joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f65e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x68]
call fcn.0040efd0
nop
xor rcx, rcx
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5f66c9
nop
mov dword [rbp + 0x3c], 0
cmp qword [rbp + 0x68], 0
je 0x5f6627
mov rax, qword [rbp + 0x68]
mov eax, dword [rax - 4]
mov dword [rbp + 0x3c], eax
mov ecx, 0x2002
mov edx, dword [rbp + 0x3c]
add edx, edx
add edx, 2
movsxd rdx, edx
call sub.kernel32.dll_GlobalAlloc
mov qword [rbp + 0x48], rax
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_GlobalLock
mov qword [rbp + 0x40], rax
nop
mov dword [rbp + 0x38], 0
cmp qword [rbp + 0x68], 0
je 0x5f6668
mov rax, qword [rbp + 0x68]
mov eax, dword [rax - 4]
mov dword [rbp + 0x38], eax
mov rcx, qword [rbp + 0x68]
call fcn.00410600
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8d, dword [rbp + 0x38]
add r8d, r8d
add r8d, 2
movsxd r8, r8d
call fcn.00408d80
call sub.user32.dll_EmptyClipboard
mov ecx, 0xd
mov rdx, qword [rbp + 0x48]
call sub.user32.dll_SetClipboardData
nop
mov rcx, qword [rbp + 0x48]
call sub.kernel32.dll_GlobalUnlock
jmp 0x5f66c1
nop
call sub.user32.dll_CloseClipboard
jmp 0x5f66e6
mov rcx, qword [0x00426838]
mov dl, 1
mov r8, qword [0x007328c0]
call fcn.0043a9f0
mov rcx, rax
call fcn.0040e0b0
nop
lea rcx, [rbp + 0x68]
call fcn.0040ee40
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x5fdc00
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x005fdc54]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5fdc21
or bx, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5fdc35
or bx, 4
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x5fdc49
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x69c7f0
Capabilities:
Get keyboard layout

Disassembly:
push rbp
add rsp, 0xffffffffffffff80
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x90], rcx
nop
mov byte [0x0072c160], 0
mov word [rbp + 0x54], 0
lea rcx, [rbp + 0x54]
call sub.user32.dll_GetKeyboardLayoutNameW
mov rcx, qword [0x005724a0]
mov dl, 1
call fcn.00573bd0
mov qword [rbp + 0x70], rax
nop
mov rcx, qword [rbp + 0x70]
mov rdx, 0xffffffff80000002
call fcn.00573ea0
lea rcx, [rbp + 0x28]
lea rdx, [rbp + 0x54]
mov r8d, 0xa
call fcn.00410700
lea rcx, [rbp + 0x30]
lea rdx, [0x0069ca10]
mov r8, qword [rbp + 0x28]
call fcn.00410a60
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x30]
call fcn.005742b0
test al, al
je 0x69c92c
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x68]
lea r8, [0x0069ca84]
call fcn.00574fb0
mov rcx, qword [rbp + 0x68]
mov edx, 0x8000
call fcn.0043edc0
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
je 0x69c92c
nop
mov rcx, qword [rbp + 0x78]
lea rdx, [0x0069ca9c]
call fcn.0041ba00
mov qword [rbp + 0x40], rax
cmp qword [rbp + 0x40], 0
je 0x69c922
call qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x69c922
mov rcx, qword [rbp + 0x90]
call fcn.0069c760
test eax, eax
je 0x69c906
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
jmp 0x69c910
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 0x50]
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x50]
and eax, 1
cmp eax, 1
sete al
mov byte [0x0072c160], al
nop
mov rcx, qword [rbp + 0x78]
call sub.kernel32.dll_FreeLibrary_2
nop
mov rcx, qword [rbp + 0x70]
call fcn.0040bc10
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040ef20
lea rcx, [rbp + 0x68]
call fcn.0040ee40
lea rsp, [rbp + 0x80]
pop rbp
ret

Function at 0x69cb20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx bx, byte [rbp + 0x28]
test bx, bx
je 0x69cb7e
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x69cb59
add bx, 0x2000
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x69cb6e
add bx, 0x4000
mov eax, dword [rbp + 0x30]
test eax, 0x20000000
je 0x69cb7e
add bx, 0x8000
mov eax, ebx
lea rsp, [rbp + 0x48]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6ae590
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx rbx, word [0x006ae5f8]
mov eax, ecx
test ax, 4
je 0x6ae5aa
or bx, 1
mov eax, ecx
test ax, 8
je 0x6ae5b7
or bx, 4
mov eax, ecx
test ax, 1
je 0x6ae5c4
or bx, 8
mov eax, ecx
test ax, 2
je 0x6ae5d1
or bx, 0x10
test cx, 0x10
je 0x6ae5dc
or bx, 0x20
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6ae5f0
or bx, 2
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x6ae600
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x006ae650]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6ae624
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6ae638
or si, 4
test ebx, 0x20000000
je 0x6ae644
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6bcb80
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6bcdb2
mov rcx, qword [0x004d67a8]
mov dl, 1
call fcn.00508b80
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040ee40
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x6bcd8a
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.005ca1d0
test al, al
je 0x6bcd74
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x006bce44]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00432690
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x6bcd74
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006bceb2]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6bcd67
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00410700
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x6bcd67
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00410700
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x6bcc28
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.00508a30
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040ee40
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6be140
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x0073e488]
cmp byte [rax + 0x159], 0
jne 0x6be1e3
cmp qword [0x0073e4c0], 0
jne 0x6be186
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x0072e310]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x0073e4c0], rax
cmp qword [0x0073e4b8], 0
jne 0x6be1a8
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x0073e4b8], rax
cmp qword [0x0073e4c8], 0
jne 0x6be1e3
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x0072e308]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x0073e4c8], rax
add rsp, 0x48
ret

Function at 0x6bf430
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2d0], 0
je 0x6bf516
cmp dword [rbx + 0x128], 0
jne 0x6bf50c
mov rax, qword [rbx + 0x2d0]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006bf310]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6bf50c
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6bf4ba
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6bf50b
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.005013d0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6bf4cb
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6bf860
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x0073e488]
cmp qword [rax + 0x2d0], 0
je 0x6bfa3a
test sil, sil
jne 0x6bf959
cmp dword [rbx + 0x138], 0
jne 0x6bf94a
mov rcx, rbx
call fcn.006c3fa0
lea rcx, [0x006bf700]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6bf90c
mov rax, qword [0x0073e488]
cmp byte [rax + 0x193], 0
je 0x6bf90c
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6bf8e5
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6bf90b
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6bf8ed
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6bf949
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005013d0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6bf91d
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6bfa3a
cmp dword [rbx + 0x138], 0
jle 0x6bfa3a
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6bfa3a
cmp qword [rbx + 0xa8], 0
je 0x6bf9d9
mov rax, qword [0x0073e488]
cmp byte [rax + 0x193], 0
je 0x6bf9d9
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6bf9af
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6bf9d8
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6bf9b7
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6bfa16
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.005013d0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6bf9ea
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006a97b8]
call fcn.00412490
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6c0c40
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6c0caf
cmp byte [rbx + 0x193], 0
jne 0x6c0caf
mov rcx, qword [rbx + 0x2d0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.0040f100
xor rax, rax
cmp qword [rsi], 0
je 0x6c0c9a
mov rax, qword [rsi]
mov eax, dword [rax - 4]
test eax, eax
jne 0x6c0cbe
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040f470
jmp 0x6c0cbe
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040f470
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6cd450
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6cd506
mov rcx, qword [rbx + 0x10]
call fcn.005c0370
mov rcx, qword [0x005d34f0]
mov dl, 1
mov r8, rax
call fcn.005b7180
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005da220
lea rax, [rsi + 0x4a8]
mov qword [rax + 8], rbx
lea rcx, [0x006ccac0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005c0370
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005c0370
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6cd5b1
mov rcx, qword [rbx + 0x10]
call fcn.005c0370
mov rcx, qword [0x005d34f0]
mov dl, 1
mov r8, rax
call fcn.005b7180
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005da220
lea rax, [rsi + 0x4a8]
mov qword [rax + 8], rbx
lea rcx, [0x006ccb20]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005c0370
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005c0370
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6cd64d
mov rcx, qword [rbx + 0x10]
call fcn.005c0370
mov rcx, qword [0x005d44b8]
mov dl, 1
mov r8, rax
call fcn.005b7180
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x478], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005c0370
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005c0370
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x6d4280
Capabilities:
Access the windows event log

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov dword [rbp + 0x58], r8d
mov word [rbp + 0x5e], r9w
mov qword [rbp + 0x88], rdx
mov rcx, qword [rbp + 0x88]
call fcn.0040efd0
nop
mov rcx, qword [rbp + 0x88]
call fcn.00410600
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x50]
cmp dword [rax + 0x10], 0
jne 0x6d42e2
mov rax, qword [rbp + 0x50]
mov rcx, qword [rax + 8]
call fcn.00410600
xor rcx, rcx
mov rdx, rax
call sub.advapi32.dll_RegisterEventSourceW
mov rcx, qword [rbp + 0x50]
mov dword [rcx + 0x10], eax
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 0x10]
mov edx, dword [rbp + 0x58]
movzx r8, word [rbp + 0x5e]
mov r9d, dword [rbp + 0xa0]
mov qword [rsp + 0x20], 0
mov word [rsp + 0x28], 1
mov dword [rsp + 0x30], 0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
call sub.advapi32.dll_ReportEventW
nop
lea rcx, [rbp + 0x88]
call fcn.0040ee40
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x6d5ef0
Capabilities:
Create service

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0xd0
mov rbp, rsp
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0x98], rbp
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x108], rdx
mov qword [rbp + 0x110], r8
nop
lea rcx, [rbp + 0xa0]
xor rdx, rdx
call fcn.004090c0
mov rax, qword [rbp + 0x108]
cmp qword [rax + 0x128], 0
je 0x6d5f79
mov rax, qword [rbp + 0x108]
lea rbx, [rax + 0x128]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x108]
call qword [rbx]
mov rax, qword [rbp + 0x108]
mov eax, dword [rax + 0x118]
mov dword [rbp + 0xbc], eax
cmp dword [rbp + 0xbc], 0
jbe 0x6d5fa5
lea rax, [rbp + 0xbc]
mov qword [rbp + 0xb0], rax
jmp 0x6d5fb0
mov qword [rbp + 0xb0], 0
mov rax, qword [rbp + 0x108]
cmp qword [rax + 0xf8], 0
jne 0x6d5fce
mov qword [rbp + 0xa8], 0
jmp 0x6d5fe8
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax + 0xf8]
call fcn.00410600
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax + 0x10]
call fcn.00410600
mov qword [rbp + 0x78], rax
mov rcx, qword [rbp + 0x108]
lea rdx, [rbp + 0x90]
call fcn.006d4e20
mov rcx, qword [rbp + 0x90]
call fcn.00410600
mov qword [rbp + 0x80], rax
mov rcx, qword [rbp + 0x108]
call fcn.006d51e0
mov dword [rbp + 0x70], eax
mov rcx, qword [rbp + 0x108]
call fcn.006d5240
mov dword [rbp + 0x74], eax
mov rcx, qword [rbp + 0x108]
call fcn.006d52a0
mov ebx, eax
mov rcx, qword [rbp + 0xa0]
call fcn.00410600
mov rsi, rax
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax + 0xe0]
call fcn.00410600
mov rdi, rax
mov rcx, qword [rbp + 0x108]
lea rdx, [rbp + 0x88]
call fcn.006d50b0
mov rcx, qword [rbp + 0x88]
call fcn.00410600
mov r13, rax
mov rax, qword [rbp + 0x108]
mov rcx, qword [rax + 0xf0]
call fcn.00410600
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x78]
mov r8, qword [rbp + 0x80]
mov r9d, 0xf01ff
mov r10d, dword [rbp + 0x70]
mov dword [rsp + 0x20], r10d
mov r10d, dword [rbp + 0x74]
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov r10, qword [rbp + 0xb0]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x50], r13
mov r10, qword [rbp + 0xa8]
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x60], rax
call sub.advapi32.dll_CreateServiceW
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0x108]
mov ecx, dword [rbp + 0xbc]
mov dword [rax + 0x118], ecx
cmp qword [rbp + 0xc8], 0
jne 0x6d6131
call fcn.0043d9f0
nop
nop
mov rax, qword [rbp + 0x108]
cmp qword [rax + 0x138], 0
je 0x6d6183
mov rax, qword [rbp + 0x108]
lea rbx, [rax + 0x138]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x108]
call qword [rbx]
jmp 0x6d6183
nop
mov rcx, qword [rbp + 0xc8]
call sub.advapi32.dll_CloseServiceHandle
nop
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040ef20
lea rcx, [rbp + 0xa0]
call fcn.0040ee40
lea rsp, [rbp + 0xd0]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x6d6260
Capabilities:
Delete service

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov qword [rbp + 0x70], r8
mov rax, qword [rbp + 0x68]
cmp qword [rax + 0x148], 0
je 0x6d629c
mov rax, qword [rbp + 0x68]
lea rbx, [rax + 0x148]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x68]
call qword [rbx]
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax + 0x10]
call fcn.00410600
mov rcx, qword [rbp + 0x70]
mov rdx, rax
mov r8d, 0xf01ff
call sub.advapi32.dll_OpenServiceW
mov qword [rbp + 0x38], rax
cmp qword [rbp + 0x38], 0
jne 0x6d62cc
call fcn.0043d9f0
nop
mov rcx, qword [rbp + 0x38]
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x6d62df
call fcn.0043d9f0
nop
mov rcx, qword [rbp + 0x38]
call sub.advapi32.dll_CloseServiceHandle
mov rax, qword [rbp + 0x68]
cmp qword [rax + 0x158], 0
je 0x6d630c
mov rax, qword [rbp + 0x68]
lea rbx, [rax + 0x158]
mov rcx, qword [rbx + 8]
mov rdx, qword [rbp + 0x68]
call qword [rbx]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret

Function at 0x6d99a0
Capabilities:
Initialize winsock library

Disassembly:
push rbp
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x38], 0
nop
mov cx, 0x101
lea rdx, [0x0073e4f0]
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x6d9a1e
lea rcx, [rbp + 0x38]
mov edx, ebx
call fcn.00438ad0
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], 0x11
mov dword [rbp + 0x50], ebx
mov byte [rbp + 0x58], 0
lea rax, [0x006d9a60]
mov qword [rbp + 0x60], rax
mov byte [rbp + 0x68], 0x11
mov rcx, qword [0x006d7590]
mov dl, 1
mov r8, qword [0x00733240]
lea r9, [rbp + 0x40]
mov dword [rsp + 0x20], 2
call fcn.0043abb0
mov rcx, rax
call fcn.0040e0b0
nop
lea rcx, [rbp + 0x38]
call fcn.0040ee40
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret

Function at 0x6da590
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x30
mov rbp, rsp
mov rbx, rcx
xor rsi, rsi
xor rax, rax
movzx rcx, byte [rbx + 0x40]
cmp cl, byte [0x006da604]
je 0x6da5be
mov esi, 0x401
mov rcx, rbx
call fcn.006da780
mov rcx, qword [rbx + 8]
mov rdx, rax
mov r8d, esi
movzx r9, byte [rbx + 0x40]
call sub.wsock32.dll_WSAAsyncSelect
movzx rax, byte [rbx + 0x40]
cmp al, byte [0x006da604]
jne 0x6da5f9
mov dword [rbp + 0x2c], 0
mov rcx, qword [rbx + 8]
mov edx, 0x8004667e
lea r8, [rbp + 0x2c]
call sub.wsock32.dll_ioctlsocket
lea rsp, [rbp + 0x30]
pop rbx
pop rsi
pop rbp
ret

Function at 0x6da6d0
Capabilities:
Connect socket

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, rbx
call fcn.006da590
mov rcx, rbx
or edx, 0xffffffff
call fcn.0040c1a0
mov rsi, rax
mov rcx, rbx
mov rdx, rbx
mov r8b, 1
call rsi
mov rcx, qword [rbx + 8]
lea rdx, [rbx + 0x30]
mov r8d, 0x10
call sub.wsock32.dll_connect
mov ecx, eax
lea rdx, [0x006da764]
call fcn.006d9890
mov byte [rbx + 0x41], 0
movzx rax, byte [rbx + 0x40]
test al, 0x10
jne 0x6da74e
cmp qword [rbx + 8], 0xffffffffffffffff
setne al
mov byte [rbx + 0x10], al
mov rcx, rbx
or edx, 0xffffffff
call fcn.0040c1a0
mov rsi, rax
mov rcx, rbx
mov rdx, rbx
mov r8b, 2
call rsi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6da7c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x68], rdx
mov rcx, qword [rbp + 0x60]
call fcn.006da310
nop
mov rcx, qword [rbp + 0x68]
call fcn.0040ee40
mov rax, qword [rbp + 0x60]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x6da832
mov dword [rbp + 0x3c], 0x10
mov rax, qword [rbp + 0x60]
mov rcx, qword [rax + 8]
lea rdx, [rbp + 0x40]
lea r8, [rbp + 0x3c]
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x6da826
mov ecx, dword [rbp + 0x44]
call sub.wsock32.dll_inet_ntoa
mov rcx, qword [rbp + 0x68]
mov rdx, rax
call fcn.00410670
nop
mov rcx, qword [rbp + 0x60]
call fcn.006da330
jmp 0x6da83e
xor rcx, rcx
mov rdx, qword [rbp + 0x28]
call fcn.006da850
mov rax, qword [rbp + 0x68]
lea rsp, [rbp + 0x50]
pop rbp
ret

Function at 0x6dad90
Capabilities:
Resolve dns

Disassembly:
push rbp
push rbx
sub rsp, 0x48
mov rbp, rsp
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x28], 0
nop
lea rcx, [rbp + 0x28]
mov rdx, qword [rbp + 0x20]
xor r8, r8
call fcn.00410140
mov rcx, qword [rbp + 0x28]
call fcn.0040ff00
mov rcx, rax
call sub.wsock32.dll_gethostbyname
mov rbx, rax
lea rcx, [rbp + 0x38]
mov edx, 4
xor r8, r8
call fcn.0040aa60
test rbx, rbx
je 0x6dae1c
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rax, byte [rax]
mov byte [rbp + 0x38], al
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rax, byte [rax + 1]
mov byte [rbp + 0x39], al
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rax, byte [rax + 2]
mov byte [rbp + 0x3a], al
mov rax, qword [rbx + 0x18]
mov rax, qword [rax]
movzx rax, byte [rax + 3]
mov byte [rbp + 0x3b], al
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x3c], eax
nop
lea rcx, [rbp + 0x28]
call fcn.0040ee90
mov eax, dword [rbp + 0x3c]
lea rsp, [rbp + 0x48]
pop rbx
pop rbp
ret