joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a2f0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001f690
xor ebx, ebx
mov rdi, rax
cmp qword [0x1400acc10], rbx
jne 0x14002a3f6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14002a4cb
lea rdx, [0x140095918]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002a4cb
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140095908]
mov rcx, rsi
mov qword [0x1400acc10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400acc18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1400acc20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1400acc30], rax
test rax, rax
je 0x14002a3ed
lea rdx, [0x1400958b8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1400acc28], rax
jmp 0x14002a3fd
mov rax, qword [0x1400acc28]
jmp 0x14002a404
mov rax, qword [0x1400acc28]
mov r11, qword [0x1400acc30]
cmp rax, rdi
je 0x14002a46c
cmp r11, rdi
je 0x14002a46c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1400acc30]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14002a46c
test rax, rax
je 0x14002a46c
call rsi
test rax, rax
je 0x14002a466
lea rcx, [rsp + 0x88]
mov r9d, recvfrom
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002a466
test byte [rsp + 0x38], 1
jne 0x14002a46c
bts ebp, 0x15
jmp 0x14002a4aa
mov rcx, qword [0x1400acc18]
cmp rcx, rdi
je 0x14002a4aa
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002a4aa
call rax
mov rbx, rax
test rax, rax
je 0x14002a4aa
mov rcx, qword [0x1400acc20]
cmp rcx, rdi
je 0x14002a4aa
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002a4aa
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400acc10]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002a4cb
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14002a4cd
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14003f620
Capabilities:
Create directory
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa90
mov dil, r9b
mov rbx, r8
mov rcx, rdx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x880]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor esi, esi
cmp eax, esi
jne 0x14003f660
xor eax, eax
jmp 0x14003f7c1
lea r8, [rsp + 0x880]
lea rdx, str.___s
lea rcx, [rsp + 0x50]
call fcn.140018e18
lea rcx, [rsp + 0x50]
call fcn.140018b2c
cmp word [rsp + rax*2 + 0x4e], 0x5c
jne 0x14003f6ac
lea rcx, [rsp + 0x50]
call fcn.140018b2c
cmp word [rsp + rax*2 + 0x4c], 0x3a
je 0x14003f6ac
lea rcx, [rsp + 0x50]
call fcn.140018b2c
mov word [rsp + rax*2 + 0x4e], si
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x14003f6c0
cmp dil, sil
je 0x14003f659
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003f700
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14003f659
xor edx, edx
lea rcx, [rsp + 0x260]
lea r8d, [rdx + 0x14]
call fcn.140018a40
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x260], 0xa0000003
call fcn.140018b2c
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x270]
add ax, ax
mov r8d, 0x104
mov word [rsp + 0x26a], ax
add ax, 2
mov word [rsp + 0x26c], ax
call fcn.140018b48
movzx r11d, word [rsp + 0x26a]
add r11w, 0xc
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
movzx r9d, r11w
lea r8, [rsp + 0x260]
mov edx, 0x900a4
mov rcx, rdi
add r9d, 8
mov dword [rsp + 0x28], esi
mov word [rsp + 0x264], r11w
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
cmp eax, esi
jne 0x14003f7b6
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003f6f2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14003fa10
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov rbx, rdx
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x1400993f8]
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
add rsp, 0x230
pop rbx
ret

Function at 0x14003fbd0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x48c]
mov rbx, rcx
mov r8d, 0x10000
test eax, eax
je 0x14003fbee
cmp eax, r8d
jne 0x14003fc0a
mov r9, qword [rcx + 0x28]
mov rcx, qword [rcx + 0x480]
mov edx, 1
call fcn.14001a6e8
and dword [rbx + 0x48c], 0
movsxd rdx, dword [rbx + 0x48c]
mov rax, qword [rbx + 0x480]
mov al, byte [rdx + rax]
lea ecx, [rdx + 1]
mov dword [rbx + 0x48c], ecx
add rsp, 0x20
pop rbx
ret
Function at 0x140041600
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
test ecx, ecx
js 0x140041683
push rbx
sub rsp, 0x20
mov ebx, ecx
test ecx, ecx
je 0x140041678
cmp ecx, 0xf
jae 0x140041676
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140041676
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x38]
sub r11, qword [rsp + 0x40]
pxor xmm1, xmm1
pxor xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x48]
cvtsi2sd xmm1, r11
divsd xmm1, xmm0
mulsd xmm1, qword [0x14009e900]
cvttsd2si rax, xmm1
cmp eax, ebx
jb 0x14004162e
jmp 0x14004167e
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x20
pop rbx
ret

Function at 0x140041840
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov rcx, rax
mov edx, SafeArrayCreateEx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor edi, edi
cmp eax, edi
jne 0x14004186f
xor eax, eax
jmp 0x1400418e3
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x14004186b
cmp ebx, 0x20
je 0x1400418d5
cmp ebx, 0x40
je 0x1400418da
mov edx, 0x80000000
mov ecx, ebx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1400418e3
mov edi, 1
xor edx, edx
mov ecx, edi
call sub.KERNEL32.dll_SetSystemPowerState
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400418f0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x2c0
mov rdi, rdx
movsxd rbx, ecx
lea rdx, [rsp + 0x120]
mov ecx, 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x1400419c9
lea rcx, [rsp + 0x20]
mov edx, 0x100
call sub.WSOCK32.dll_gethostname
lea rcx, [rsp + 0x20]
call sub.WSOCK32.dll_gethostbyname
test rax, rax
je 0x1400419c9
mov r9, qword [rax + 0x18]
xor ecx, ecx
cmp qword [r9], rcx
je 0x140041959
mov rax, r9
add rax, 8
inc ecx
cmp qword [rax], 0
jne 0x14004194d
cmp ebx, ecx
jle 0x14004196e
lea rdx, str.0.0.0.0
mov rcx, rdi
call fcn.140018120
jmp 0x1400419c2
mov rdx, qword [r9 + rbx*8 - 8]
lea rcx, [rsp + 0x2e0]
mov r8d, 4
call fcn.140018610
mov ecx, dword [rsp + 0x2e0]
call sub.WSOCK32.dll_inet_ntoa
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.1400194b0
lea rcx, [rsp + 0x20]
or edx, 0xffffffff
call fcn.140015d70
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call fcn.140018120
mov rcx, rbx
call fcn.1400185f4
call sub.WSOCK32.dll_WSACleanup
jmp 0x1400419d8
lea rdx, [0x140096618]
mov rcx, rdi
call fcn.140018120
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2c0
pop rdi
ret
Function at 0x140051110
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
mov r12, r9
mov rax, rdx
lea ebx, [r14 + 1]
mov edi, r14d
mov ebp, r14d
cmp word [rdx], r14w
jne 0x14005114e
xor al, al
jmp 0x14005129a
or edx, 0xffffffff
mov rcx, rax
call fcn.140017380
mov rsi, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
mov rcx, rax
mov byte [rsi], r14b
mov byte [r15], r14b
mov qword [rsp + 0x30], rax
mov byte [r12], r14b
mov byte [r13], r14b
call fcn.140019350
lea rcx, [rbx + rax]
call fcn.140017e04
mov rdx, qword [rsp + 0x30]
mov r14, rax
movsxd rax, edi
mov cl, byte [rax + rdx]
cmp cl, 0x2b
je 0x1400511bc
cmp cl, 0x5e
je 0x1400511b7
cmp cl, 0x21
je 0x1400511b7
cmp cl, 0x23
jne 0x1400511e2
cmp cl, 0x2b
jne 0x1400511c2
mov byte [r12], bl
jmp 0x1400511de
cmp cl, 0x5e
jne 0x1400511cd
mov byte [r13], bl
jmp 0x1400511de
cmp cl, 0x21
jne 0x1400511d7
mov byte [r15], bl
jmp 0x1400511de
cmp cl, 0x23
jne 0x1400511de
mov byte [rsi], bl
add edi, ebx
jmp 0x14005119d
mov rsi, qword [rsp + 0x90]
movsxd rax, edi
add edi, ebx
mov cl, byte [rax + rdx]
mov dword [rsp + 0x88], edi
cmp cl, 0x7b
jne 0x140051258
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x88]
mov r8, rdx
mov r9, r14
mov dl, 0x7d
mov qword [rsp + 0x20], rax
call fcn.1400432b0
test eax, eax
jne 0x1400512c6
lea rdi, str.t_t_
mov rcx, qword [rdi]
mov rdx, r14
call fcn.14002e180
test eax, eax
je 0x140051250
lea rax, reloc.WSOCK32.dll_accept
add rdi, 8
add ebp, ebx
cmp rdi, rax
jl 0x14005122f
cmp ebp, 0x62
jne 0x1400512b2
mov cl, byte [r14]
call qword [sym.imp.USER32.dll_VkKeyScanA]
movsx ecx, ax
bt ecx, 9
mov dword [rsi], ecx
jae 0x14005126d
mov byte [r13], bl
bt ecx, 0xa
jae 0x140051276
mov byte [r15], bl
bt ecx, 8
jae 0x140051280
mov byte [r12], bl
mov rcx, qword [rsp + 0x30]
and dword [rsi], 0xff
call fcn.1400185f4
mov rcx, r14
call fcn.1400185f4
mov al, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140000000]
movsxd rax, ebp
cmp byte [rax + rcx + 0xabba0], 0
je 0x1400512ca
xor bl, bl
jmp 0x140051280
mov eax, dword [rcx + rax*4 + 0xabc10]
mov dword [rsi], eax
jmp 0x140051280
Function at 0x140059ad0
Capabilities:
Copy file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x480
mov rbx, rdx
lea rdx, [rsp + 0x270]
mov dil, r8b
call fcn.1400158f0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400158f0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ebx, ebx
cmp eax, ebx
jne 0x140059b52
cmp dil, bl
je 0x140059b4b
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call fcn.140018ccc
cmp eax, ebx
je 0x140059b44
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x140059bfe
xor al, al
jmp 0x140059bfe
lea rcx, [rsp + 0x270]
call fcn.140041e40
cmp al, bl
je 0x140059b4b
lea rcx, [rsp + 0x60]
call fcn.140041e40
cmp al, bl
je 0x140059c0f
cmp dil, bl
je 0x140059b4b
lea rdx, str..
lea rcx, [rsp + 0x270]
call fcn.1400180f4
lea rcx, [rsp + 0x270]
call fcn.140018b2c
lea rcx, [rsp + 0x60]
mov word [rsp + rax*2 + 0x272], bx
call fcn.140018b2c
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
lea rax, [rsp + 0x270]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
mov eax, 0x614
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 2
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
sete al
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rdi
ret
lea rcx, [rsp + 0x60]
call fcn.140041a50
cmp al, bl
je 0x140059b4b
lea rcx, [rsp + 0x60]
call fcn.140041e40
cmp al, bl
jmp 0x140059b78

Function at 0x140059c40
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xcd0
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov bpl, bl
call fcn.1400158f0
lea rcx, [rsp + 0x30]
call fcn.140041e40
cmp al, bl
je 0x140059c85
lea rdx, str..
lea rcx, [rsp + 0x30]
call fcn.1400180f4
lea rax, [rsp + 0xac0]
lea r9, [rsp + 0x8b0]
lea r8, [rsp + 0x490]
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400198dc
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dil, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140059d46
cmp dil, 1
jne 0x140059d46
test byte [rsp + 0x240], 0x10
jne 0x140059d2c
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x30]
mov bpl, dil
call fcn.140018120
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x30]
call fcn.1400180f4
lea rdx, [rsp + 0x26c]
lea rcx, [rsp + 0x30]
call fcn.1400180f4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x140059d49
lea rdx, [rsp + 0x240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jne 0x140059cd3
mov dil, bl
jmp 0x140059cd3
mov bl, bpl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0xcd0]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400600f0
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x2e0
mov rbx, rcx
xor r12d, r12d
lea rcx, [rsp + 0x58]
mov rsi, r9
mov rbp, r8
mov rdi, rdx
mov qword [rsp + 0x30], r12
mov qword [rax + 0x20], r12
call fcn.140008640
lea rcx, [rsp + 0x38]
call fcn.140008640
lea rcx, [rsp + 0x78]
call fcn.140008640
lea rdx, str.SOFTWAREClasses_
lea rcx, [rsp + 0x58]
call fcn.140011cb0
lea rcx, [rsp + 0x58]
mov rdx, rbx
call fcn.1400121b0
lea rdx, str.CLSID
lea rcx, [rsp + 0x58]
call fcn.1400121b0
lea rdx, [0x140096618]
lea rcx, [rsp + 0x38]
call fcn.140011cb0
cmp rdi, r12
je 0x1400601ac
cmp word [rdi], 0x5c
je 0x1400601ac
cmp word [rdi + 2], 0x5c
je 0x1400601ac
lea rdx, [0x14009ca40]
lea rcx, [rsp + 0x38]
call fcn.140011cb0
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.1400121b0
cmp rsi, r12
je 0x14006021f
xor edx, edx
lea rcx, [rsp + 0x98]
lea r8d, [rdx + 0x30]
call fcn.140018a40
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x9c], r12d
call fcn.140013690
lea rdx, str.IPC_
lea rcx, [rsp + 0x78]
call fcn.1400121b0
mov r11, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x98]
xor r9d, r9d
mov r8, rsi
mov qword [rsp + 0xb0], r11
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp eax, r12d
jne 0x14006030c
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rdx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp eax, r12d
jne 0x14006030c
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x318]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x140060301
mov rcx, qword [rsp + 0x318]
lea rax, [rsp + 0x308]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x308], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x1400602f3
mov eax, dword [rsp + 0x308]
lea rcx, [rsp + 0xd0]
shr eax, 1
mov dword [rsp + 0x308], eax
mov word [rsp + rax*2 + 0xd0], r12w
call fcn.140015940
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.1400185f4
mov rcx, qword [rsp + 0x318]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.1400036e0
lea rcx, [rsp + 0x38]
call fcn.1400036e0
lea rcx, [rsp + 0x58]
call fcn.1400036e0
lea r11, [rsp + 0x2e0]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140060350
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x290
mov rsi, rcx
lea rcx, [rsp + 0x40]
movaps xmmword [rax - 0x28], xmm6
mov rbp, rdx
call fcn.140008640
lea rdx, [rsp + 0x38]
movsd xmm6, qword [0x14009e8d0]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromIID]
xor r12d, r12d
cmp eax, r12d
mov edi, eax
jl 0x140060573
mov rcx, qword [rsp + 0x38]
call fcn.140015940
lea rdx, str.interface_
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140011cb0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1400121b0
lea rdx, str.TypeLib
lea rcx, [rsp + 0x40]
call fcn.1400121b0
mov rcx, rbx
call fcn.1400185f4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x40]
lea r11, [rsp + 0x2c8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x140060573
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x140060565
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.140015940
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.1400185f4
cmp edi, r12d
jl 0x140060565
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
lea rdx, str.Version
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x14006050d
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.140019b44
movapd xmm6, xmm0
movsd xmm1, qword [0x14009e8d0]
movapd xmm0, xmm6
call fcn.14001d450
lea rax, [rsp + 0x30]
cvttsd2si rdx, xmm6
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
cvttsd2si r8, xmm0
call qword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
cmp eax, r12d
mov edi, eax
jl 0x140060565
mov rcx, qword [rsp + 0x30]
mov r8, rbp
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov edi, eax
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.1400036e0
lea r11, [rsp + 0x290]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140061650
Capabilities:
Create http request

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov rax, qword [rcx + 0x158]
mov esi, dword [rcx + 0x148]
mov rdi, r8
mov r8, qword [rcx + 0x150]
mov qword [r11 - 0x40], rax
mov rax, qword [rcx + 0x160]
mov qword [r11 - 0x38], rax
mov rax, qword [rcx + 0x168]
mov rbx, rcx
inc dword [rax]
mov rbp, qword [rcx + 0x178]
mov r12, qword [rcx + 0x170]
mov qword [r11 - 0x30], rax
mov rax, qword [rcx + 0x180]
mov qword [r11 - 0x48], r8
mov qword [r11 - 0x58], rax
mov rax, qword [rcx + 0x188]
mov qword [r11 - 0x60], rbp
inc dword [rax]
mov r13, qword [rcx + 0x198]
mov r14, qword [rcx + 0x190]
mov qword [r11 - 0x50], rax
mov rax, qword [rcx + 0x1a0]
mov qword [r11 - 0x80], r13
mov qword [r11 - 0x78], rax
mov rax, qword [rcx + 0x1a8]
mov qword [rsp + 0x30], r14
inc dword [rax]
mov qword [r11 - 0x68], r12
mov qword [r11 - 0x70], rax
cmp edx, 1
jne 0x140061757
mov esi, dword [rcx + 0x1b0]
lea rdx, [rcx + 0x1b8]
lea rcx, [r11 - 0x48]
call fcn.140013690
lea rdx, [rbx + 0x1d8]
lea rcx, [rsp + 0x50]
call fcn.140013690
lea rdx, [rbx + 0x1f8]
lea rcx, [rsp + 0x30]
call fcn.140013690
mov r8, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
cmp esi, 1
jne 0x140061760
mov edx, esi
jmp 0x140061773
cmp esi, 2
jne 0x140061771
lea r9, str._local_
lea edx, [rsi + 1]
jmp 0x140061779
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea rcx, str.AutoIt
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi], rax
cmp rax, rbx
je 0x1400617ef
lea r9d, [rbx + 8]
lea r8, [rsp + 0xc0]
lea edx, [rbx + 0x32]
xor ecx, ecx
mov dword [rsp + 0xc0], 1
mov dword [rsp + 0xc4], ebx
call qword [sym.imp.WININET.dll_InternetSetOptionW]
cmp esi, 2
jne 0x1400617ed
cmp rbp, rbx
je 0x1400617ed
mov rcx, qword [rdi]
lea r9d, [rbp + 1]
lea edx, [rbx + 0x2b]
mov r8, r12
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov rcx, qword [rdi]
lea r9d, [r13 + 1]
lea edx, [rbx + 0x2c]
mov r8, r14
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov bl, 1
lea rcx, [rsp + 0x30]
call fcn.1400036e0
lea rcx, [rsp + 0x50]
call fcn.1400036e0
lea rcx, [rsp + 0x70]
call fcn.1400036e0
lea r11, [rsp + 0x90]
mov al, bl
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret