joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2100db6f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
sub rsp, 0x20
mov r12, rcx
mov ecx, dword [0x210318444]
call sym.TlsGetValue
mov rdx, r12
mov rcx, rax
add rsp, 0x20
pop r12
jmp method._cygtls.call_unsigned_int____void__void___void_

Function at 0x2100db720
Capabilities:
Check for peb ntglobalflag flag
Get number of processors
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x718
movabs rax, 0x671858c9fd7fbe18
mov qword [rsp + 0x4e0], rax
mov dword [rsp + 0x444], 0x14fc5465
cmp dword [rsp + 0x728], 1
je 0x210041058
movabs rax, 0xa8271bfcc186d75d
mov qword [rsp + 0x6f8], rax
mov eax, 1
jmp 0x210042cac
mov byte [rsp + 0x198], 0x3e
add rsp, 0x718
ret
jmp 0x210041005

Function at 0x2100e07a0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
mov r13, rdx
xor ecx, ecx
mov ebx, r8d
mov edx, 1
xor r8d, r8d
lea r14, [rsp + 0x30]
mov rsi, r9
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.CreateEventA
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, ebx
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x48], rax
call sym.ReadFile
test eax, eax
je 0x2100e0840
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call sym.GetOverlappedResult
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call sym.CloseHandle
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call sym.GetLastError
cmp eax, 0x3e5
je 0x2100e0870
mov rcx, qword [rsp + 0x48]
xor r12d, r12d
call sym.CloseHandle
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov edx, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call sym.WaitForSingleObject
test eax, eax
je 0x2100e0812
mov rcx, r12
call sym.CancelIo
jmp 0x2100e0812

Function at 0x2100e0890
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x50
mov r12, rcx
mov r13, rdx
xor ecx, ecx
mov ebx, r8d
mov edx, 1
xor r8d, r8d
lea r14, [rsp + 0x30]
mov rsi, r9
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
call sym.CreateEventA
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, ebx
mov rdx, r13
mov rcx, r12
mov qword [rsp + 0x48], rax
call sym.WriteFile
test eax, eax
je 0x2100e0930
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call sym.GetOverlappedResult
mov rcx, qword [rsp + 0x48]
mov r12d, eax
call sym.CloseHandle
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
call sym.GetLastError
cmp eax, 0x3e5
je 0x2100e0960
mov rcx, qword [rsp + 0x48]
xor r12d, r12d
call sym.CloseHandle
mov eax, r12d
add rsp, 0x50
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov edx, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x48]
call sym.WaitForSingleObject
test eax, eax
je 0x2100e0902
mov rcx, r12
call sym.CancelIo
jmp 0x2100e0902
Function at 0x2100e0a30
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov edi, dword [rcx + 0x24]
mov r13, qword [rcx + 8]
mov rbx, rcx
test edi, edi
je 0x2100e0c13
mov rax, qword [rcx + 0x18]
mov esi, edi
add dword [rcx + 0x28], 1
lea rbp, [rsp + 0x50]
add rsi, r13
lea r12, [rax + 1]
mov qword [rcx + 0x10], r12
cmp r12, rsi
jae 0x2100e0b72
mov edx, 0xa
mov rcx, r12
call sym.msys_2.0.dll_strchr
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x2100e0bc0
mov eax, dword [rbx + 0x20]
sub eax, 2
cmp eax, edi
ja 0x2100e0be8
sub rsi, r12
mov rcx, r13
lea rbp, [rsp + 0x50]
mov rdx, r12
mov dword [rbx + 0x24], esi
mov r8d, esi
call sym.msys_2.0.dll_memmove
mov eax, dword [rbx + 0x24]
mov rdx, qword [rbx + 8]
mov rcx, rax
add rax, rdx
mov qword [rbx + 0x10], rax
lea eax, [rcx + 1]
mov byte [rdx + rax], 0
mov eax, dword [rbx + 0x24]
mov rdx, qword [rbx + 8]
mov byte [rdx + rax], 0
mov r13, qword [rbx + 8]
mov dword [rbx + 0x24], 0
mov rdx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x20]
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov qword [rsp + 0x40], 0
xor r8d, r8d
mov rcx, rdx
sub eax, 2
mov qword [rsp + 0x28], rdx
xor edx, edx
mov qword [rsp + 0x38], 0
sub rcx, r13
sub eax, ecx
mov rcx, qword [rbx]
mov dword [rsp + 0x30], eax
call sym.NtReadFile
test eax, eax
js 0x2100e0c00
mov rax, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x10]
mov dword [rbx + 0x24], eax
add eax, 1
mov byte [rdx + rax], 0
mov eax, dword [rbx + 0x24]
mov rdx, qword [rbx + 0x10]
mov byte [rdx + rax], 0
mov r12, qword [rbx + 8]
mov rdi, qword [rbx + 0x10]
mov qword [rbx + 0x18], r12
mov r13, r12
sub rdi, r12
add edi, dword [rbx + 0x24]
mov qword [rbx + 0x10], r12
mov esi, edi
mov dword [rbx + 0x24], edi
add rsi, r12
cmp r12, rsi
jb 0x2100e0a71
sub rsi, r12
mov rcx, r13
mov rdx, r12
mov dword [rbx + 0x24], esi
mov r8d, esi
call sym.msys_2.0.dll_memmove
mov eax, dword [rbx + 0x24]
mov rdx, qword [rbx + 8]
mov rcx, rax
add rax, rdx
mov qword [rbx + 0x10], rax
lea eax, [rcx + 1]
mov byte [rdx + rax], 0
mov eax, dword [rbx + 0x24]
mov rdx, qword [rbx + 8]
mov byte [rdx + rax], 0
mov r13, qword [rbx + 8]
mov dword [rbx + 0x24], 0
jmp 0x2100e0ae0
xor edx, edx
cmp byte [rax - 1], 0xd
sete dl
sub rax, rdx
mov byte [rax], 0
mov r12, qword [rbx + 0x10]
mov rax, r12
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rax, r12
mov dword [rbx + 0x24], 0
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rbp, [rsp + 0x50]
jmp 0x2100e0ae0
Function at 0x2100e0eb0
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r15d, dword [rsp + 0xa0]
mov edi, dword [rsp + 0xa8]
mov r14, qword [rsp + 0xb0]
mov r13, rcx
mov rbp, rdx
mov rbx, r8
mov edx, 1
mov r8d, 0x30
mov ecx, 1
mov esi, r9d
call sym.ccalloc
mov r12, rax
test rax, rax
je 0x2100e1130
mov qword [rax], r13
mov qword [rax + 8], rbp
test rbx, rbx
je 0x2100e0f60
mov qword [rax + 0x10], rbx
or edi, 0x10000
add rbx, rsi
mov r9, rax
lea r8, [sym.pthread_wrapper]
mov edx, 0x40000
lea rcx, [0x2102d1cc0]
mov qword [rax + 0x18], rbx
mov qword [rsp + 0xa8], r14
mov dword [rsp + 0xa0], edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.CreateThread
mov eax, dword [0x21034b024]
mov edx, dword [0x21034b048]
lea r8d, [rax - 1]
mov ecx, eax
lea eax, [rdx + rax - 1]
neg edx
neg ecx
add r15d, r8d
add esi, r8d
mov ebx, edx
and r15d, ecx
and esi, ecx
lea rcx, [0x21024fbe0]
add rcx, qword [0x21024fbf0]
add eax, r15d
add eax, esi
and ebx, eax
mov rax, qword [0x21024fbe8]
mov esi, ebx
test al, 1
je 0x2100e0fb1
mov rdx, qword [rcx]
mov rax, qword [rdx + rax - 1]
mov rdx, rsi
call rax
mov r13, rax
test rax, rax
je 0x2100e1140
mov eax, dword [0x2103184b4]
mov r9d, dword [0x21034b024]
test eax, eax
je 0x2100e10f8
sub ebx, r15d
mov r10d, r9d
mov r8d, eax
mov ecx, ebx
sub ebx, r9d
sub rcx, r10
cmp r8, rcx
ja 0x2100e0ff9
mov edx, 0x10000
cmp eax, edx
cmovb eax, edx
mov ebx, eax
mov rbp, rsi
mov edx, r15d
mov r9d, 0x104
mov r8d, 0x1000
sub rbp, rbx
mov rcx, rbp
sub rcx, rdx
add rcx, r13
call sym.VirtualAlloc
test rax, rax
je 0x2100e10d0
add rbp, r13
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rbp
call sym.VirtualAlloc
test rax, rax
je 0x2100e10d0
lea rax, [r13 + rsi]
or edi, 0x10000
mov qword [r12 + 0x10], r13
mov r9, r12
mov qword [r12 + 0x18], rax
lea r8, [sym.pthread_wrapper]
mov edx, 0x40000
lea rcx, [0x2102d1cc0]
mov qword [r12 + 0x20], rbp
mov dword [r12 + 0x28], r15d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], edi
call sym.CreateThread
mov r12, rax
test rax, rax
jne 0x2100e10b3
call sym.GetLastError
mov rcx, r13
mov r8d, 0x8000
xor edx, edx
mov r14d, eax
call sym.VirtualFree
mov ecx, r14d
call sym.SetLastError
mov rax, r12
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.GetLastError
mov r8d, 0x8000
xor edx, edx
mov rcx, r13
mov r12d, eax
call sym.VirtualFree
mov ecx, r12d
xor r12d, r12d
call sym.SetLastError
jmp 0x2100e10b3
xor ecx, ecx
call sym.GetModuleHandleA
mov r9d, dword [0x21034b024]
movsxd rdx, dword [rax + 0x3c]
mov r8, rax
lea eax, [r9 - 1]
add eax, dword [rdx + r8 + 0x68]
mov edx, r9d
neg edx
and eax, edx
mov dword [0x2103184b4], eax
jmp 0x2100e0fd7
mov ecx, 0xe
call sym.SetLastError
jmp 0x2100e10b3
xor r12d, r12d
jmp 0x2100e10b3
Function at 0x2100e20f0
Capabilities:
Inspect section memory permissions

Disassembly:
push rsi
push rbx
sub rsp, 0x58
movdqu xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movdqu xmm1, xmmword [rdx + 0x10]
mov rbx, rcx
movups xmmword [rcx + 0x10], xmm1
movdqu xmm2, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm2
movdqu xmm3, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm3
mov eax, dword [rdx + 0x40]
mov r8d, dword [rcx + 0x34]
mov dword [rcx + 0x40], eax
mov ecx, dword [rcx + 0x3c]
mov eax, 8
mov r10d, ecx
and r10d, 2
jne 0x2100e2149
mov eax, r8d
and eax, 0x40000000
cmp eax, 1
sbb eax, eax
and eax, 0xfffffffe
add eax, 4
mov edx, dword [rbx + 0x38]
mov r9d, edx
and r9d, 0x8000000
and r8d, 0x20000000
je 0x2100e21f8
shl eax, 4
mov dword [rsp + 0x4c], eax
test r9d, r9d
jne 0x2100e22d0
mov r8d, edx
and r8d, 4
test dl, 2
je 0x2100e2278
mov esi, 4
test r10d, r10d
jne 0x2100e2290
mov edx, esi
shl edx, 4
test r8d, r8d
cmovne esi, edx
cmp esi, eax
jne 0x2100e2210
mov rdx, qword [rbx + 0x18]
mov ecx, dword [0x21034b024]
mov r8d, 1
lea r9, [rcx + rdx - 1]
xor edx, edx
mov rax, r9
div rcx
sub rax, 1
cmp r9, rcx
jb 0x2100e21ec
nop word cs:[rax + rax]
mov rdx, rax
mov ecx, eax
mov rsi, r8
shr rdx, 5
and ecx, 0x1f
shl rsi, cl
or dword [rbx + rdx*4 + 0x44], esi
sub rax, 1
jae 0x2100e21d0
add rsp, 0x58
pop rbx
pop rsi
ret
mov dword [rsp + 0x4c], eax
test r9d, r9d
je 0x2100e2173
mov esi, 0x40
nop word [rax + rax]
mov rdx, qword [rbx + 0x18]
and ch, 0x40
jne 0x2100e21a4
mov rcx, qword [rbx + 0x20]
lea r9, [rsp + 0x4c]
mov r8d, esi
call sym.VirtualProtect
test eax, eax
jne 0x2100e21a0
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x30], esi
lea r9, str.Warning:_VirtualProtect__addr:__p__len:__ly__new_prot:__y__old_prot:__y____E
lea r8, str.void_mmap_record::init_page_map_mmap_record_
mov edx, 0x8000
lea rcx, [0x210273880]
mov dword [rsp + 0x38], eax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x2100e21a0
and edx, 1
je 0x2100e22b8
mov esi, 2
jmp 0x2100e2191
mov esi, 8
test cl, 0x20
je 0x2100e2191
and edx, 0x4000000
cmp edx, 1
sbb esi, esi
and esi, 0xfffffffc
add esi, 8
jmp 0x2100e2191
cmp r8d, 1
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x10
jmp 0x2100e2210
mov esi, 0x40
jmp 0x2100e219c
Function at 0x2100ea740
Capabilities:
Check if file exists

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x140
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov edx, dword [rax - 0x304c]
test edx, edx
je 0x2100ea872
mov ebx, 0x61
mov esi, 1
lea rdi, [0x2102aa240]
lea r12, [rsp + 0x2c]
lea r13, str._c:_
cmp ebx, 0x7a
ja 0x2100ea7c9
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov edx, esi
and edx, dword [rax - 0x304c]
je 0x2100ea7bf
jmp 0x2100ea7c9
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov ecx, esi
and ecx, dword [rax - 0x304c]
jne 0x2100ea7c9
add ebx, 1
add esi, esi
cmp ebx, 0x7b
jne 0x2100ea7a8
movsxd rax, ebx
mov rcx, r12
mov rdx, r13
movsx r8d, byte [rdi + rax]
call sym.__small_sprintf
mov rcx, r12
call sym.GetFileAttributesA
cmp eax, 0xffffffff
je 0x2100ea840
mov rax, qword [0x21025fe40]
lea r13, [rsp + 0x30]
mov r9d, ebx
mov byte [rsp + 0x2e], 0
lea rdx, str._s_c
mov rcx, r13
lea r8, [rax + 0x8514]
call sym.__small_sprintf
mov rax, qword [0x21025fe40]
mov rdx, r13
mov rcx, r12
mov r8d, dword [rax + 0x8620]
call sym.fillout_mntent_char_const__char_const__unsigned_int_
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov edx, esi
not edx
and dword [rax - 0x304c], edx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov eax, dword [rax - 0x304c]
test eax, eax
jne 0x2100ea786
xor eax, eax
jmp 0x2100ea82c
Function at 0x2100ed910
Capabilities:
Check if file exists

Disassembly:
test edx, edx
js 0x2100ed918
cmp dword [rcx], edx
jg 0x2100ed920
jmp sym.cygdrive_getmntent__
movsxd rdx, edx
movsxd rax, dword [rcx + rdx*4 + 0x8714]
imul rax, rax, 0x214
mov r8d, dword [rcx + rax + 0x214]
lea r9, [rcx + rax + 4]
lea rdx, [rcx + rax + 0x10c]
mov rcx, r9
jmp sym.fillout_mntent_char_const__char_const__unsigned_int_

Function at 0x2100ee0b0
Capabilities:
Get disk information

Disassembly:
push r12
sub rsp, 0x230
mov r8d, 0x104
lea r12, [rsp + 0x20]
mov rdx, r12
call sym.QueryDosDeviceW
test eax, eax
jne 0x2100ee0e0
add rsp, 0x230
pop r12
ret
mov r8d, 0x11
lea rdx, str.Device_
mov rcx, r12
call sym.msys_2.0.dll_wcsncmp
test eax, eax
je case.0x2100ee118.1
movzx eax, word [rsp + 0x30]
sub eax, 0x43
cmp ax, 0xa
ja case.0x2100ee118.1
lea rdx, [0x21029b27c]
movzx eax, ax
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
mov r8d, 0x11
lea rcx, [rsp + 0x30]
lea rdx, str.Harddisk
call sym.msys_2.0.dll_wcsncmp
mov r8d, eax
mov eax, 3
test r8d, r8d
jne 0x2100ee0d0
xor eax, eax
add rsp, 0x230
pop r12
ret
lea rcx, [rsp + 0x30]
mov r8d, 0xf
lea rdx, str.MRxNfs_
call sym.msys_2.0.dll_wcsncmp
test eax, eax
je case.0x2100ee118.1
mov eax, 5
jmp 0x2100ee0d0
lea rcx, [rsp + 0x30]
mov r8d, 0x23
lea rdx, str.LanmanRedirector_
call sym.msys_2.0.dll_wcsncmp
test eax, eax
setne al
movzx eax, al
shl eax, 2
jmp 0x2100ee0d0
lea rcx, [rsp + 0x30]
mov r8d, 0xd
lea rdx, str.Floppy
call sym.msys_2.0.dll_wcsncmp
test eax, eax
setne al
movzx eax, al
add eax, eax
jmp 0x2100ee0d0
lea rcx, [rsp + 0x30]
mov r8d, 0xb
lea rdx, str.CdRom
call sym.msys_2.0.dll_wcsncmp
test eax, eax
setne al
movzx eax, al
jmp 0x2100ee0d0

Function at 0x2100ee200
Capabilities:
Get disk information

Disassembly:
push r12
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x3050], 0
mov r12, rcx
call sym.GetLogicalDrives
mov r8d, eax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov dword [rax - 0x304c], r8d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
test byte [rax - 0x304c], 1
jne 0x2100ee278
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
test byte [rax - 0x304c], 2
jne 0x2100ee2a0
mov rax, r12
add rsp, 0x20
pop r12
ret
lea rcx, [0x21029b2a8]
call sym.get_disk_type_wchar_t_const_
cmp eax, 2
jne 0x2100ee252
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
and dword [rax - 0x304c], 0xfffffffe
jmp 0x2100ee252
lea rcx, [0x21029b2ae]
call sym.get_disk_type_wchar_t_const_
cmp eax, 2
jne 0x2100ee268
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
and dword [rax - 0x304c], 0xfffffffd
mov rax, r12
add rsp, 0x20
pop r12
ret
Function at 0x2100ee2d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rcx, qword [0x21025fe40]
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 8]
movsxd rax, dword [rdx - 0x3050]
lea r8d, [rax + 1]
mov dword [rdx - 0x3050], r8d
test eax, eax
js 0x2100ee2ff
cmp eax, dword [rcx + 0x10]
jl 0x2100ee308
jmp sym.cygdrive_getmntent__
movsxd rax, dword [rcx + rax*4 + 0x8724]
imul rax, rax, 0x214
mov r8d, dword [rcx + rax + 0x224]
lea r9, [rcx + rax + 0x14]
lea rdx, [rcx + rax + 0x11c]
mov rcx, r9
jmp sym.fillout_mntent_char_const__char_const__unsigned_int_
Function at 0x2100ef870
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r14
push r13
push r12
push rdi
push rbx
sub rsp, 0x300
lea rdx, str.TcpipParametersInterfaces_
lea r13, [rsp + 0x100]
mov rbx, rcx
mov rcx, r13
call sym.msys_2.0.dll_wcpcpy
mov rdx, rax
mov rax, qword gs:[8]
mov rax, qword [rax - 0x2938]
test rax, rax
je 0x2100efa18
lea rcx, [sym.__ascii_mbtowc]
cmp qword [rax + 0xe8], rcx
je 0x2100efa08
mov rax, qword gs:[8]
mov rax, qword [rax - 0x2938]
mov rcx, qword [sym.__utf8_mbtowc]
test rax, rax
je 0x2100ef8ec
mov rcx, qword [rax + 0xe8]
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
mov r8d, 0xdc
xor r12d, r12d
call sym._sys_mbstowcs_int_____reent__wchar_t__char_const__unsigned_long___mbstate_t___wchar_t__unsigned_long__char_const__unsigned_long_
mov rdx, r13
mov ecx, 1
call sym.RtlCheckRegistryKey
test eax, eax
js 0x2100ef9ef
xor eax, eax
lea rdi, [rsp + 0x50]
mov ecx, 0x15
xor r9d, r9d
rep stosq qword [rdi], rax
lea r14, [rsp + 0x40]
lea r8, [rsp + 0x50]
mov rdx, r13
lea rax, str.EnableDHCP
mov ecx, 1
mov qword [rsp + 0x20], 0
mov r12d, 1
mov qword [rsp + 0x60], rax
lea rax, str.IPAddress
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x58], 0xa0
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x68], rax
mov qword [rsp + 0xa0], r14
call sym.RtlQueryRegistryValues
test eax, eax
js 0x2100ef9ef
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x2100ef9ef
mov r12d, dword [rsp + 0x3c]
test r12d, r12d
jne 0x2100efa40
cmp word [rbx], 0
je 0x2100efa46
nop word [rax + rax]
mov rcx, rbx
add r12d, 1
call sym.msys_2.0.dll_wcslen
lea rbx, [rbx + rax*2 + 2]
cmp word [rbx], 0
jne 0x2100ef9d0
mov rcx, r14
call sym.RtlFreeUnicodeString
mov eax, r12d
add rsp, 0x300
pop rbx
pop rdi
pop r12
pop r13
pop r14
ret
lea rcx, [sym.__utf8_mbtowc]
jmp 0x2100ef8ec
lea rax, [sym.__ascii_mbtowc]
cmp qword [sym.__utf8_mbtowc], rax
lea rcx, [sym.__utf8_mbtowc]
jne 0x2100ef8c9
jmp 0x2100ef8ec
mov r12d, 1
mov rcx, r14
call sym.RtlFreeUnicodeString
jmp 0x2100ef9ef
Function at 0x2100f3ea0
Capabilities:
Create thread

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov rax, qword [0x21034b1a0]
mov qword [rsp + 0x48], rcx
mov rbx, rcx
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], edx
test byte [rax + 0x10], 8
je 0x2100f3ece
cmp rcx, 0x7fffffff
ja 0x2100f3f10
call sym.call_gaa_void_
mov r8d, 1
test eax, eax
jne 0x2100f3ef0
mov eax, r8d
add rsp, 0x58
pop rbx
pop r12
ret
cmp eax, 0x6f
sete r8b
test rbx, rbx
sete al
and r8d, eax
mov eax, r8d
add rsp, 0x58
pop rbx
pop r12
ret
mov qword [rsp + 0x28], 0
xor edx, edx
mov r9, rcx
lea r8, [sym.call_gaa_void_]
mov dword [rsp + 0x20], 0
xor ecx, ecx
call sym.CreateThread
mov rcx, rax
mov r12, rax
call sym.GetThreadId
lea rdx, str.__call_gaa
mov ecx, eax
call sym.SetThreadName_unsigned_int__char_const_
test r12, r12
je 0x2100f3f80
mov edx, 0xffffffff
mov rcx, r12
call sym.WaitForSingleObject
lea rdx, [rsp + 0x3c]
mov rcx, r12
call sym.GetExitCodeThread
mov rcx, r12
call sym.CloseHandle
mov eax, dword [rsp + 0x3c]
jmp 0x2100f3ed3
movzx r8d, byte [0x210273880]
and r8d, 1
je 0x2100f3edd
lea r8, str.bool_get_adapters_addresses_IP_ADAPTER_ADDRESSES_LH__ULONG_
lea r9, str.CreateThread:__E
mov edx, 0x40
lea rcx, [0x210273880]
call method.strace.prntf_unsigned_int__char_const__char_const__..._
xor r8d, r8d
jmp 0x2100f3edd

Function at 0x2100f7df0
Capabilities:
Get geographical location

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov r9d, 0xa
mov r12, qword [r8]
lea rbx, [rsp + 0x26]
mov rsi, r8
mov r8, rbx
call sym.GetLocaleInfoA
movzx eax, byte [rsp + 0x26]
mov rdx, r12
mov r8, rbx
mov rcx, r12
test al, al
je 0x2100f7e5a
sub eax, 0x30
cmp al, 9
ja 0x2100f7e4a
test al, al
je 0x2100f7e61
add r8, 1
mov byte [rdx], al
lea rcx, [rdx + 1]
movzx eax, byte [r8]
test al, al
je 0x2100f7e5a
sub eax, 0x30
mov rdx, rcx
cmp al, 9
jbe 0x2100f7e2a
movzx eax, byte [r8 + 1]
add r8, 1
test al, al
jne 0x2100f7e23
mov rcx, rdx
mov byte [rcx], 0x7f
lea rdx, [rcx + 1]
mov byte [rdx], 0
mov rax, r12
add rdx, 1
mov qword [rsi], rdx
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
Function at 0x2100f81c0
Capabilities:
Get geographical location

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
mov r12, qword [r9]
lea rbx, [rsp + 0x30]
mov esi, r8d
mov rdi, r9
mov r9d, 0x50
mov r8, rbx
call sym.GetLocaleInfoW
movzx edx, word [rsp + 0x30]
mov r10, r12
test dx, dx
je 0x2100f8288
mov eax, esi
mov rcx, rbx
and esi, 2
mov r15d, 0x53
and eax, 1
lea rbx, [0x21029d484]
mov r14d, 0x70
mov dword [rsp + 0x2c], eax
lea r13, [0x21029d47c]
lea rbp, [0x21029d476]
lea rax, [rcx + 2]
mov r9, rax
cmp dx, 0xa
jbe 0x2100f8260
lea r8d, [rdx - 0x25]
cmp r8w, 0x54
ja case.0x2100f8253.1
movzx r8d, r8w
movsxd r8, dword [rbx + r8*4]
add r8, rbx
jmp r8
cmp dx, 8
ja case.0x2100f8253.0
mov word [r10], dx
movzx edx, word [rcx + 2]
add r10, 2
nop word cs:[rax + rax]
mov rcx, rax
test dx, dx
jne 0x2100f8230
xor eax, eax
add r10, 2
mov word [r10 - 2], ax
mov rax, r12
mov qword [rdi], r10
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp word [rcx + 2], dx
jne 0x2100f82bd
mov rcx, rax
add rax, 2
mov r9d, 0x25
mov r8d, 0x4d
mov word [r10], r9w
cmp dx, 0x6d
je 0x2100f82de
cmp dx, 0x73
mov r8d, r14d
cmove r8d, r15d
mov word [r10 + 2], r8w
add r10, 4
movzx edx, word [rcx + 2]
jmp 0x2100f8280
lea r9, str.edaA
cmp dx, 0x64
je 0x2100f8313
cmp dx, 0x4d
lea r9, str.yyyY
lea r11, str.mmbB
cmove r9, r11
cmp dx, word [rcx + 2]
jne 0x2100f8420
xor r8d, r8d
jmp 0x2100f832c
add rax, 2
add r8, 1
mov rcx, rax
cmp word [rax + 2], dx
je 0x2100f8328
mov r11d, 3
cmp r8, r11
cmovbe r11, r8
test esi, esi
je 0x2100f8418
cmp dx, 0x79
je 0x2100f8418
cmp r8, 2
jbe 0x2100f8418
add r9, 4
add rax, 2
jmp 0x2100f8420
lea r8, [0x21029d47c]
cmp dx, 0x68
je 0x2100f838c
mov r8d, dword [rsp + 0x2c]
test r8d, r8d
mov r8, rbp
cmovne r8, r13
cmp word [rcx + 2], dx
jne 0x2100f839d
mov rcx, rax
add r8, 2
add rax, 2
movzx edx, word [r8]
mov r11d, 0x25
add r10, 4
mov word [r10 - 4], r11w
mov word [r10 - 2], dx
movzx edx, word [rcx + 2]
jmp 0x2100f8280
movzx edx, word [rcx + 2]
jmp 0x2100f8280
movzx edx, word [rcx + 2]
cmp dx, 0x27
jne 0x2100f8448
mov edx, 0x27
add r10, 2
mov word [r10 - 2], dx
movzx edx, word [rcx + 2]
jmp 0x2100f8280
mov r8d, 0x25
mov word [r10 + 2], dx
add r10, 4
mov word [r10 - 4], r8w
movzx edx, word [rcx + 2]
jmp 0x2100f8280
lea r9, [r9 + r11*2]
add rax, 2
movzx edx, word [r9]
mov r11d, 0x25
add r10, 4
mov word [r10 - 4], r11w
mov word [r10 - 2], dx
movzx edx, word [rcx + 2]
jmp 0x2100f8280
test dx, dx
je 0x2100f8288
nop dword [rax]
mov word [r10], dx
movzx edx, word [r9 + 2]
add r10, 2
mov rax, r9
add r9, 2
test dx, dx
je 0x2100f8288
cmp dx, 0x27
jne 0x2100f8458
movzx edx, word [rax + 4]
lea rax, [r9 + 2]
jmp 0x2100f8280