joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ce60
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x880
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x870], rax
lea r9, [0x140129da0]
lea r8, str.SYSTEMCurrentControlSetServices_sParameters
lea rcx, [rsp + 0x70]
xor ebx, ebx
mov edx, 0x400
mov dword [rsp + 0x50], ebx
call fcn.1400d9998
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14006cee6
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14006cf4e
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, str.Net_DF
xor r8d, r8d
mov dword [rsp + 0x54], 3
mov dword [rsp + 0x60], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14006cf3f
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14006cf4e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1400d4d90
add rsp, 0x880
pop rbx
ret
Function at 0x140071950
Capabilities:
Get file version info
Send data
Send data on socket

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x6e0], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov r12, rdx
mov rsi, rcx
mov byte [rsp + 0x28], 0
xor eax, eax
mov qword [rsp + 0x29], rax
mov byte [rsp + 0x31], al
xor r13d, r13d
mov word [rbp - 0x80], r13w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x7e]
call fcn.1400dd9f0
mov r8d, 0x104
lea rdx, [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140071b46
mov dword [rsp + 0x60], r13d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x140071b46
mov byte [rsp + 0x20], r13b
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov edx, edi
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.14001b1c0
nop
mov rbx, qword [rsp + 0x40]
mov r9, rbx
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x140071a36
jmp 0x140071b2a
mov qword [rsp + 0x68], r13
mov dword [rsp + 0x38], r13d
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x68]
lea rdx, [0x14012ed28]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140071b2a
cmp dword [rsp + 0x38], 0x34
jne 0x140071b2a
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x140071b2a
mov word [rsp + 0x28], 0x24
mov dword [rsp + 0x2e], reloc.WS2_32.dll_listen
mov dword [rsp + 0x2a], 0x55aa0000
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rbp + 0x191]
call fcn.1400dd9f0
mov rax, qword [rsp + 0x28]
mov qword [rbp + 0x190], rax
movzx eax, word [rsp + 0x30]
mov word [rbp + 0x198], ax
mov eax, dword [rdi + 8]
mov dword [rbp + 0x19a], eax
mov eax, dword [rdi + 0xc]
mov dword [rbp + 0x19e], eax
movzx eax, byte [rsi + 0x15e4]
mov byte [rbp + 0x1a2], al
mov eax, dword [rsi + 0x2a0]
mov dword [rbp + 0x1a3], eax
xor r9d, r9d
lea r8d, [r9 + 0x17]
lea rdx, [rbp + 0x190]
mov rcx, r12
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x140071b07
jmp 0x140071b2a
test rbx, rbx
je 0x140071b14
mov rcx, rbx
call fcn.1400d4d78
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov eax, 1
jmp 0x140071b48
test rbx, rbx
je 0x140071b37
mov rcx, rbx
call fcn.1400d4d78
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
xor eax, eax
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x6a0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140071e70
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x368]
sub rsp, 0x450
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov rsi, rcx
mov rdi, qword [0x140183698]
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x41]
call fcn.1400dd9f0
xor r9d, r9d
mov r8d, 0x400
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1400720a9
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
movzx eax, word [rsp + 0x48]
mov word [rsp + 0x38], ax
cmp cl, 0x24
jne 0x1400720a9
shr rcx, 0x10
cmp ecx, 0x20009202
je 0x140071fa0
mov byte [rdi + 0x169], 1
sub ecx, 0x20009206
je 0x140071f90
cmp ecx, 0x22
je 0x140071f83
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r8d, dword [rsp + 0x32]
lea rdx, str.Bad_data_type._Password_failed._Type_received:__08Xh.
lea rcx, [rsp + 0x20]
call fcn.140016060
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400720a9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x1400720a9
mov rcx, rsi
call fcn.140071b70
jmp 0x1400720a9
mov rdx, rsi
mov rcx, rdi
call fcn.140071950
jmp 0x1400720a9
mov eax, dword [rdi + 0x15e0]
cmp eax, dword [rsp + 0x46]
je 0x140071fec
test eax, eax
je 0x140071fec
mov byte [rdi + 0x169], 1
xor ebx, ebx
mov qword [rsp + 0x32], 0x55aa0001
mov word [rsp + 0x30], 0x24
xor r9d, r9d
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov byte [rdi + 0x169], 1
mov eax, ebx
jmp 0x1400720ab
call fcn.14006ce60
mov r12d, dword [rsp + 0x36]
test eax, eax
jne 0x14007205f
cmp r12d, 1
jb 0x14007205f
mov r8d, r12d
lea rdx, [rsp + 0x4a]
lea rcx, [rdi + 0x11e0]
call fcn.1400d5d30
lea r8, [rsp + 0x36]
lea rdx, [rdi + 0x11e0]
mov rcx, rdi
call fcn.14006cb30
xor ebx, ebx
mov qword [rsp + 0x32], 0x55aa0000
mov word [rsp + 0x30], 0x24
xor r9d, r9d
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov byte [rdi + 0x169], bl
cmp eax, 0xffffffff
setne bl
mov eax, ebx
jmp 0x1400720ab
mov r8, r12
lea rdx, [rdi + 0x11e0]
lea rcx, [rsp + 0x4a]
call fcn.1400e28d0
test eax, eax
jne 0x14007207d
cmp r12d, 1
jae 0x140072028
mov byte [rdi + 0x169], 1
mov qword [rsp + 0x32], 0x55aa0001
mov word [rsp + 0x30], 0x24
xor r9d, r9d
lea r8d, [r9 + 0xa]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
xor eax, eax
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.1400d4d90
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140074c50
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
xor eax, eax
mov rbx, rcx
xor ecx, ecx
mov qword [rsp + 0x30], rcx
lea r8d, [rcx + 3]
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x78], ecx
lea rcx, str..pipemsg_D66E1F7A_5D94_4645_9BA1_CF75474D4FAA
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x40000000
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [0x140183698]
mov qword [rcx + 0x178], rax
cmp rax, 0xffffffffffffffff
jne 0x140074cbf
xor eax, eax
add rsp, 0x60
pop rbx
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [0x140183698]
mov dword [rsp + 0x88], 3
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx + 0x178]
mov rdi, rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x88]
mov r8d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140074d25
cmp dword [rsp + 0x78], 4
je 0x140074d49
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140074d49
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140074e1f
mov rax, qword [rbx]
lea r9, [rsp + 0x78]
lea rdx, [rsp + 0x80]
mov ecx, dword [rax - 0x10]
lea rax, [rsp + 0x40]
mov r8d, 4
mov dword [rsp + 0x80], ecx
mov rcx, qword [0x140183698]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x178]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140074d92
cmp dword [rsp + 0x78], 4
je 0x140074db2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140074db2
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140074e1f
mov rax, qword [rbx]
cmp dword [rax - 8], 1
jle 0x140074dc6
mov edx, dword [rax - 0x10]
mov rcx, rbx
call fcn.140002b80
mov rcx, qword [0x140183698]
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rbx]
mov rcx, qword [rcx + 0x178]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140074dff
cmp dword [rsp + 0x78], 4
je 0x140074e2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140074e2c
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140074e2c
xor eax, eax
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
mov rcx, qword [0x140183698]
mov rcx, qword [rcx + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x60
pop rbx
ret
Function at 0x1400763a0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov r12, rdx
lea rdx, [0x1401317b0]
mov rcx, qword [rcx]
call fcn.1400d9d24
mov rdi, rax
test rax, rax
je 0x140076561
mov rbp, qword [0x140183698]
add rbp, 0x1630
lea r13, vtable.CLockMgr_class_CMutexWrapper_.0
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x38], 1
or ebx, 0xffffffff
cmp qword [rbp], 0
je 0x140076426
call qword [sym.imp.USER32.dll_InSendMessage]
mov ecx, 0x2710
test eax, eax
cmovne ebx, ecx
mov edx, ebx
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rbx, qword [r12]
cmp rbx, qword [r12 + 8]
je 0x140076544
nop word [rax + rax]
mov rax, qword [rbx]
mov ecx, dword [rax - 0x10]
lea edx, [rcx + rcx]
mov dword [rsp + 0x70], edx
mov rax, qword [rbx + 8]
mov ecx, dword [rax - 0x10]
add ecx, ecx
mov dword [rsp + 0x80], ecx
lea eax, [rcx + rdx + 0x11]
mov dword [rsp + 0x88], eax
mov r9, rdi
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x88]
call fcn.1400d6c94
mov r9, rdi
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x70]
call fcn.1400d6c94
mov r11, qword [rbx]
cmp dword [r11 - 8], 1
jle 0x1400764ad
mov edx, dword [r11 - 0x10]
mov rcx, rbx
call fcn.140001fb0
movsxd r8, dword [rsp + 0x70]
mov r9, rdi
mov edx, 1
mov rcx, qword [rbx]
call fcn.1400d6c94
mov r9, rdi
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x80]
call fcn.1400d6c94
mov r11, qword [rbx + 8]
cmp dword [r11 - 8], 1
jle 0x1400764f3
mov edx, dword [r11 - 0x10]
lea rcx, [rbx + 8]
call fcn.140001fb0
movsxd r8, dword [rsp + 0x80]
mov r9, rdi
mov edx, 1
mov rcx, qword [rbx + 8]
call fcn.1400d6c94
lea rcx, [rbx + 0x14]
mov r9, rdi
mov edx, 1
mov r8d, edx
call fcn.1400d6c94
lea rcx, [rbx + 0x10]
mov r9, rdi
mov edx, 4
lea r8d, [rdx - 3]
call fcn.1400d6c94
add rbx, 0x18
cmp rbx, qword [r12 + 8]
jne 0x140076440
mov rcx, rdi
call fcn.1400d79b4
nop
mov qword [rsp + 0x28], r13
mov rcx, qword [rbp]
test rcx, rcx
je 0x140076561
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140076580
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rbp, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x1400765f8
movzx esi, dx
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x14007660a
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400029f0
jmp 0x140076605
xor r8d, r8d
lea rcx, [rsp + 0x48]
call fcn.140002120
mov rbx, qword [rsp + 0x48]
test edi, edi
je 0x1400766b1
jns 0x14007661f
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140076641
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.1400020c0
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 8], 1
jle 0x140076659
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001fb0
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x1400766a6
cmp eax, dword [rbx - 0xc]
jg 0x1400766a6
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp dword [rbp + 0x188], ecx
je 0x1400766b1
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x48]
call fcn.140014000
jmp 0x1400766b1
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._sstray_flists.dat
lea rcx, [rsp + 0x48]
call fcn.14003bd50
lea rdx, [rbp + 0x208]
lea rcx, [rsp + 0x48]
call fcn.140075f30
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400766fa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140076710
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rbp, qword [0x140183698]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x14007678c
movzx esi, dx
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x14007679e
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400029f0
jmp 0x140076799
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140002120
mov rbx, qword [rsp + 0x40]
test edi, edi
je 0x140076845
jns 0x1400767b3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400767d5
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.1400020c0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x1400767ed
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140001fb0
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x14007683a
cmp eax, dword [rbx - 0xc]
jg 0x14007683a
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp dword [rbp + 0x188], ecx
je 0x140076845
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x40]
call fcn.140014000
jmp 0x140076845
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._sstray_flists.dat
lea rcx, [rsp + 0x40]
call fcn.14003bd50
lea rdx, [rbp + 0x208]
lea rcx, [rsp + 0x40]
call fcn.1400763a0
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14007688e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400768b0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rbp, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x140076928
movzx esi, dx
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x14007693a
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400029f0
jmp 0x140076935
xor r8d, r8d
lea rcx, [rsp + 0x48]
call fcn.140002120
mov rbx, qword [rsp + 0x48]
test edi, edi
je 0x1400769e1
jns 0x14007694f
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140076971
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.1400020c0
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 8], 1
jle 0x140076989
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001fb0
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x1400769d6
cmp eax, dword [rbx - 0xc]
jg 0x1400769d6
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp dword [rbp + 0x188], ecx
je 0x1400769e1
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x48]
call fcn.140014000
jmp 0x1400769e1
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._sstray_slists.dat
lea rcx, [rsp + 0x48]
call fcn.14003bd50
lea rdx, [rbp + 0x1e8]
lea rcx, [rsp + 0x48]
call fcn.140075f30
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140076a2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140076a40
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rbp, qword [0x140183698]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x140076abc
movzx esi, dx
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x140076ace
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400029f0
jmp 0x140076ac9
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.140002120
mov rbx, qword [rsp + 0x40]
test edi, edi
je 0x140076b75
jns 0x140076ae3
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140076b05
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.1400020c0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x140076b1d
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140001fb0
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x140076b6a
cmp eax, dword [rbx - 0xc]
jg 0x140076b6a
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp dword [rbp + 0x188], ecx
je 0x140076b75
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x40]
call fcn.140014000
jmp 0x140076b75
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, reloc.WS2_32.dll_select
lea rdx, str._sstray_slists.dat
lea rcx, [rsp + 0x40]
call fcn.14003bd50
lea rdx, [rbp + 0x1e8]
lea rcx, [rsp + 0x40]
call fcn.1400763a0
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140076bbe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140076be0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rbp, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea rcx, [0x14017bd30]
mov rdx, qword [0x14017bd30]
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rdx, [0x140129a38]
test rdx, 0xffffffffffff0000
jne 0x140076c58
movzx esi, dx
mov ecx, esi
call fcn.140002830
test rax, rax
je 0x140076c6a
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400029f0
jmp 0x140076c65
xor r8d, r8d
lea rcx, [rsp + 0x48]
call fcn.140002120
mov rbx, qword [rsp + 0x48]
test edi, edi
je 0x140076d11
jns 0x140076c7f
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140076ca1
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.1400020c0
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 8], 1
jle 0x140076cb9
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140001fb0
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400d4f10
test eax, eax
js 0x140076d06
cmp eax, dword [rbx - 0xc]
jg 0x140076d06
mov dword [rbx - 0x10], eax
cdqe
xor ecx, ecx
mov word [rbx + rax*2], cx
cmp dword [rbp + 0x188], ecx
je 0x140076d11
lea r8, str.SysWOW64
lea rdx, str.system32
lea rcx, [rsp + 0x48]
call fcn.140014000
jmp 0x140076d11
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov r8d, socket
lea rdx, str._sstray_devlists.dat
lea rcx, [rsp + 0x48]
call fcn.14003bd50
lea rdx, [rbp + 0x228]
lea rcx, [rsp + 0x48]
call fcn.140075f30
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140076d5a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret