 0x58], rsi
mov edx, dword [0x140071d84]
mov rcx, qword [rsi + 8]
mov qword [r8 + rdx*8 + 0x258], rcx
inc dword [0x140071d84]
xor eax, eax
add rsp, 0x30
pop rsi
ret
mov rdx, qword [0x140072198]
test rdx, rdx
je 0x14002b4f2
cmp dword [rdx + 0x24], 0x40
jb 0x14002b523
mov rdx, qword [rdx + 0x430]
test rdx, rdx
jne 0x14002b4e0
mov ecx, 0x438
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
call fcn.140044708
mov rdi, rax
test rax, rax
jne 0x14002b549
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, 0xfffefffd
add rsp, 0x30
pop rsi
ret
mov qword [rsi + 0x20], rdx
mov eax, dword [rdx + 0x24]
mov qword [rdx + rax*8 + 0x28], rsi
mov rax, qword [rsi + 8]
mov ecx, dword [rdx + 0x24]
mov qword [rdx + rcx*8 + 0x228], rax
inc dword [rdx + 0x24]
xor eax, eax
add rsp, 0x30
pop rsi
ret
xor edx, edx
mov r8d, 0x438
mov rcx, rax
call fcn.140043a10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x14002b57c
mov ebx, 0xfffefffd
jmp 0x14002b653
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x18], rax
test rax, rax
jne 0x14002b59f
mov ebx, 0xfffefffd
jmp 0x14002b653
mov rcx, rdi
call fcn.14002b180
mov ebx, eax
test eax, eax
jne 0x14002b653
lea rax, [rdi + 8]
lea r8, [0x14002b200]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.140045194
mov qword [rdi], rax
test rax, rax
jne 0x14002b5ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b64e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002b653
lea rcx, [0x140072198]
mov rdx, rdi
call fcn.14000a5d0
mov rax, qword [rdi + 0x18]
mov r11d, dword [0x1400723b0]
lea r8, [0x140071d30]
mov qword [r8 + r11*8 + 0x480], rax
inc dword [0x1400723b0]
mov qword [rsi + 0x20], rdi
mov eax, dword [rdi + 0x24]
mov qword [rdi + rax*8 + 0x28], rsi
mov ecx, dword [rdi + 0x24]
mov rax, qword [rsi + 8]
mov qword [rdi + rcx*8 + 0x228], rax
inc dword [rdi + 0x24]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
mov ebx, 0xffffe5d4
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14002b66a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], 0
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x14002b681
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x18], 0
mov rcx, rdi
call fcn.1400447c0
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
Function at 0x14002b7e0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdx, rcx
lea rcx, [0x140072198]
call fcn.14000a610
mov edx, dword [0x1400723b0]
xor ecx, ecx
test edx, edx
je 0x14002b855
mov r8, qword [rbx + 0x18]
lea rax, [0x1400721b0]
cmp qword [rax], r8
je 0x14002b824
inc ecx
add rax, 8
cmp ecx, edx
jb 0x14002b813
jmp 0x14002b855
inc ecx
lea r9, [0x140071d30]
mov r8, rdx
movsxd rax, ecx
sub r8, rax
lea rdx, [r9 + rax*8 + 0x480]
lea eax, [rcx - 1]
shl r8, 3
movsxd rcx, eax
lea rcx, [r9 + rcx*8 + 0x480]
call fcn.140043cb0
mov dword [rbx + 0x20], 1
dec dword [0x1400723b0]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, 0xffffe5d4
test eax, eax
jne 0x14002b8b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b88b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b8b8
jmp 0x14002b88d
mov eax, edi
mov dword [rsp + 0x28], eax
lea rax, str.SetEvent__
lea r8, str.PollRemoveWorker
lea rdx, str._s:_d____s_failed:__d_n
mov r9d, 0x1f0
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140025bd0
mov rcx, qword [rbx]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x14002b910
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b8e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b917
jmp 0x14002b8e3
mov eax, edi
mov dword [rsp + 0x28], eax
lea rax, str.WaitForSingleObject__
lea r8, str.PollRemoveWorker
lea rdx, str._s:_d____s_failed:__d_n
mov r9d, 0x1f4
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140025bd0
jmp 0x14002b917
cmp eax, 0x102
jne 0x14002b967
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x14002b967
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002b93c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
je 0x14002b967
lea rax, str.TerminateThread__
lea r8, str.PollRemoveWorker
lea rdx, str._s:_d____s_failed:__d_n
mov r9d, 0x1fa
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.140025bd0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
mov qword [rbx], 0
test rcx, rcx
je 0x14002b98e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14002b9a5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x18], 0
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400447c0
Function at 0x14002c4d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
lea r8, [rsp + 0x58]
lea rdx, str.SOFTWAREApple_Inc.Bonjour
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x58], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x14002c571
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, str.ManageLLRouting
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14002c571
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
lea rdx, str.ManageLLRouting
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002c581
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14002c590
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x38
lea r8, [rsp + 0x68]
lea rdx, str.SOFTWAREApple_Inc.Bonjour
xor edi, edi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x68], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ebx, eax
test eax, eax
jne 0x14002c654
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.ManageLLRouting
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002c609
cmp dword [rsp + 0x58], edi
setne dil
mov dword [reloc.WS2_32.dll_accept], edi
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
lea rdx, str.CacheEntryCount
xor r8d, r8d
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov eax, dword [0x14008ed74]
test ebx, ebx
cmove eax, dword [rsp + 0x58]
mov dword [0x14008ed74], eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14002c664
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14002c970
Capabilities:
Modify service

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14002c9b8
xor edx, edx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14002c9b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002caec
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002cae4
mov rcx, rbx
mov qword [rsp + 0x78], rsi
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov rsi, rax
test rax, rax
jne 0x14002c9ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002caf9
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002cadf
mov r8d, setsockopt
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14002ca22
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002cb0b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002cacf
lea r8, [rsp + 0x88]
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x88], rbp
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14002ca5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002cb12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002cac1
xor ebp, ebp
lea rax, [rsp + 0x70]
lea r8, [rsp + 0x20]
lea edx, [rbp + 2]
mov rcx, rdi
mov dword [rsp + 0x20], 0xffffffff
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x74], 0x1f4
mov dword [rsp + 0x70], 1
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
jne 0x14002cabf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002cb12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jne 0x14002cac1
mov ebx, ebp
test rdi, rdi
je 0x14002cacf
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rsi, rsi
je 0x14002cadd
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov eax, ebx
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, 0xffffe59d
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, 0xffffe5bf
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov ebx, 0xffffe5b9
jmp 0x14002cacf
mov ebx, 0xffffe5cf
jmp 0x14002cac1