joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cdf64
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rcx
lea rdi, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, rdi
je 0x1400cdfc8
test byte [rcx + 0x1c], 1
je 0x1400cdfc8
mov edx, SafeArrayUnlock
lea r8, [0x140009148]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rsp + 0x20], rax
xor esi, esi
cmp qword [r14 + 0x28], rsi
je 0x1400ce0c3
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
jbe 0x1400ce02f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x1400ce0c3
lea r9, [0x1400ce160]
lea r8, [rsp + 0x40]
lea rdx, [0x1400ce188]
lea rcx, [rsp + 0x20]
call fcn.1400157a0
mov rcx, qword [0x140148ea8]
mov ebx, 2
cmp rcx, rdi
je 0x1400ce080
test byte [rcx + 0x1c], bl
je 0x1400ce080
cmp byte [rcx + 0x19], 4
jb 0x1400ce080
lea edx, [rbx + 0x10]
mov r9, qword [rsp + 0x20]
lea r8, [0x140009148]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcd0
mov r9d, ebx
mov r8d, 0xa
mov rdx, qword [rsp + 0x20]
mov rcx, qword [r14 + 0x28]
call fcn.140107874
test eax, eax
jne 0x1400ce0b1
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x1400ce0b6
and qword [r14 + 0x28], 0
jmp 0x1400ce0c8
mov ebx, 2
mov rcx, qword [0x140148ea8]
cmp rcx, rdi
je 0x1400ce105
test byte [rcx + 0x1c], 1
je 0x1400ce105
movzx eax, byte [rcx + 0x19]
mov edx, 5
test esi, esi
cmovns ebx, edx
cmp eax, ebx
jl 0x1400ce105
mov edx, SafeArrayAccessData
mov r9d, esi
lea r8, [0x140009148]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
nop
mov r14, qword [rsp + 0x20]
lock add dword [r14 - 8], 0xffffffff
jg 0x1400ce12f
mov rdi, qword [r14 - 0x18]
mov r8, qword [rdi]
mov rbx, qword [r8 + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
mov eax, esi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140001000
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400cf978
Capabilities:
Modify service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov dword [rax + 0x10], edx
push r15
sub rsp, 0x60
mov rdi, rcx
mov rcx, qword [0x140148ea8]
lea r14, [0x140148ea8]
lea r15, [0x140009168]
cmp rcx, r14
je 0x1400cf9f1
test byte [rcx + 0x1c], 1
je 0x1400cf9cb
mov rcx, qword [rcx + 0x10]
mov edx, DispGetParam
mov r8, r15
call fcn.14000fcb0
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400cf9f1
test byte [rcx + 0x1c], 2
je 0x1400cf9f1
cmp byte [rcx + 0x19], 4
jb 0x1400cf9f1
mov rcx, qword [rcx + 0x10]
mov edx, reloc.OLEAUT32.dll_DispGetParam
mov r8, r15
lea r9d, [rdx - 0x1a]
call fcn.14000fd64
mov edx, 1
mov rcx, rdi
call fcn.1400cfde4
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400cfa2c
test byte [rcx + 0x1c], 2
je 0x1400cfa2c
cmp byte [rcx + 0x19], 4
jb 0x1400cfa2c
mov rcx, qword [rcx + 0x10]
mov edx, 0x1c
mov r9d, eax
mov r8, r15
call fcn.14000fd64
cmp ebx, 1
jne 0x1400cfaed
mov rcx, qword [rdi + 0x10]
lea r8, [rsp + 0x78]
lea edx, [rbx + 2]
mov dword [rsp + 0x78], ebx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov ebx, eax
cmp eax, 1
je 0x1400cfa7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400cfaed
test byte [rcx + 0x1c], 2
je 0x1400cfaed
cmp byte [rcx + 0x19], 2
jb 0x1400cfaed
mov edx, 0x1d
jmp 0x1400cfade
mov rcx, qword [rdi + 0x10]
xor eax, eax
or edx, 0xffffffff
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
lea r8d, [rax + 2]
mov r9d, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov ebx, eax
cmp eax, 1
je 0x1400cfaed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400cfaed
test byte [rcx + 0x1c], 2
je 0x1400cfaed
cmp byte [rcx + 0x19], 4
jb 0x1400cfaed
mov edx, 0x1e
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov r8, r15
call fcn.14000fd64
mov rcx, rdi
call fcn.1400d0010
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400cfb21
test byte [rcx + 0x1c], 1
je 0x1400cfb21
cmp byte [rcx + 0x19], 5
jb 0x1400cfb21
mov rcx, qword [rcx + 0x10]
mov edx, 0x1f
mov r9d, ebx
mov r8, r15
call fcn.14000fd64
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1400cfb3c
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x140148ea8]
lea rsi, [0x140148ea8]
cmp rcx, rsi
je 0x1400cfb7c
test byte [rcx + 0x1c], 1
je 0x1400cfb7c
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009168]
mov edx, 0x20
call fcn.14000fcb0
xor edx, edx
mov rcx, rdi
call fcn.1400cfde4
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400cfbb8
test byte [rcx + 0x1c], 2
je 0x1400cfbb8
cmp byte [rcx + 0x19], 4
jb 0x1400cfbb8
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009168]
mov edx, 0x21
mov r9d, eax
call fcn.14000fd64
cmp ebx, 1
jne 0x1400cfc09
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ebx, eax
cmp eax, 1
je 0x1400cfc09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400cfc09
test byte [rcx + 0x1c], 2
je 0x1400cfc09
cmp byte [rcx + 0x19], 4
jb 0x1400cfc09
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009168]
mov edx, 0x22
mov r9d, eax
call fcn.14000fd64
mov rcx, rdi
call fcn.1400d0010
mov rcx, qword [0x140148ea8]
cmp rcx, rsi
je 0x1400cfc41
test byte [rcx + 0x1c], 1
je 0x1400cfc41
cmp byte [rcx + 0x19], 5
jb 0x1400cfc41
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009168]
mov edx, 0x23
mov r9d, ebx
call fcn.14000fd64
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cfc54
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push r15
sub rsp, 0x60
mov rcx, qword [0x140148ea8]
lea r15, [0x140148ea8]
cmp rcx, r15
je 0x1400cfc9b
test byte [rcx + 0x1c], 1
je 0x1400cfc9b
cmp byte [rcx + 0x19], 5
jb 0x1400cfc9b
mov rcx, qword [rcx + 0x10]
mov edx, 0x33
lea r8, [0x140009168]
lea r9d, [rdx - 0x31]
call fcn.14000fd64
and qword [rsp + 0x40], 0
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
lea r8, [0x140005590]
lea rcx, [rsp + 0x40]
mov rdx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2011f
call fcn.140029e44
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400cfd06
test byte [rcx + 0x1c], 2
je 0x1400cfd06
cmp byte [rcx + 0x19], 4
jb 0x1400cfd06
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009168]
mov edx, 0x34
mov r9d, eax
call fcn.14000fd64
mov rcx, qword [0x140148ea8]
test ebx, ebx
jne 0x1400cfd76
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x78]
lea r9d, [rbx + 4]
lea rdx, [0x1400cfdd0]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400cfdaf
test byte [rcx + 0x1c], 2
je 0x1400cfd76
cmp byte [rcx + 0x19], 4
jb 0x1400cfd76
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009168]
mov edx, 0x35
mov r9d, eax
call fcn.14000fd64
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400cfdaf
test byte [rcx + 0x1c], 1
je 0x1400cfdaf
movzx r9d, byte [rcx + 0x19]
mov eax, ebx
neg eax
sbb edx, edx
and edx, 0xfffffffd
add edx, 5
cmp r9d, edx
jl 0x1400cfdaf
mov rcx, qword [rcx + 0x10]
lea r8, [0x140009168]
mov edx, 0x36
mov r9d, ebx
call fcn.14000fd64
cmp qword [rsp + 0x40], 0
je 0x1400cfdc2
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop r15
ret
Function at 0x1400d252c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
mov r14, rcx
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
lea r13, [0x1400091a8]
cmp rcx, rax
je 0x1400d2585
test byte [rcx + 0x1c], 1
je 0x1400d2585
cmp byte [rcx + 0x19], 5
jb 0x1400d2585
mov rcx, qword [rcx + 0x10]
mov edx, 0x4a
mov r9, rbp
mov r8, r13
call fcn.14000fcd0
mov rcx, qword [r14]
xor r15d, r15d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x70], r15d
mov edi, r15d
mov dword [rsp + 0x88], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400d25e2
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x1400d25d2
lea ebx, [r15 + 0xd]
jmp 0x1400d25e2
mov edi, dword [rsp + 0x70]
mov ebx, r15d
shr edi, 1
mov dword [rsp + 0x88], edi
mov r10, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp r10, rax
je 0x1400d261e
test byte [r10 + 0x1c], 2
je 0x1400d261e
cmp byte [r10 + 0x19], 4
jb 0x1400d261e
mov rcx, qword [r10 + 0x10]
mov edx, 0x4b
mov r9d, ebx
mov r8, r13
call fcn.14000fd64
mov r10, qword [0x140148ea8]
test ebx, ebx
jne 0x1400d2713
mov rax, qword [rsi]
lea ecx, [rbx + 1]
lea edx, [rdi + 2]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or ecx, eax
jge 0x1400d2643
mov rcx, rsi
call fcn.140011854
mov r8, qword [rsi]
lea r9, [rsp + 0x88]
mov rdx, rbp
mov rcx, r14
call fcn.140029ee0
mov ebx, eax
mov rcx, qword [0x140148ea8]
lea rdi, [0x140148ea8]
cmp rcx, rdi
je 0x1400d268e
test byte [rcx + 0x1c], 2
je 0x1400d268e
cmp byte [rcx + 0x19], 4
jb 0x1400d268e
mov rcx, qword [rcx + 0x10]
mov edx, 0x4c
mov r9d, eax
mov r8, r13
call fcn.14000fd64
mov eax, ebx
neg eax
sbb ecx, ecx
or rax, 0xffffffffffffffff
neg ecx
dec ecx
cmp ecx, eax
jne 0x1400d26ba
mov rcx, qword [rsi]
test rcx, rcx
jne 0x1400d26ad
mov ecx, r15d
jmp 0x1400d26c2
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400d26ad
mov rcx, rax
test ecx, ecx
js 0x1400d276a
mov rax, qword [rsi]
cmp ecx, dword [rax - 0xc]
jg 0x1400d276a
mov dword [rax - 0x10], ecx
mov rax, qword [rsi]
movsxd rcx, ecx
mov word [rax + rcx*2], r15w
mov r10, qword [0x140148ea8]
cmp r10, rdi
je 0x1400d274f
test byte [r10 + 0x1c], 2
je 0x1400d271a
cmp byte [r10 + 0x19], 4
jb 0x1400d271a
mov r9, qword [rsi]
mov rcx, qword [r10 + 0x10]
mov edx, 0x4d
mov r8, r13
call fcn.14000fcd0
mov r10, qword [0x140148ea8]
jmp 0x1400d271a
lea rdi, [0x140148ea8]
cmp r10, rdi
je 0x1400d274f
test byte [r10 + 0x1c], 1
je 0x1400d274f
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400d274f
mov rcx, qword [r10 + 0x10]
mov edx, 0x4e
mov r9d, ebx
mov r8, r13
call fcn.14000fd64
lea r11, [rsp + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.1400119f0
int3
Function at 0x1400d2f64
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x38
mov rax, qword [section..data]
xor esi, esi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
and qword [rsp + 0x78], rsi
lea rdx, [0x140005590]
mov rbx, rax
lea rax, [rsp + 0x78]
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d3023
mov rdi, qword [rsp + 0x78]
and dword [rsp + 0x60], esi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea rdx, [0x140008d50]
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400d3015
cmp dword [rsp + 0x70], 4
jne 0x1400d3015
test eax, eax
jne 0x1400d3015
cmp dword [rsp + 0x60], esi
lea eax, [rsi + 1]
cmovne esi, eax
test rdi, rdi
je 0x1400d3023
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, rbx
lock add dword [rbx + 0x10], 0xffffffff
jg 0x1400d3048
mov rdi, qword [rbx]
mov r8, qword [rdi]
mov rbx, qword [r8 + 8]
mov rcx, rbx
call qword [fcn.140015690]
mov rdx, r14
mov rcx, rdi
call rbx
mov eax, esi
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d3054
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x50
and dword [rbp + 0x38], 0
and dword [rbp + 0x40], 0
and qword [rbp - 8], 0
mov dword [rbp + 0x48], 4
mov rcx, qword [0x140148ea8]
lea r15, [0x140148ea8]
mov ebx, 1
cmp rcx, r15
je 0x1400d30a5
test byte [rcx + 0x1c], bl
je 0x1400d30a5
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x68]
lea r8, [0x1400091a8]
call fcn.14000fcb0
xor edi, edi
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x10]
and qword [rbp - 0x10], rdi
and dword [rbp + 0x30], edi
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetGetJoinInformation]
mov esi, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400d30fb
test byte [rcx + 0x1c], 2
je 0x1400d30fb
cmp byte [rcx + 0x19], 4
jb 0x1400d30fb
mov eax, dword [rbp + 0x30]
mov rcx, qword [rcx + 0x10]
mov r9d, esi
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.1400d0a20
mov rcx, qword [0x140148ea8]
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x1400d3114
mov rcx, rax
call qword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov rcx, qword [0x140148ea8]
test esi, esi
jne 0x1400d3175
cmp dword [rbp + 0x30], 3
jne 0x1400d314d
cmp rcx, r15
je 0x1400d3149
test byte [rcx + 0x1c], 2
je 0x1400d3149
cmp byte [rcx + 0x19], 4
jb 0x1400d3149
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x6b]
lea r8, [0x1400091a8]
call fcn.14000fcb0
mov rcx, qword [0x140148ea8]
mov edi, ebx
jmp 0x1400d31a5
cmp rcx, r15
je 0x1400d31d1
test byte [rcx + 0x1c], 2
je 0x1400d31a5
cmp byte [rcx + 0x19], 4
jb 0x1400d31a5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400091a8]
mov edx, WSAGetLastError
call fcn.14000fcb0
jmp 0x1400d319e
cmp rcx, r15
je 0x1400d31d1
test byte [rcx + 0x1c], 2
je 0x1400d31a5
cmp byte [rcx + 0x19], 2
jb 0x1400d31a5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400091a8]
mov edx, WSAGetLastError
mov r9d, esi
call fcn.14000fd64
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400d31cd
test byte [rcx + 0x1c], bl
je 0x1400d31cd
cmp byte [rcx + 0x19], 5
jb 0x1400d31cd
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400091a8]
mov edx, WSAGetLastError
mov r9d, edi
call fcn.14000fd64
test edi, edi
jne 0x1400d31d3
xor ebx, ebx
lea rax, [rbp - 8]
lea rdx, [0x140008d90]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d3257
mov rcx, qword [rbp - 8]
lea rax, [rbp + 0x48]
lea r8, [0x140008de0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
lea rdx, [0x140008e00]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x38]
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400d3248
cmp dword [rbp + 0x38], 4
jne 0x1400d3248
xor ebx, ebx
cmp dword [rbp + 0x40], ebx
sete bl
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400d3257
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x50
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400d3264
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor eax, eax
mov rdi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x60]
mov r9d, 0x2001f
xor r8d, r8d
mov rsi, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400d3405
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400d32e0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
test ebx, ebx
jne 0x1400d3405
jmp 0x1400d3312
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400d3264
mov ebx, eax
test eax, eax
jne 0x1400d3405
mov rcx, qword [rsp + 0x48]
xor ebx, ebx
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400d32f4
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400d3360
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
cmp qword [rdi + 8], rbx
jne 0x1400d33bf
cmp qword [rdi + 0x10], rbx
jne 0x1400d33bf
lea rcx, [0x1400d3440]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d3394
lea rdx, [0x140009178]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 8], rax
jmp 0x1400d33bf
lea rcx, [0x140009188]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
je 0x1400d33bf
lea rdx, [0x1400d3498]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x10], rax
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x1400d33e1
mov rcx, rbx
call qword [fcn.140015690]
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call rbx
jmp 0x1400d3403
mov rbx, qword [rdi + 0x10]
test rbx, rbx
je 0x1400d33fd
mov rcx, rbx
call qword [fcn.140015690]
mov rcx, qword [rdi]
mov rdx, rsi
call rbx
jmp 0x1400d3403
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400d3415
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140001000
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d3600
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [0x140148ea8]
lea r15, [0x140148ea8]
mov r14d, 5
lea r12, [0x1400091b8]
cmp rcx, r15
je 0x1400d3660
test byte [rcx + 0x1c], 1
je 0x1400d3660
cmp byte [rcx + 0x19], r14b
jb 0x1400d3660
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 5]
mov r9, rsi
mov r8, r12
mov qword [rsp + 0x20], rbp
call fcn.140040218
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
xor ebx, ebx
call sub.msvcrt.dll_memset
and qword [rsp + 0xa0], rbx
lea r8d, [rbx + 0x2c]
lea rcx, [rsp + 0x34]
xor edx, edx
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 4
mov rcx, qword [0x140148ea8]
lea edi, [rbx + 2]
cmp rcx, r15
je 0x1400d36bf
test byte [rcx + 0x1c], dil
je 0x1400d36bf
cmp byte [rcx + 0x19], r14b
jb 0x1400d36bf
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xb]
mov r9, rsi
mov r8, r12
call fcn.14000fcd0
lea r9, [rsp + 0xa0]
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
mov r8d, eax
test eax, eax
je 0x1400d373f
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400d37bd
test byte [rcx + 0x1c], dil
je 0x1400d37bd
movzx edx, byte [rcx + 0x19]
test ebx, ebx
mov eax, edi
cmovns eax, r14d
cmp edx, eax
jl 0x1400d37bd
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], r8d
mov edx, SafeArrayGetDim
mov r9d, ebx
mov r8, r12
call fcn.140011e38
jmp 0x1400d37bd
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x10]
cmp r9, 0x80
jbe 0x1400d377c
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400d3775
test byte [rcx + 0x1c], dil
je 0x1400d3775
cmp byte [rcx + 0x19], dil
jb 0x1400d3775
mov rcx, qword [rcx + 0x10]
call fcn.1400d34a8
mov ebx, 0x80004005
jmp 0x1400d37bd
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400d37a5
test byte [rcx + 0x1c], dil
je 0x1400d37a5
cmp byte [rcx + 0x19], r14b
jb 0x1400d37a5
mov rcx, qword [rcx + 0x10]
mov edx, reloc.Cabinet.dll_FCIDestroy
mov r8, r12
call fcn.14000fda0
mov rdx, qword [rsp + 0xa0]
mov rcx, rbp
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov rcx, qword [0x140148ea8]
cmp rcx, r15
je 0x1400d3811
test byte [rcx + 0x1c], 1
je 0x1400d3811
movzx eax, byte [rcx + 0x19]
test ebx, ebx
cmovns edi, r14d
cmp eax, edi
jl 0x1400d3811
test ebx, ebx
js 0x1400d37f5
movzx eax, word [rbp]
jmp 0x1400d37f8
or eax, 0xffffffff
mov rcx, qword [rcx + 0x10]
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov r9d, ebx
mov r8, r12
mov word [rsp + 0x20], ax
call fcn.1400d35b0
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400d382c
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x460
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov rax, qword [0x140148ea8]
lea rcx, [0x140148ea8]
mov edx, 5
cmp rax, rcx
je 0x1400d389f
test byte [rax + 0x1c], 1
je 0x1400d389f
cmp byte [rax + 0x19], dl
jb 0x1400d389f
mov rcx, qword [rax + 0x10]
lea r8, [0x1400091b8]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r9, rsi
mov dword [rsp + 0x20], ebp
call fcn.140033a78
mov rax, qword [0x140148ea8]
xor ebx, ebx
lea edi, [rbx + 2]
lea r12d, [rbx + 0x17]
cmp di, word [rsi]
je 0x1400d38bd
cmp r12w, word [rsi]
je 0x1400d38bd
mov ebx, 0x80070057
jmp 0x1400d3994
mov dword [rsp + 0x30], edi
and dword [rsp + 0x28], ebx
and qword [rsp + 0x20], rbx
lea r8, [rsp + 0x40]
mov r9d, 0x401
mov edx, 0x80
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
je 0x1400d3949
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
movzx ebx, ax
mov r9d, eax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov rax, qword [0x140148ea8]
lea rsi, [0x140148ea8]
cmp rax, rsi
je 0x1400d39d8
test byte [rax + 0x1c], dil
je 0x1400d399b
cmp byte [rax + 0x19], dil
jb 0x1400d399b
mov rcx, qword [rax + 0x10]
lea r8, [0x1400091b8]
mov edx, SafeArrayUnlock
call fcn.14000fd64
mov rax, qword [0x140148ea8]
jmp 0x1400d399b
test ebp, ebp
je 0x1400d3980
cmp r12w, word [rsi]
jne 0x1400d3980
lea rcx, [rsp + 0x40]
mov edx, 0x25
call qword [sym.imp.msvcrt.dll_strchr]
test rax, rax
je 0x1400d396a
mov byte [rax], bl
lea r8, [rsp + 0x40]
lea rdx, [0x1400d3a08]
mov rcx, r14
call fcn.1400157a0
jmp 0x1400d398d
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140043ce0
mov rax, qword [0x140148ea8]
lea rsi, [0x140148ea8]
cmp rax, rsi
je 0x1400d39d8
test byte [rax + 0x1c], 1
je 0x1400d39d8
movzx ecx, byte [rax + 0x19]
test ebx, ebx
mov edx, 5
cmovns edi, edx
cmp ecx, edi
jl 0x1400d39d8
mov rcx, qword [r14]
lea r8, [0x1400091b8]
mov edx, SafeArrayAccessData
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax + 0x10]
mov r9d, ebx
call fcn.1400170b0
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140001000
mov rbx, qword [rsp + 0x498]
add rsp, 0x460
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret