joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007270
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x1400073b3
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1400073a9
mov rcx, qword [rbx + 0x20]
xorps xmm0, xmm0
lea rdx, str._dgst
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140024230
mov rcx, qword [rsp + 0x30]
test rax, rax
je 0x140007317
test rcx, rcx
jne 0x1400072e5
lea r8, [rsp + 0x30]
lea rdx, str.SoftwareHewlett_PackardHP_Print_Settings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
sete al
test al, al
je 0x140007389
mov rcx, qword [rsp + 0x30]
mov rdx, qword [str.ServicesTab]
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140007389
test rcx, rcx
je 0x140007341
mov rdx, qword [str.ServicesTab]
test rdx, rdx
je 0x140007341
call fcn.14001b5e0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], 0
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006a30
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006b90
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006cf0
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006e50
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140006fb0
mov rdx, qword [rbx + 0x20]
mov rcx, rdi
call fcn.140007110
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140007399
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400073a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14000adc0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x630
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov rbx, rcx
mov rdi, rdx
lea rcx, [rsp + 0x22]
xor esi, esi
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0x20], si
call fcn.140027190
lea rcx, [rsp + 0x222]
xor edx, edx
mov r8d, 0x3fe
mov word [rsp + 0x220], si
call fcn.140027190
lea rdx, [rsp + 0x20]
mov r8d, 0x100
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x20]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], si
jne 0x14000ae40
test rax, rax
je 0x14000ae79
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x220]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
je 0x14000ae79
lea rdx, [rsp + 0x220]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14000dc60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
xor bl, bl
mov rax, rdx
test rdx, rdx
je 0x14000ddc9
cmp qword [0x140054c28], 8
mov qword [rsp + 0x58], rdi
lea rdi, [0x140054c10]
cmovae rdi, qword [0x140054c10]
mov rcx, rax
mov rdx, rdi
call fcn.140024230
mov rcx, rax
test rax, rax
je 0x14000ddbc
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
or rsi, 0xffffffffffffffff
mov rax, rsi
mov qword [rsp + 0x20], r15
cmp word [rdi + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14000dcc1
add rcx, 2
lea rdx, [0x140045350]
lea r15, [rcx + rax*2]
lea rcx, [r15 + 2]
call fcn.140024230
lea rdx, str..cfm
mov rcx, r15
mov rbp, rax
call fcn.140024230
test rbp, rbp
je 0x14000ddb7
test rax, rax
je 0x14000ddb7
sub rbp, r15
mov qword [rsp + 0x28], r14
sar rbp, 1
lea eax, [rbp + 1]
movsxd r14, eax
mov eax, 2
mul r14
cmovo rax, rsi
mov rcx, rax
call fcn.140020070
mov rsi, rax
test rax, rax
je 0x14000dd95
test r14, r14
je 0x14000dd49
xor eax, eax
mov rdi, rsi
mov rcx, r14
movzx eax, ax
rep stosw word [rdi], ax
movsxd r8, ebp
mov rdx, r15
mov rcx, rsi
call fcn.140023fd0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000dd67
mov bl, 1
mov rax, qword [0x1400575e8]
mov qword [rsp + 0x40], rsi
test rax, rax
jne 0x14000dd89
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14000dd95
lea rcx, [rsp + 0x40]
mov edx, 1
call rax
mov r14, qword [rsp + 0x28]
movzx eax, bl
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret
movzx eax, bl
jmp 0x14000dd9d
mov al, 1
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x140012570
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rdx
mov qword [rbp + 0x27], rdx
mov qword [rbp + 0x47], 7
xor edi, edi
mov qword [rbp + 0x3f], rdi
mov word [rbp + 0x2f], di
lea r8d, [rdi + 3]
lea rdx, [0x140046880]
lea rcx, [rbp + 0x2f]
call fcn.14000d3f0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x2f]
call fcn.14000c7a0
xor edx, edx
lea r8d, [rdi + 0x70]
lea rcx, [rbp - 0x49]
call fcn.140027190
mov dword [rbp - 0x49], WSACleanup
mov dword [rbp - 0x45], 0x40
lea rax, str.runas
mov qword [rbp - 0x39], rax
lea rax, [0x140046898]
mov qword [rbp - 0x31], rax
lea rax, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rax, qword [rbp + 0x2f]
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x19], edi
lea rcx, [rbp - 0x49]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
or edx, 0xffffffff
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x47], 8
jb 0x140012685
mov rax, qword [rbp + 0x2f]
mov qword [rbp - 0x59], rax
test rax, rax
je 0x140012685
mov r8, qword [0x1400575e8]
test r8, r8
jne 0x14001267c
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14001268c
xor edx, edx
lea rcx, [rbp - 0x59]
call r8
mov r8, qword [0x1400575e8]
mov qword [rbp + 0x47], 7
mov qword [rbp + 0x3f], rdi
mov word [rbp + 0x2f], di
cmp qword [rbx + 0x18], 8
jb 0x1400126d1
mov rax, qword [rbx]
mov qword [rbp - 0x59], rax
test rax, rax
je 0x1400126d1
test r8, r8
jne 0x1400126c8
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x1400126d1
xor edx, edx
lea rcx, [rbp - 0x59]
call r8
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140012710
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor sil, sil
mov eax, 2
mov r14d, 0x400
mul r14
mov rdi, rax
mov rbp, 0xffffffffffffffff
cmovo rdi, rbp
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov rax, qword [0x1400575f0]
test rax, rax
jne 0x140012785
call fcn.140021790
mov qword [0x1400575f0], rax
test rax, rax
je 0x140012892
mov r8, qword [rsp + 0x78]
lea r9, [rsp + 0x20]
mov r15d, 1
mov edx, r15d
mov rcx, rdi
call rax
mov rdi, rax
test rax, rax
je 0x140012892
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
cmp word [rdi], bx
je 0x1400127da
mov rbx, rbp
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1400127d0
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14000d3f0
nop
mov r8d, 0xc
lea rdx, str.pnputil.exe
lea rcx, [rsp + 0x30]
call fcn.14000d280
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
movzx ebx, sil
cmp eax, 0xffffffff
cmovne ebx, r15d
mov qword [rsp + 0x20], rdi
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x140012846
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x140012857
mov edx, r15d
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x1400575e8]
cmp qword [rsp + 0x48], 8
jb 0x14001288d
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
test rcx, rcx
je 0x14001288d
test rax, rax
jne 0x140012884
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14001288d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
movzx eax, bl
jmp 0x140012896
movzx eax, sil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140012b40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x560
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140012b71
xor eax, eax
jmp 0x140012ccd
test rcx, rcx
je 0x140012cc8
mov qword [rsp + 0x580], rsi
lea rcx, [rsp + 0x42]
xor esi, esi
xor edx, edx
mov r8d, 0x2fe
mov word [rsp + 0x40], si
call fcn.140027190
lea rdx, [rsp + 0x40]
mov r8d, 0x180
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x140012cc0
lea rdx, str.RCLID_
lea rcx, [rsp + 0x40]
call fcn.140024230
test rax, rax
je 0x140012cc0
lea rdx, str._a_RCLID_
lea rcx, [rsp + 0x40]
call fcn.140024230
test rax, rax
je 0x140012c99
lea rcx, [rsp + 0x342]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x340], si
call fcn.140027190
movabs rax, 0x3e0061003c
movsd xmm0, qword [str.__a_]
movsd qword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rax
movzx eax, word [0x140046910]
lea rcx, [rsp + 0x52]
mov word [rsp + 0x28], ax
call fcn.140023d28
lea r8, [rsp + 0x40]
mov edx, eax
mov rcx, rdi
call fcn.140012cf0
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x340]
mov edx, 0x104
call fcn.140024568
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x340]
mov edx, 0x104
call fcn.140024458
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x340]
mov edx, 0x104
call fcn.140024458
lea rdx, [rsp + 0x340]
jmp 0x140012cb7
lea rcx, [rsp + 0x4c]
call fcn.140023d28
lea r8, [rsp + 0x40]
mov rcx, rdi
mov edx, eax
call fcn.140012cf0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rsi, qword [rsp + 0x580]
mov eax, 1
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.140023790
mov rbx, qword [rsp + 0x588]
add rsp, 0x560
pop rdi
ret
Function at 0x140012cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x840
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rcx
mov rsi, r8
mov ebp, edx
lea rcx, [rsp + 0x22]
xor ebx, ebx
xor edx, edx
mov r8d, 0x806
mov word [rsp + 0x20], bx
call fcn.140027190
movzx r9d, word [rdi + 8]
mov rcx, qword [rdi]
mov eax, ebp
lea edx, [rbx + 6]
and ebp, 0xf
shr eax, 4
inc eax
movzx r14d, ax
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
jne 0x140012d84
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x717
jne 0x140012dc0
mov rcx, qword [rdi]
mov r9d, 0x400
lea edx, [rbx + 6]
mov r8d, r14d
mov word [rdi + 8], r9w
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x140012dc0
mov rcx, qword [rdi]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140012dc0
nop word [rax + rax]
movzx ecx, word [rax]
add rax, 2
test cx, cx
je 0x140012db9
movzx edi, cx
cmp ebx, ebp
je 0x140012de0
mov ecx, edi
lea rax, [rax + rdi*2]
inc ebx
cmp ebx, 0x10
jl 0x140012da0
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140023790
add rsp, 0x840
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x403
mov rdx, rax
cmp edi, ecx
cmovg edi, ecx
lea rcx, [rsp + 0x20]
movsxd r8, edi
call fcn.140023fd0
lea rax, [rsp + 0x20]
lea rdx, [rsp + 0x20]
sub rsi, rax
nop word [rax + rax]
movzx ecx, word [rdx]
lea rdx, [rdx + 2]
mov word [rsi + rdx - 2], cx
test cx, cx
jne 0x140012e10
mov eax, edi
jmp 0x140012dc2

Function at 0x140016780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400167b3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400167f9
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400167f4
nop
cmp rbx, rcx
jae 0x1400167f9
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x1400167e0
cmp rbx, rcx
jb 0x1400167fd
xor eax, eax
jmp 0x140016809
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140016a50
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400575f0]
xor ebx, ebx
mov rdi, rcx
mov dword [rsp + 0x30], ebx
test rax, rax
jne 0x140016a80
call fcn.140021790
mov qword [0x1400575f0], rax
test rax, rax
je 0x140016a99
mov r8, qword [rsp + 0x28]
lea r9, [rsp + 0x30]
mov edx, 1
mov ecx, 0x208
call rax
mov rbx, rax
mov qword [rdi + 8], rbx
test rbx, rbx
je 0x140016ac9
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
call fcn.140027190
mov rdx, qword [rdi + 8]
lea rcx, str._WinDir_Inf
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140018520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov r14, rdx
mov rdx, r8
mov rbx, r8
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14001855c
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x1400185d6
mov rcx, qword [rdi + 0x18]
mov rdx, rbx
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, 0x40
mov edx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, ebx
mov rdx, rsi
mov rcx, rax
mov rdi, rax
mov qword [r14], rax
call fcn.1400237c0
mov eax, 0xffff
cmp word [rdi + 2], ax
jne 0x1400185c7
or dword [rdi + 8], 0x400000
jmp 0x1400185ce
or dword [rdi + 4], 0x400000
mov rax, rbp
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001ac10
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp + 0x37], 7
xor esi, esi
mov qword [rbp + 0x2f], rsi
mov word [rbp + 0x1f], si
lea r8d, [rsi + 0x15]
lea rdx, str.MystSNMPCommunityName
lea rcx, [rbp + 0x1f]
call fcn.14000d3f0
nop
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], rsi
mov word [rbp - 1], si
lea r8d, [rsi + 0x1d]
lea rdx, str.SOFTWAREHewlett_PackardSNMP
lea rcx, [rbp - 1]
call fcn.14000d3f0
nop
add rbx, 8
mov r14b, 1
mov qword [rbp - 0x19], rsi
mov dword [rbp - 0x11], esi
cmp qword [rdi + 0x18], 8
jb 0x14001acaa
mov rdi, qword [rdi]
cmp word [rdi], 0
jne 0x14001acb5
mov r8, rsi
jmp 0x14001accb
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x14001acc0
mov rdx, rdi
mov rcx, rbx
call fcn.14000d3f0
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001ad22
xor bl, bl
jmp 0x14001ad75
mov rax, qword [rbx + 0x10]
lea ecx, [rax*2 + 2]
cmp qword [rbx + 0x18], 8
jb 0x14001ad37
mov rbx, qword [rbx]
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, r14b
test eax, eax
cmovne ebx, esi
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp + 0x17], 8
jb 0x14001adae
mov rax, qword [rbp - 1]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x14001adae
mov rax, qword [0x1400575e8]
test rax, rax
jne 0x14001ada6
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14001adb5
xor edx, edx
lea rcx, [rbp - 0x19]
call rax
mov rax, qword [0x1400575e8]
mov qword [rbp + 0x17], 7
mov qword [rbp + 0xf], rsi
mov word [rbp - 1], si
cmp qword [rbp + 0x37], 8
jb 0x14001adf7
mov rcx, qword [rbp + 0x1f]
mov qword [rbp - 0x19], rcx
test rcx, rcx
je 0x14001adf7
test rax, rax
jne 0x14001adef
call fcn.140021810
mov qword [0x1400575e8], rax
test rax, rax
je 0x14001adf7
xor edx, edx
lea rcx, [rbp - 0x19]
call rax
movzx eax, bl
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14001ae20
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov qword [rbp - 0x19], 7
xor edi, edi
mov qword [rbp - 0x21], rdi
mov word [rbp - 0x31], di
lea r8d, [rdi + 0x15]
lea rdx, str.MystSNMPCommunityName
lea rcx, [rbp - 0x31]
call fcn.14000d3f0
nop
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], rdi
mov word [rbp - 0x51], di
lea r8d, [rdi + 0x1d]
lea rdx, str.SOFTWAREHewlett_PackardSNMP
lea rcx, [rbp - 0x51]
call fcn.14000d3f0
nop
mov dword [rbp - 0x61], 1
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rdx, qword [rbp - 0x51]
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001af73
mov dword [rbp - 0x5d], 0x21
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov word [rbp + 0x37], ax
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rdx, qword [rbp - 0x31]
lea rax, [rbp - 0x5d]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x61]
xor r8d, r8d
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001af68
cmp word [rbp - 9], ax
jne 0x14001af43
mov r8d, edi
jmp 0x14001af5b
lea rax, [rbp - 9]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001af50
lea rcx, [rbx + 8]
lea rdx, [rbp - 9]
call fcn.14000d3f0
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp - 0x39], 8
jb 0x14001afb0
mov rax, qword [rbp - 0x51]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14001afb0
mov r8, qword [0x1400575e8]
test r8, r8
jne 0x14001afa7
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14001afb7
xor edx, edx
lea rcx, [rbp - 0x69]
call r8
mov r8, qword [0x1400575e8]
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], rdi
mov word [rbp - 0x51], di
cmp qword [rbp - 0x19], 8
jb 0x14001affd
mov rax, qword [rbp - 0x31]
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14001affd
test r8, r8
jne 0x14001aff4
call fcn.140021810
mov r8, rax
mov qword [0x1400575e8], rax
test rax, rax
je 0x14001affd
xor edx, edx
lea rcx, [rbp - 0x69]
call r8
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140023790
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001b470
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x14001b526
lea rdx, [rsp + 0xc0]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14001b526
movzx eax, word [rsp + 0xc0]
cmp al, 2
jne 0x14001b520
shr ax, 8
cmp al, 2
jne 0x14001b520
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea edx, [rbx + 2]
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x30], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
test eax, eax
jne 0x14001b4f9
movzx ebx, word [rsp + 0x40]
jmp 0x14001b520
xor r8d, r8d
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
lea edx, [r8 + 0x17]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAStringToAddressW]
test eax, eax
cmove bx, word [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx eax, bx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140023790
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret

Function at 0x14001b5e0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140053010]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14001b652
test rdx, rdx
je 0x14001b652
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001b644
cmp eax, 0xea
jne 0x14001b657
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x14001b657
mov eax, 0xd
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140023790
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x14001c380
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xb8], 0
mov rdi, rcx
jne 0x14001c4ab
mov rax, qword [rcx]
mov qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x60]
xor ebx, ebx
mov qword [rsp + 0x60], rbx
call qword [rax + 0x78]
test al, al
je 0x14001c499
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea rdx, str.SNMP_Community
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c48e
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14001c48e
mov ecx, eax
mov qword [rsp + 0x38], rbp
mov eax, 2
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
mul rcx
cmovo rax, rbp
mov rcx, rax
call fcn.140020070
mov rsi, rax
test rax, rax
je 0x14001c484
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.SNMP_Community
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c47c
cmp word [rsi], bx
je 0x14001c46a
mov rbx, rbp
nop dword [rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14001c460
lea rcx, [rdi + 0xa8]
mov r8, rbx
mov rdx, rsi
call fcn.14000d3f0
mov rcx, rsi
call fcn.14001ffe0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rdi + 0xa8]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rax, [rcx + 0xa8]
add rsp, 0x40
pop rdi
ret