joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c840
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x14001ca80
cmp byte [rcx + 0x71], 0
je 0x14001ca80
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
jne 0x14001c88b
xor al, al
jmp 0x14001ca82
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r14d, r14d
mov r9, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, rcx
lea r8, [rbp - 0x28]
cmovae r8, rcx
mov rcx, qword [rdi + 0x68]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x18]
add r9, rdx
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x74]
call qword [r10 + 0x40]
test eax, eax
je 0x14001c902
sub eax, 1
jne 0x14001c9fe
jmp 0x14001c906
mov byte [rdi + 0x71], r14b
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, rcx
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x14001c957
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, rcx
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.1400e8618
mov r9, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x28]
cmp rbx, rax
jne 0x14001ca0b
cmp byte [rdi + 0x71], r14b
je 0x14001ca29
test rbx, rbx
jne 0x14001c8c0
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x14001ca1c
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x14001ca0f
cmp r9, rbx
jae 0x14001c9a8
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140007250
mov r9, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x28]
jmp 0x14001c9c5
test rbx, rbx
jne 0x14001c9ce
mov qword [rbp - 0x18], r14
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, rcx
mov byte [rax], r14b
jmp 0x14001c8b8
test rbx, rbx
je 0x14001c8c0
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, rcx
mov rax, qword [rbp - 0x18]
xor ecx, ecx
mov qword [rax + rdx], rcx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rbx + rax], cl
jmp 0x14001c8b8
sub eax, 2
mov r9, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x28]
je 0x14001ca29
xor bl, bl
jmp 0x14001ca2b
lea rcx, str.string_too_long
call fcn.14007e074
int3
lea rcx, str.string_too_long
call fcn.14007e074
int3
mov bl, 1
cmp r9, 0x10
jb 0x14001ca7b
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x14001ca76
test byte [rbp - 0x28], 0x1f
je 0x14001ca49
call fcn.1400e462c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001ca58
call fcn.1400e462c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001ca67
call fcn.1400e462c
int3
cmp rcx, 0x27
jbe 0x14001ca73
call fcn.1400e462c
int3
mov rcx, rax
call fcn.14007b800
movzx eax, bl
jmp 0x14001ca82
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400253a0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r8, rcx
mov r9d, 4
nop dword [rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + r8]
xor byte [r8], al
inc r8
sub rcx, 1
jne 0x1400253e0
sub r9, 1
jne 0x1400253d0
lea rdi, [rsi + 0x10]
lea ebp, [rcx + 0xd]
lea r14, str.cw
nop word [rax + rax]
mov r8, rbx
mov r9d, 4
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140025430
inc r8
sub r9, 1
jne 0x140025420
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 5]
mov byte [rbx + 1], al
movzx eax, byte [rbx + 9]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 7], cl
mov rcx, rbx
mov byte [rbx + 0xb], al
call fcn.140025cc0
mov rax, rbx
mov r8d, 4
nop dword [rax]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x1400254d0
sub r8, 1
jne 0x1400254c0
add rdi, 0x10
sub rbp, 1
jne 0x140025410
mov r8, rbx
lea r9d, [rdx + 4]
nop word [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140025510
inc r8
sub r9, 1
jne 0x140025500
movzx eax, byte [rbx + 5]
lea edx, [r9 + 4]
movzx ecx, byte [rbx + 1]
mov byte [rbx + 1], al
movzx eax, byte [rbx + 9]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xb], al
mov byte [rbx + 7], cl
nop word [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + rbx + 0xe0]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400255a0
sub rdx, 1
jne 0x140025590
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400255e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140025620
sub r9, 1
jne 0x140025610
mov bpl, reloc.WS2_32.dll_listen
lea rdi, [rsi + 0xd0]
lea r14, [0x14012f0c0]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400256c0
inc r8
sub r9, 1
jne 0x1400256b0
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140025700
sub r8, 1
jne 0x1400256f0
mov rcx, rbx
call fcn.140025800
sub rdi, 0x10
add bpl, 0xff
jne 0x140025650
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400257a0
inc r8
sub r9, 1
jne 0x140025790
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400257d0
sub rdx, 1
jne 0x1400257c2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140025800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x140025830
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140025cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
lea rax, [rcx + 2]
mov ebp, 4
nop dword [rax]
movzx esi, byte [rax - 2]
movzx r9d, byte [rax - 1]
movzx r8d, sil
movzx edi, byte [rax + 1]
xor r8b, r9b
movzx r11d, byte [rax]
lea rax, [rax + 4]
movzx ecx, r8b
movzx r10d, dil
shr cl, 7
add r8b, r8b
movzx ecx, cl
xor r10b, r11b
imul edx, ecx, 0x1b
movzx ebx, r10b
xor bl, sil
xor bl, r9b
xor dl, r8b
movzx r8d, r9b
xor dl, sil
xor r8b, r11b
xor dl, bl
movzx ecx, r8b
mov byte [rax - 6], dl
xor sil, dil
shr cl, 7
add r8b, r8b
movzx ecx, cl
imul edx, ecx, 0x1b
movzx ecx, r10b
shr cl, 7
add r10b, r10b
movzx ecx, cl
xor dl, r8b
xor dl, r9b
xor dl, bl
mov byte [rax - 5], dl
imul edx, ecx, 0x1b
movzx ecx, sil
shr cl, 7
add sil, sil
movzx ecx, cl
xor dl, r10b
xor dl, r11b
xor dl, bl
mov byte [rax - 4], dl
imul edx, ecx, 0x1b
xor dl, sil
xor dl, dil
xor dl, bl
mov byte [rax - 3], dl
sub rbp, 1
jne 0x140025ce0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x1400279f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor r8d, r8d
mov dword [rbp - 0x18], 0x7761626f
mov qword [rcx + 0x10], r8
mov rbx, rcx
mov dword [rbp - 0x14], 0x636a616f
mov dword [rbp - 8], 0x6c6d7365
mov dword [rbp - 4], 0x637370
mov dword [rbp - 0x10], 0x616c6467
mov dword [rbp - 0xc], 0x6d6b6371
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r8b
mov dword [rbp - 0x20], r8d
cmp byte [rbp - 0x18], r8b
je 0x140027a5a
lea rax, [rbp - 0x18]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140027a50
lea rdx, [rbp - 0x18]
call fcn.1400080d0
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x140027a80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
xor r8d, r8d
mov dword [rsp + 0x28], 0x35313631
mov qword [rcx + 0x10], r8
mov rbx, rcx
mov dword [rsp + 0x2c], 0x39383932
mov word [rsp + 0x31], gethostname
mov byte [rsp + 0x30], 0x33
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r8b
mov dword [rsp + 0x20], r8d
cmp byte [rsp + 0x28], r8b
je 0x140027ada
lea rax, [rsp + 0x28]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140027ad0
lea rdx, [rsp + 0x28]
call fcn.1400080d0
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140027f00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], 0
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x140027f3e
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140027fa0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x140027fa0
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x140027f80
mov r8d, eax
mov rcx, rbx
call fcn.1400144a0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140029180
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov dword [rax + 0x10], 4
mov dword [rax + 8], 4
mov edx, reloc.WS2_32.dll_recvfrom
lea rcx, [rax - 0x40]
call fcn.1400244d0
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x1400291bb
mov rdi, qword [rax]
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x1400291d3
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x98], rbx
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14002922c
test rdi, 0xffffffffffff0000
jne 0x14002921d
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b6e0
test rax, rax
je 0x140029249
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.14000bf00
jmp 0x140029241
mov rax, rsi
inc rax
cmp word [rdi + rax*2], 0
jne 0x140029220
jmp 0x14002922e
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.1400144a0
mov rbx, qword [rsp + 0x98]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
lea r8, [0x14012f528]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14002929a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1400292b7
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.1400146a0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400292d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov dword [rax + 0x10], 4
mov dword [rax + 8], 4
mov edx, reloc.WS2_32.dll_select
lea rcx, [rax - 0x40]
call fcn.1400244d0
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x14002930b
mov rdi, qword [rax]
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x140029323
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x98], rbx
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14002937c
test rdi, 0xffffffffffff0000
jne 0x14002936d
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b6e0
test rax, rax
je 0x140029399
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.14000bf00
jmp 0x140029391
mov rax, rsi
inc rax
cmp word [rdi + rax*2], 0
jne 0x140029370
jmp 0x14002937e
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x98]
call fcn.1400144a0
mov rbx, qword [rsp + 0x98]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
lea r8, [0x14012f528]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400293ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x140029407
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.1400146a0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140029420
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov dword [r11 + 0x20], r9d
mov qword [r11 + 0x18], r8
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, r8
lea rax, [r11 + 0x18]
mov r14, rdx
mov qword [r11 - 0x48], rax
mov rdx, qword [rdx]
xor ebp, ebp
xor r8d, r8d
mov qword [r11 + 0x18], rbp
mov r9d, 0x20206
mov rdi, rcx
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400294ab
cmp eax, 2
jne 0x1400294ee
mov rdx, qword [r14]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov rcx, rdi
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400294ee
mov r8, qword [rsi]
lea rax, [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
lea rdx, [0x14012f528]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rcx, qword [rsp + 0x80]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [r14]
test ebx, ebx
sete dil
sub rdx, 0x18
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029513
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14002952e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov rbx, qword [rsp + 0x70]
movzx eax, dil
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14002a0f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov r14, rcx
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rsp + 0x40]
call fcn.1400244d0
mov rsi, rax
cmp qword [rax + 0x18], 8
jb 0x14002a126
mov rsi, qword [rax]
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x14002a13e
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
or rdi, 0xffffffffffffffff
test rsi, rsi
je 0x14002a191
test rsi, 0xffffffffffff0000
jne 0x14002a182
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.14000b6e0
test rax, rax
je 0x14002a1a8
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000bf00
jmp 0x14002a1a3
mov rax, rdi
inc rax
cmp word [rsi + rax*2], 0
jne 0x14002a185
jmp 0x14002a193
xor eax, eax
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400144a0
mov rbx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x14002a1c5
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.1400146a0
mov dword [rsp + 0xa8], 4
mov dword [rsp + 0x98], 0
mov dword [rsp + 0xa0], 4
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa8]
mov r8, qword [r14]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, [rbx - 0x18]
test eax, eax
mov eax, edi
je 0x14002a257
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a239
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14002a253
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
xor eax, eax
jmp 0x14002a28f
mov esi, dword [rsp + 0x98]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a272
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14002a28d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov eax, esi
add rsp, 0x68
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002a2a0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r14, rcx
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rax - 0x40]
call fcn.1400244d0
mov rdi, rax
cmp qword [rax + 0x18], 8
jb 0x14002a2dc
mov rdi, qword [rax]
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x14002a2f4
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x90], rbx
or rsi, 0xffffffffffffffff
test rdi, rdi
je 0x14002a34d
test rdi, 0xffffffffffff0000
jne 0x14002a33e
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b6e0
test rax, rax
je 0x14002a36a
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.14000bf00
jmp 0x14002a362
mov rax, rsi
inc rax
cmp word [rdi + rax*2], 0
jne 0x14002a341
jmp 0x14002a34f
xor eax, eax
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x90]
call fcn.1400144a0
mov rbx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x14002a387
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.1400146a0
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8, qword [r14]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a3cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [r14]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14002a3e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret