joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800559d4
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov eax, 1
movzx r14d, dx
mov rbp, rcx
lea rdx, [rsp + 0x40]
mov ecx, 0x202
mov esi, eax
mov r15d, eax
mov rdi, r9
mov r12d, r8d
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x180055b7c
mov edx, r15d
lea ecx, [rax + 2]
lea r8d, [r15 + 5]
mov ebx, 0x251d
call qword [sym.imp.WS2_32.dll_socket]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
jne 0x180055a5b
xor esi, esi
jmp 0x180055a6a
mov rcx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
nop dword [rax + rax]
mov ecx, 0x17
mov edx, r15d
lea r8d, [rcx - 0x11]
call qword [sym.imp.WS2_32.dll_socket]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
jne 0x180055a8d
xor r15d, r15d
jmp 0x180055a9c
mov rcx, rax
call qword [sym.imp.WS2_32.dll_closesocket]
nop dword [rax + rax]
test esi, esi
je 0x180055b17
mov eax, 1
test r12d, r12d
je 0x180055aed
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
and dword [rsp + 0x34], 0
mov r9d, eax
mov r8d, 0x4b0
mov dword [rsp + 0x38], 0xffff0000
mov rcx, rbp
mov dword [rsp + 0x3c], 0x100007f
mov dword [rsp + 0x20], eax
call fcn.18002cc38
mov rcx, rax
test rax, rax
jne 0x180055b0c
mov ebx, 0xe
jmp 0x180055b6c
cmp r14w, ax
jne 0x180055b1c
mov edx, 0x100007f
mov dword [rsp + 0x20], eax
mov r8d, 0x4b0
mov rcx, rbp
call fcn.18002ca7c
jmp 0x180055ade
mov rax, qword [rdi]
xor ebx, ebx
mov qword [rcx], rax
mov qword [rdi], rcx
mov eax, 1
cmp r14w, 0x1c
jne 0x180055b6c
test r15d, r15d
je 0x180055b6c
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
and dword [rsp + 0x34], 0
mov r9d, eax
and dword [rsp + 0x38], 0
mov r8d, 0x4b0
mov rcx, rbp
mov dword [rsp + 0x3c], 0x1000000
mov dword [rsp + 0x20], eax
call fcn.18002cc38
mov rcx, rax
test rax, rax
je 0x180055ae6
mov rax, qword [rdi]
xor ebx, ebx
mov qword [rcx], rax
mov qword [rdi], rcx
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop dword [rax + rax]
test ebx, ebx
je 0x180055b8d
mov rcx, qword [rdi]
test rcx, rcx
je 0x180055b8d
call fcn.1800157ac
and qword [rdi], 0
mov eax, ebx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x1800567a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov edx, 2
lea rcx, [rsp + 0x20]
call qword [sym.imp.CRYPTBASE.dll_SystemFunction036]
nop dword [rax + rax]
test al, al
je 0x1800567dd
movzx eax, word [rsp + 0x20]
test ax, ax
je 0x1800567b7
jmp 0x180056809
test byte [0x1800b78f0], 0x10
je 0x180056806
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, 0x3f
lea rdx, [0x18009f0e0]
mov r8d, eax
call fcn.1800876bc
movzx eax, bx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18002d5c0
add rsp, 0x30
pop rbx
ret
Function at 0x1800574f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
xor ebx, ebx
test byte [0x1800b78f1], 4
lea edi, [rbx + 0x14]
je 0x18005752a
mov r9, rdx
lea ecx, [rbx + 0x27]
lea rdx, str._z_
mov r8d, edi
call fcn.1800883c8
mov ecx, 0x410
mov qword [rsi], rdi
mov dword [rsi + 8], ebx
call fcn.180017d38
mov rdi, rax
test rax, rax
je 0x180057635
lea r8, [0x1800a2df8]
mov edx, 0x104
sub r8, rdi
lea rbp, [rax + 0x208]
mov rcx, rdi
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x180057582
movzx eax, word [r8 + rcx]
test ax, ax
je 0x180057582
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x18005755f
test rdx, rdx
lea rax, [rcx - 2]
mov edx, 0x104
cmovne rax, rcx
mov rcx, rdi
mov word [rax], bx
mov r8, qword [str.FilterClusterIp]
call fcn.180056198
test byte [0x1800b78f1], 4
je 0x1800575c1
mov ecx, 0x28
lea rdx, str._z_
mov r8, rdi
call fcn.180087814
mov r8d, 0x104
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
dec eax
cmp eax, 0x102
ja 0x1800575ff
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 0xa]
call qword [sym.imp.api_ms_win_core_crt_l1_1_0.dll_wcstoul]
nop dword [rax + rax]
mov dword [rsi + 4], eax
mov ebx, 1
mov dword [rsi + 8], ebx
test byte [0x1800b78f1], 4
je 0x18005762b
mov r8d, dword [rsi + 4]
lea rdx, str._z_
mov dword [rsp + 0x20], r8d
mov ecx, 0x29
mov r8, rdi
mov r9d, ebx
call fcn.180087144
mov rcx, rdi
call sym.DNSAPI.dll_DnsApiFree
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180057654
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov eax, edx
lea rbp, str.Hostname
add rax, rax
mov edx, 1
mov rbx, r9
mov esi, r8d
mov rbp, qword [rbp + rax*8]
call fcn.180025050
mov rdi, rax
test rax, rax
jne 0x1800576a1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x1800576d7
mov eax, dword [rsp + 0x60]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x1800576f0
xor r9d, r9d
lea ecx, [rbx + 1]
xor r8d, r8d
xor edx, edx
call sym.DNSAPI.dll_DnsNotifyResolverEx
call fcn.180001488
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180057be0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x260], rax
and dword [rsp + 0x40], 0
mov rbx, rcx
mov rdi, qword [rcx + 0xb8]
test byte [0x1800b78f0], 0x80
je 0x180057c49
mov eax, dword [rbx + 0x234]
mov r9d, edi
movzx ecx, word [rcx + 0x268]
mov r8, rbx
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x210]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
call fcn.18008b740
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180057e31
mov ecx, dword [rbx + 0x234]
mov eax, 0x10624dd3
mov rbp, qword [rbx + 0x258]
mul ecx
mov qword [rsp + 0x58], rdi
shr edx, 6
imul eax, edx, 0x3e8
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [rsp + 0x4c], eax
test rbp, rbp
jne 0x180057cb2
lea rbp, [rbx + 0x26a]
mov esi, 2
mov word [rbx + 0x268], si
mov qword [rbx + 0x258], rbp
jmp 0x180057cb9
movzx esi, word [rbx + 0x268]
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
nop dword [rax + rax]
test eax, eax
jg 0x180057d4d
jns 0x180057d14
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
nop dword [rax + rax]
mov ebx, eax
test byte [0x1800b78f1], 4
je 0x180057d0d
mov ecx, 0x81
lea rdx, [0x18009f1f8]
mov r8d, eax
call fcn.1800876bc
mov eax, ebx
jmp 0x180057e36
mov edi, 0x5b4
mov r8d, 1
mov edx, edi
mov rcx, rbx
call fcn.1800232ec
test byte [0x1800b78f1], 4
je 0x180057d46
mov ecx, 0x82
lea rdx, [0x18009f1f8]
mov r8, rbx
call fcn.1800879b4
mov eax, edi
jmp 0x180057e36
and dword [rsp + 0x44], 0
lea r14, [rbx + 0x100]
mov qword [r14 + 8], rbp
mov dword [r14], esi
test byte [0x1800b78f1], 4
je 0x180057d7d
mov ecx, 0x83
lea rdx, [0x18009f1f8]
mov r8, rbx
call fcn.1800879b4
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x44]
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x40]
mov r8d, 1
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_WSARecv]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x180057dc5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
nop dword [rax + rax]
mov edi, eax
jmp 0x180057dc7
xor edi, edi
cmp edi, 0x3e5
jne 0x180057df2
test byte [0x1800b78f1], 4
je 0x180057d46
mov ecx, 0x84
lea rdx, [0x18009f1f8]
call fcn.180087008
jmp 0x180057d46
mov edx, dword [rsp + 0x40]
mov r8d, edi
mov rcx, rbx
call fcn.1800580f8
mov edi, eax
test eax, eax
je 0x180057d46
test byte [0x1800b78f1], 4
je 0x180057d46
mov ecx, 0x85
lea rdx, [0x18009f1f8]
mov r8d, eax
call fcn.1800876bc
jmp 0x180057d46
mov eax, 0x57
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18002d5c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800580f8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, qword [rcx + 0x258]
mov edi, r8d
mov r15, qword [rcx + 0xb8]
mov rbx, rcx
movzx ebp, word [rcx + 0x268]
mov r14d, edx
mov cl, byte [0x1800b78f1]
lea r13, [0x18009f1f8]
test cl, 4
je 0x18005815a
mov ecx, 0x91
mov r9d, ebp
mov rdx, r13
call fcn.180087020
mov cl, byte [0x1800b78f1]
xor r12d, r12d
test edi, edi
jne 0x180058339
test r14d, r14d
jne 0x1800581b2
test cl, 2
je 0x18005817f
mov ecx, 0x96
mov r8d, r15d
mov rdx, r13
call fcn.1800876bc
add rbx, 0x26a
cmp word [rbx], r12w
jne 0x18005819b
cmp rsi, rbx
jne 0x18005819b
mov edi, 0x251f
jmp 0x18005839b
test byte [0x1800b78f3], 0x40
je 0x180058396
mov ecx, 0x97
mov r8d, ebp
jmp 0x18005820c
sub ebp, r14d
add rsi, r14
mov r14d, 1
test ebp, ebp
jne 0x18005824b
lea rax, [rbx + 0x26c]
cmp rsi, rax
ja 0x18005826d
movzx ecx, word [rbx + 0x26a]
call qword [sym.imp.WS2_32.dll_ntohs]
nop dword [rax + rax]
mov word [rbx + 0x26a], ax
cmp ax, 0xc
jae 0x180058219
test byte [0x1800b78f1], 4
je 0x180058396
movzx r8d, ax
mov ecx, 0x92
mov rdx, r13
call fcn.1800876bc
jmp 0x180058396
movzx ebp, ax
test byte [0x1800b78f1], 2
je 0x18005823d
mov ecx, 0x93
mov qword [rsp + 0x20], rbx
mov r9d, r15d
mov r8d, ebp
mov rdx, r13
call fcn.18008ae1c
cmp ebp, dword [rbx + 0x210]
mov eax, r12d
setbe al
jmp 0x18005824e
mov eax, r14d
test eax, eax
je 0x18005826d
mov rcx, rbx
mov qword [rbx + 0x258], rsi
mov word [rbx + 0x268], bp
call sym.DNSAPI.dll_Dns_RecvTcp
jmp 0x18005839d
lea r8, [rbx + 0x8c]
mov rcx, r15
lea rdx, [rbx + 0x6c]
mov dword [r8], 0x20
call qword [sym.imp.WS2_32.dll_getsockname]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x180058333
movzx eax, word [rbx + 0x26c]
mov r8d, r14d
rol ax, 8
xor edx, edx
mov word [rbx + 0x26c], ax
mov rcx, rbx
movzx eax, word [rbx + 0x270]
rol ax, 8
mov word [rbx + 0x270], ax
movzx eax, word [rbx + 0x272]
rol ax, 8
mov word [rbx + 0x272], ax
movzx eax, word [rbx + 0x274]
rol ax, 8
mov word [rbx + 0x274], ax
movzx eax, word [rbx + 0x276]
rol ax, 8
mov word [rbx + 0x276], ax
mov dword [rbx + 0xac], r12d
mov byte [rbx + 0x250], r14b
mov qword [rbx + 0x258], r12
call fcn.1800232ec
mov rax, qword [section..data]
test byte [rax + 0x1c], 0x80
je 0x18005832f
mov rdx, rbx
lea rcx, str.Received_TCP_packet
call fcn.18006fa34
xor eax, eax
jmp 0x18005839d
mov cl, byte [0x1800b78f1]
lea rax, [rbx + 0x26a]
cmp rsi, rax
jne 0x180058374
lea eax, [rdi - 0x2745]
test eax, 0xfffffffa
jne 0x180058374
cmp edi, 0x2749
je 0x180058374
test cl, 2
je 0x180058392
mov ecx, 0x94
mov r9d, r15d
mov r8d, edi
mov rdx, r13
call fcn.180087020
jmp 0x180058392
test byte [0x1800b78f3], 0x40
je 0x180058392
sub esi, ebx
mov dword [rsp + 0x20], edi
mov r9d, ebp
lea r8d, [rsi - 0x26a]
call fcn.18008b3f0
test edi, edi
jne 0x18005839b
mov edi, 0x251e
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18005c314
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx eax, byte [rdx]
xor r9d, r9d
mov r8, qword [rsp + 0x88]
shl eax, 0x18
mov dword [rsp + 0x38], eax
movzx eax, word [rdx + 1]
mov dword [rsp + 0x3c], eax
mov rax, qword [rdx + 3]
add rdx, 0xb
mov qword [rsp + 0x40], rax
mov rax, qword [0x1800b7020]
mov qword [r8], rax
mov rax, qword [0x1800b7020]
mov qword [rsp + 0x28], r8
movzx ecx, word [rax]
mov dword [r8 + 8], ecx
lea rcx, str.ETW0
mov qword [r8 + 0x10], rdx
mov dword [r8 + 0xc], 2
movzx eax, word [rdx]
lea rdx, [rsp + 0x38]
mov dword [r8 + 0x18], eax
lea rax, [0x1800a2368]
sub eax, ecx
mov dword [r8 + 0x1c], 1
mov rcx, qword [0x1800b7038]
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_EtwEventWriteTransfer]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18002d5c0
add rsp, 0x58
ret
Function at 0x18005e444
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, str.DemandStart
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov ebx, 0x426
lea r8d, [rdx + 1]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x18005e4a2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18005e55f
mov r8d, 0x15
lea rdx, str.dnsCache
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x18005e4d6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18005e550
mov rcx, rdi
call fcn.18005e680
test eax, eax
jne 0x18005e541
lea r8, [rsp + 0x20]
mov rcx, rdi
lea edx, [rax + 1]
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
nop dword [rax + rax]
xor r9d, r9d
mov r8d, 0x7d0
mov rcx, rdi
lea edx, [r9 + 9]
call qword [sym.imp.api_ms_win_service_private_l1_1_0.dll_WaitServiceState]
nop dword [rax + rax]
mov ebx, eax
test byte [0x1800b78f1], 4
je 0x18005e534
mov ecx, 0xa
lea rdx, [0x1800a2fe8]
mov r8d, eax
call fcn.1800876bc
sub ebx, 4
neg ebx
sbb ebx, ebx
and ebx, 0x41d
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
nop dword [rax + rax]
test byte [0x1800b78f1], 4
je 0x18005e57c
mov ecx, 0xb
lea rdx, [0x1800a2fe8]
mov r8d, ebx
call fcn.1800876bc
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18002d5c0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18005ea20
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp + 0x20], rax
and qword [rsp + 0x30], 0
mov rsi, rcx
cmp r8d, 1
jne 0x18005ec61
test rcx, rcx
je 0x18005ec61
movups xmm0, xmmword [rcx]
test rdx, rdx
lea ebx, [r8 + 0x77]
movups xmm1, xmmword [rcx + 0x10]
lea r15, [0x18009f0a8]
mov dword [rbp - 0x3c], r8d
movaps xmmword [rbp - 0x20], xmm0
cmovne r15, rdx
movups xmm0, xmmword [rcx + 0x20]
xor edx, edx
mov dword [rbp - 0x40], r8d
movaps xmmword [rbp - 0x10], xmm1
mov r8d, ebx
movups xmm1, xmmword [rcx + 0x30]
lea rcx, [rsp + 0x40]
movaps xmmword [rbp], xmm0
movaps xmmword [rbp + 0x10], xmm1
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rax, [rbp - 0x40]
mov dword [rsp + 0x40], 0x80000001
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x50], 0xa
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x40]
mov ebx, eax
mov edx, 6
lea rax, [rsp + 0x30]
mov r8d, 0x1048
mov rcx, r15
mov qword [rsp + 0x20], rax
call sym.DNSAPI.dll_DnsQuery_W
mov edi, eax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount]
nop dword [rax + rax]
mov r14d, eax
sub r14d, ebx
cmp eax, ebx
jae 0x18005eb18
dec r14d
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18005eb32
mov edx, 1
call sym.DNSAPI.dll_DnsFree
and qword [rsp + 0x30], 0
mov eax, 0x251d
mov dword [rsi + 0x24], r14d
mov dword [rsi + 0x28], edi
cmp edi, eax
jg 0x18005ec0e
je 0x18005ec05
test edi, edi
je 0x18005ebff
cmp edi, 0x7b
je 0x18005ec55
cmp edi, 0x5b4
je 0x18005ebf6
cmp edi, 0x2329
jle 0x18005eb8d
cmp edi, 0x232b
jle 0x18005ec05
cmp edi, 0x232d
je 0x18005ebed
cmp edi, 0x2331
je 0x18005ec05
mov dword [rsi + 0x2c], 0xff
test edi, edi
jne 0x18005ebe1
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov edx, 6
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0x104a
mov rcx, r15
call sym.DNSAPI.dll_DnsQuery_W
mov rcx, qword [rsp + 0x30]
mov ebx, eax
test rcx, rcx
je 0x18005ebd6
mov edx, 1
call sym.DNSAPI.dll_DnsFree
test ebx, ebx
je 0x18005ebe1
mov dword [rsi + 0x2c], 0x10
mov rcx, rsi
call fcn.18005929c
xor eax, eax
jmp 0x18005ec66
mov dword [rsi + 0x2c], 6
jmp 0x18005ebe1
mov dword [rsi + 0x2c], 4
jmp 0x18005ebe1
and dword [rsi + 0x2c], 0
jmp 0x18005eb98
mov dword [rsi + 0x2c], 5
jmp 0x18005eb94
cmp edi, 0x2558
jl 0x18005eb8d
cmp edi, 0x2559
jle 0x18005ec55
cmp edi, 0x2743
je 0x18005ec49
cmp edi, 0x2746
je 0x18005ec49
cmp edi, 0x274d
je 0x18005ec49
lea eax, [rdi - 0x2750]
cmp eax, 1
ja 0x18005eb8d
mov dword [rsi + 0x2c], 3
jmp 0x18005eb94
mov dword [rsi + 0x2c], 2
jmp 0x18005eb94
mov eax, 0x57
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.18002d5c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180063350
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rsp + 0x70]
xor edi, edi
mov rbx, r9
mov r14, r8
movzx r15d, dx
mov rsi, rcx
test rbp, rbp
je 0x180063548
cmp qword [r9 + 0x38], rdi
je 0x180063548
lea rcx, [0x1800b7928]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_AcquireSRWLockExclusive]
nop dword [rax + rax]
mov rax, qword [rbx + 0x38]
cmp dword [rax + 0xc], edi
je 0x1800633b2
mov edi, 1
jmp 0x1800633b9
mov dword [rax + 0xc], 1
lea rcx, [0x1800b7928]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseSRWLockExclusive]
nop dword [rax + rax]
test edi, edi
jne 0x180063548
mov ecx, 0x230
call fcn.180017d38
mov rbx, rax
test rax, rax
jne 0x180063407
test byte [0x1800b78f1], 4
je 0x180063548
lea ecx, [rdi + 0x28]
lea rdx, [0x18009f278]
call fcn.180087008
jmp 0x180063548
test rsi, rsi
je 0x18006341c
mov r8, rsi
mov edx, pe_nt_image_headers64
mov rcx, rbx
call fcn.180008070
mov rax, qword [rsp + 0x78]
lea rcx, str.dnsapi.dll
mov edi, 0x800
mov word [rbx + 0x200], r15w
mov r8d, edi
mov qword [rbx + 0x208], r14
xor edx, edx
mov qword [rbx + 0x220], rbp
mov qword [rbx + 0x228], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov r8d, edi
lea rcx, str.dnsrslvr.dll
xor edx, edx
mov qword [rbx + 0x210], rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
cmp qword [rbx + 0x210], 0
mov qword [rbx + 0x218], rax
je 0x1800634e7
test rax, rax
je 0x1800634e7
and qword [rsp + 0x28], 0
lea r8, [0x1800647f0]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
test rax, rax
je 0x1800634cb
mov rcx, rax
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x180063548
test byte [0x1800b78f1], 4
je 0x180063510
mov ecx, 0x2a
lea rdx, [0x18009f278]
call fcn.180087008
jmp 0x180063510
test byte [0x1800b78f1], 4
je 0x180063510
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, 0x29
lea rdx, [0x18009f278]
mov r8d, eax
call fcn.1800876bc
mov rcx, qword [rbx + 0x210]
test rcx, rcx
je 0x180063528
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x218]
test rcx, rcx
je 0x180063540
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov rcx, rbx
call sym.DNSAPI.dll_DnsApiFree
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18006c4bc
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rbp - 8], rax
and dword [rbp - 0x10], 0
mov r14, r9
xor ebx, ebx
mov dword [rbp - 0x1c], 0
mov qword [rbp - 0x18], rbx
mov rsi, r8
mov r13, rcx
test byte [0x1800b78f3], 0x20
je 0x18006c51d
lea ecx, [rbx + 0x1b]
mov r8, r13
lea r9, str.AppSid
lea rdx, [0x18009f2d0]
call fcn.180088bbc
test rsi, rsi
je 0x18006c525
and qword [rsi], rbx
test r14, r14
je 0x18006c52d
mov dword [r14], ebx
test rsi, rsi
jne 0x18006c543
mov edi, 0x80070057
mov dword [rbp - 0x1c], 0x1a6
jmp 0x18006c637
test r14, r14
jne 0x18006c559
mov edi, 0x80070057
mov dword [rbp - 0x1c], 0x1a7
jmp 0x18006c637
lea rax, [rbp - 0x10]
mov r9d, 3
mov qword [rsp + 0x30], rax
lea r8, str.AppSid
and qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], rbx
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
movzx r15d, ax
mov r12d, eax
or r15d, 0x80070000
mov edi, eax
test eax, eax
jle 0x18006c5a1
mov edi, r15d
test edi, edi
jns 0x18006c5b1
mov dword [rbp - 0x1c], 0x1b1
jmp 0x18006c637
mov ecx, dword [rbp - 0x10]
lea rdx, [rbp - 0x18]
call fcn.18006c428
mov rbx, qword [rbp - 0x18]
mov edi, eax
test eax, eax
jns 0x18006c5d0
mov dword [rbp - 0x1c], 0x1b3
jmp 0x18006c637
lea rax, [rbp - 0x10]
mov r9d, 3
mov qword [rsp + 0x30], rax
lea r8, str.AppSid
mov qword [rsp + 0x28], rbx
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jns 0x18006c611
mov dword [rbp - 0x1c], 0x1bb
jmp 0x18006c637
test r12d, r12d
mov edi, r15d
cmovle edi, r12d
test edi, edi
jns 0x18006c628
mov dword [rbp - 0x1c], 0x1bc
jmp 0x18006c637
mov eax, dword [rbp - 0x10]
mov qword [rsi], rbx
xor ebx, ebx
mov qword [rbp - 0x18], rbx
mov dword [r14], eax
test byte [0x1800b78f3], 0x20
je 0x18006c654
mov ecx, 0x1c
lea rdx, [0x18009f2d0]
mov r8d, edi
call fcn.1800876bc
test rbx, rbx
je 0x18006c662
lea rcx, [rbp - 0x18]
call fcn.180030b30
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18002d5c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006c690
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1800b7160]
xor rax, rsp
mov qword [rsp + 0x50], rax
and dword [rsp + 0x48], 0
mov rdi, r8
mov rsi, rdx
mov dword [rsp + 0x44], 0
mov rbx, rcx
mov dword [rsp + 0x4c], 4
test byte [0x1800b78f3], 0x20
je 0x18006c6ea
mov qword [rsp + 0x20], r8
mov r9, rdx
mov r8, rbx
lea rdx, [0x18009f2d0]
mov ecx, 0x15
call fcn.18008e3ac
and dword [rdi], 0
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rax
mov r9d, 0x10
lea rax, [rsp + 0x48]
mov r8, rsi
mov qword [rsp + 0x28], rax
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x18006c730
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
jns 0x18006c73e
mov dword [rsp + 0x44], 0x117
jmp 0x18006c744
mov ecx, dword [rsp + 0x48]
mov dword [rdi], ecx
test byte [0x1800b78f3], 0x20
je 0x18006c761
mov ecx, 0x16
lea rdx, [0x18009f2d0]
mov r8d, ebx
call fcn.1800876bc
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002d5c0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret