joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059cb0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r12d, r9d
mov r14, r8
mov r13, rdx
mov rsi, rcx
lea r15, vtable.CLockMgr_class_CMutexWrapper_.0
mov qword [rsp + 0x28], r15
lea rbx, [rcx + 0x78]
mov qword [rsp + 0x30], rbx
mov dword [rax - 0x80], 1
or edi, 0xffffffff
cmp qword [rbx], 0
je 0x140059d27
call qword [sym.imp.USER32.dll_InSendMessage]
mov ecx, 0x2710
test eax, eax
cmovne edi, ecx
mov edx, edi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov r8, qword [r14]
mov rdx, qword [r13]
mov rcx, rsi
call fcn.140059890
mov rdi, rax
or ebp, 0xffffffff
test rax, rax
je 0x140059e73
movzx eax, byte [rsi + 0x70]
test al, al
jne 0x140059e6e
mov r8, qword [r14]
mov rdx, qword [r13]
mov rcx, rsi
call fcn.140059a80
cmp rdi, r12
jbe 0x140059e6e
xor r15d, r15d
nop dword [rax]
movzx eax, byte [rsi + 0x70]
test al, al
jne 0x140059e67
mov rbx, qword [rsi + 8]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], r15
xor edx, edx
lea rcx, [rbx + 8]
call fcn.140059010
mov r11, qword [rbx + 8]
mov qword [rsp + 0x50], r11
mov eax, 0x214
mov word [rsp + 0x60], ax
mov dword [rsp + 0x64], r15d
mov dword [rsp + 0x48], 3
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x140059e67
lea rcx, [rbx + 0x10]
mov r8, rbx
mov rdx, qword [rsi + 0x10]
call fcn.14005c710
mov rdi, qword [rsi + 0x10]
lea rbx, [rdi - 0x10]
mov qword [rsp + 0xc0], rbx
cmp rbx, rdi
je 0x140059e4a
nop dword [rax]
lea rax, [rbx + 8]
mov qword [rsp + 0xc0], rax
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140059e39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
add rbx, 0x10
mov qword [rsp + 0xc0], rbx
cmp rbx, rdi
jne 0x140059e10
add qword [rsi + 0x10], 0xfffffffffffffff0
mov r8, qword [r14]
mov rdx, qword [r13]
mov rcx, rsi
call fcn.140059890
cmp rax, r12
ja 0x140059d70
lea r15, vtable.CLockMgr_class_CMutexWrapper_.0
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov rcx, qword [rbx]
test rcx, rcx
je 0x140059e87
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140059ea6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
dec ebp
test ebp, ebp
jg 0x140059ec2
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rinet_addr + 8]
mov eax, 1
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005bf90
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x2b8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r8
mov rbx, rdx
mov rbp, rcx
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
je 0x14005c1a7
mov rdi, rax
nop word [rax + rax]
test byte [rsp + 0x50], 0x10
je 0x14005c180
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x14005c058
test rbx, 0xffffffffffff0000
jne 0x14005c044
movzx edi, bx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x14005c06b
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400029f0
jmp 0x14005c06b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x14005c05a
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140002120
nop
mov rax, qword [rsp + 0x20]
mov edx, dword [rax - 0x10]
dec edx
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.14005d700
lea r8, [rsp + 0x7c]
lea rdx, [0x14012f6a8]
lea rcx, [rsp + 0x20]
call fcn.140045040
lea rsi, [rsp + 0x7c]
lea rdi, [0x14012ffcc]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14005c15b
lea rsi, [rsp + 0x7c]
lea rdi, [0x14012ffd0]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14005c15b
lea rax, [rsp + 0x7c]
mov rsi, qword [rsp + 0x38]
mov rdi, rsi
sub rdi, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x14005c0f3
add rax, 2
test ecx, ecx
jne 0x14005c0e0
test edx, edx
jne 0x14005c10d
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call fcn.14005c1d0
mov rdi, qword [rsp + 0x20]
jmp 0x14005c155
mov r8d, 2
lea rdx, [0x14012ffc4]
lea rcx, [rsp + 0x20]
call fcn.14003bd50
mov rdi, qword [rsp + 0x20]
cmp dword [rdi - 8], 1
jle 0x14005c141
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140001fb0
mov rdi, qword [rsp + 0x20]
mov r9, qword [rsp + 0x30]
mov r8, rsi
mov rdx, rdi
mov rcx, rbp
call fcn.14005bf90
nop
lea rdx, [rdi - 0x18]
jmp 0x14005c164
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005c17b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdi, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14005c19e
movzx eax, byte [rbp + 0x70]
test al, al
je 0x14005bff0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400d4d90
add rsp, 0x2b8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005ed60
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x460
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x450], rax
movzx ebp, r8b
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x20], 0
cmp dword [rcx + 0x2a0], 0
je 0x14005ee5d
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x200
jbe 0x14005ee46
test eax, eax
jne 0x14005ee46
lea rcx, [rsp + 0x28]
call fcn.1400853d0
nop
xor eax, eax
lea rdi, [0x140129a38]
mov r8, qword [rsp + 0x28]
mov rsi, r8
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x14005edfb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x14005ee3f
lea r9, [0x14012b86c]
lea rdx, [0x14012ffb8]
lea rcx, [rbx + 0x58]
call fcn.140016060
test bpl, bpl
je 0x14005ee3f
xor r8d, r8d
mov rdx, qword [rbx + 0x58]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
mov rdx, qword [rsp + 0x28]
jmp 0x14005ee91
lea rcx, [rbx + 0x58]
lea r8, [rsp + 0x50]
lea rdx, [0x14012f6a8]
call fcn.140016060
jmp 0x14005eeac
lea rcx, [rsp + 0x30]
call fcn.1400853d0
nop
test bpl, bpl
je 0x14005ee8c
xor r8d, r8d
mov rdx, qword [rbx + 0x58]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14005eeac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rcx, qword [rbx + 0x58]
sub rcx, 0x18
call fcn.140001d80
add rax, 0x18
mov qword [r12], rax
mov dword [rsp + 0x20], 1
mov rax, r12
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x14005ef00
Capabilities:
Create directory
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
test r8b, r8b
je 0x14005ef49
xor r8d, r8d
mov rdx, qword [rcx + 0x50]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rdi + 0x50]
sub rcx, 0x18
call fcn.140001d80
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14005f330
Capabilities:
Create directory
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
test r8b, r8b
je 0x14005f37f
xor r8d, r8d
mov rdx, qword [rcx + 0xb0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rdi + 0xb0]
sub rcx, 0x18
call fcn.140001d80
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14005f4f0
Capabilities:
Create directory
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
test r8b, r8b
je 0x14005f53f
xor r8d, r8d
mov rdx, qword [rcx + 0xc8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rdi + 0xc8]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rdi + 0xc8]
sub rcx, 0x18
call fcn.140001d80
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14005f570
Capabilities:
Create directory
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
test r8b, r8b
je 0x14005f5bf
xor r8d, r8d
mov rdx, qword [rcx + 0xd0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov edx, 2
mov rcx, qword [rdi + 0xd0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rdi + 0xd0]
sub rcx, 0x18
call fcn.140001d80
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140063bd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
movsxd rbx, r9d
mov r12, rcx
mov dword [rax - 0x16], edx
lea esi, [rbx + 0xa]
mov edx, 1
mov rbp, r8
movsxd rcx, esi
mov word [rax - 0x18], 0x124
mov dword [rax - 0x12], ebx
call fcn.1400d8794
mov rdi, rax
test rax, rax
je 0x140063c5a
mov rax, qword [rsp + 0x20]
lea rcx, [rdi + 0xa]
mov r8, rbx
mov qword [rdi], rax
movzx eax, word [rsp + 0x28]
mov rdx, rbp
mov word [rdi + 8], ax
call fcn.1400d5d30
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rdi
mov ebx, eax
call fcn.1400d6134
xor eax, eax
cmp ebx, 0xffffffff
setne al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x140063c80
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, qword [rsp + 0x70]
mov r14, r8
mov r8d, dword [r9]
mov r13, r9
mov rbp, rdx
add r8d, 0xa
xor r9d, r9d
mov rdx, rsi
mov r15, rcx
call qword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140063d89
test eax, eax
je 0x140063d89
cmp eax, 0xa
jl 0x140063d89
mov rcx, qword [rsi]
sub ebx, 0xa
mov qword [rbp], rcx
movzx ecx, word [rsi + 8]
mov word [rbp + 8], cx
test ebx, ebx
jle 0x140063cf6
lea rdx, [rsi + 0xa]
movsxd r8, ebx
mov rcx, r14
call fcn.1400d5d30
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r12
mov r8d, dword [rbp + 6]
cmp ebx, r8d
jb 0x140063d0f
cmp ebx, dword [r13]
jb 0x140063d40
lea rdx, [rsi + 0xa]
xor r9d, r9d
mov rcx, r15
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140063d7d
test eax, eax
je 0x140063d7d
mov ecx, ebx
lea rdx, [rsi + 0xa]
mov r8, rdi
add rcx, r14
call fcn.1400d5d30
add ebx, edi
jmp 0x140063d00
mov r8d, dword [rbp + 6]
lea rdx, [rsi + 0xa]
mov rcx, r14
call fcn.1400d5d30
mov rcx, rsi
call fcn.1400d6134
xor eax, eax
cmp byte [rbp], 0x24
sete al
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.1400d6134
xor eax, eax
jmp 0x140063d61
mov rcx, rsi
call fcn.1400d6134
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x14006c100
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rbx, rcx
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x118], rax
cmp rax, 0xffffffffffffffff
jne 0x14006c15b
or eax, eax
jmp 0x14006c257
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
mov qword [rsp + 0x60], rax
add rax, 0x18
mov qword [rsp + 0x108], rax
mov r8, rbx
lea rdx, str._s__rem
lea rcx, [rsp + 0x108]
call fcn.140016060
mov dword [rsp + 0x80], WSAGetLastError
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x88]
call fcn.1400dd9f0
mov rbx, qword [rsp + 0x108]
lea rax, [rbx - 0x18]
mov qword [rsp + 0x50], rax
cmp dword [rax + 0x10], 1
jle 0x14006c1ea
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x108]
call fcn.140001fb0
mov rbx, qword [rsp + 0x108]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x110], rbx
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
dec eax
test eax, eax
jg 0x14006c255
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
xor eax, eax
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
Function at 0x14006c270
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r12, rcx
mov rsi, qword [0x140183698]
lea r13, vtable.CLockMgr_class_CMutexWrapper_.0
mov qword [rbp - 0x29], r13
lea rbx, [rsi + 0x1628]
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x19], 1
or edi, 0xffffffff
cmp qword [rbx], 0
je 0x14006c2f1
call qword [sym.imp.USER32.dll_InSendMessage]
mov ecx, 0x2710
test eax, eax
cmovne edi, ecx
mov edx, edi
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov qword [0x140183620], rsi
lea rax, [rbp - 9]
mov qword [0x140183618], rax
call fcn.14004a390
mov r11, qword [rsi + 0x15f8]
xor eax, eax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rax
mov byte [rbp + 0x38], al
mov word [rbp - 0x39], 0x24
mov dword [rbp - 0x37], 0x20009411
mov dword [rbp - 0x33], 4
mov rax, qword [rbp - 0x39]
mov qword [rbp + 7], rax
movzx eax, word [rbp - 0x31]
mov word [rbp + 0xf], ax
mov dword [rbp + 0x11], r11d
xor r9d, r9d
lea r8d, [r9 + 0xe]
lea rdx, [rbp + 7]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x14006c383
mov qword [rbp - 0x29], r13
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006c37f
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
jmp 0x14006c39a
mov qword [rbp - 0x29], r13
mov rcx, qword [rbx]
test rcx, rcx
je 0x14006c395
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x14006c800
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rsi, rcx
mov rcx, rdx
call fcn.140013bd0
test eax, eax
je 0x14006c939
xor ebp, ebp
mov qword [rsp + 0x50], rbp
lea ecx, [rbp + 0x10]
call fcn.1400d5224
mov rbx, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x14006c858
mov qword [rax], 0xffffffff80000002
mov qword [rax + 8], rbp
jmp 0x14006c85b
mov rbx, rbp
mov qword [rsp + 0x50], rbx
lea rdi, [rbx + 8]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14012b4c0]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14006c8bf
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x14006c8b3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rbp
mov rcx, rbx
call fcn.1400d4d78
xor eax, eax
jmp 0x14006c934
mov dword [rsp + 0x98], 3
mov dword [rsp + 0x90], 1
lea rax, [rsi + 0x15e4]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.Paused
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14006c916
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x14006c927
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rdi], rbp
mov rcx, rbx
call fcn.1400d4d78
mov eax, 1
mov qword [rsp + 0x50], rbp
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006c950
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rbp, rcx
mov rcx, rdx
call fcn.140013e90
test eax, eax
je 0x14006ca7e
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400d5224
mov rbx, rax
mov qword [rsp + 0x90], rax
xor edi, edi
test rax, rax
je 0x14006c9a5
mov qword [rax], 0xffffffff80000002
mov qword [rax + 8], rdi
jmp 0x14006c9a8
mov rbx, rdi
mov qword [rsp + 0x98], rbx
lea rsi, [rbx + 8]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14012b4c0]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14006ca0f
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x14006ca03
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi], rdi
mov rcx, rbx
call fcn.1400d4d78
xor eax, eax
jmp 0x14006ca76
movzx eax, byte [rbp + 0x15e4]
mov byte [rsp + 0x90], al
mov dword [rsp + 0x28], 1
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.Paused
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14006ca58
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x14006ca69
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi], rdi
mov rcx, rbx
call fcn.1400d4d78
mov eax, 1
mov qword [rsp + 0x98], rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006cb30
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14006cc17
cmp dword [r8], ebx
je 0x14006cc17
lea rcx, [rsp + 0x68]
call fcn.14009c1c0
test eax, eax
je 0x14006cc66
mov rcx, qword [rsp + 0x68]
xor edx, edx
call fcn.14009c260
test eax, eax
je 0x14006cc66
mov eax, dword [rdi]
mov rcx, qword [rsp + 0x68]
lea r9d, [rbx + 3]
mov dword [rsp + 0x28], eax
lea rdx, str.Net_stat
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14006cc66
mov eax, dword [rdi]
mov rcx, qword [rsp + 0x68]
mov ebx, 1
mov edx, ebx
mov dword [rbp + 0x15e0], eax
call fcn.14009c260
test eax, eax
jne 0x14006cbcf
xor ebx, ebx
jmp 0x14006cc66
mov eax, dword [rdi]
mov rcx, qword [rsp + 0x68]
lea rdx, str.Net_SH
mov dword [rsp + 0x58], eax
lea rax, [rsp + 0x58]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14006ccae
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006ccae
lea rcx, [rsp + 0x68]
call fcn.14009c1c0
test eax, eax
je 0x14006cca9
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea rdx, str.Net_DF
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14006cc66
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
lea rdx, str.Net_DF
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], 0
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14006ccae
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14006ccae
mov ebx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006ccd0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x880
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rbx, r8
mov rsi, rcx
mov rdi, rdx
lea r8, str.SYSTEMCurrentControlSetServices_sParameters
lea rcx, [rsp + 0x70]
lea r9, [0x140129da0]
mov edx, 0x400
call fcn.1400d9998
xor ebp, ebp
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14006cd64
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14006ce2f
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.Net_stat
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rbx], 0x400
mov dword [rsp + 0x60], 0x400
mov dword [rsp + 0x50], 3
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14006ce02
mov r8d, dword [rbx]
xor edx, edx
mov rcx, rdi
call fcn.1400dd9f0
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.Net_DF
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14006cdf1
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbx], ebp
xor eax, eax
jmp 0x14006ce2f
mov rcx, qword [rsp + 0x58]
mov rdx, rbx
call fcn.14009c2b0
test eax, eax
jne 0x14006ce17
mov dword [rbx], ebp
jmp 0x14006ce1f
mov eax, dword [rbx]
mov dword [rsi + 0x15e0], eax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x8b8]
add rsp, 0x880
pop rdi
pop rsi
pop rbp
ret