joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401d2e80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
sub rsp, 0x38
test byte [rcx + 8], 1
jne 0x1401d2e99
mov eax, 0xffffffea
add rsp, 0x38
ret
mov rcx, qword [rcx + 0x18]
lea r9, [rsp + 0x50]
xor eax, eax
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401d2ed0
mov eax, dword [rsp + 0x50]
sub eax, 8
neg eax
sbb eax, eax
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401d2ee4
mov eax, 0xffffffff
add rsp, 0x38
ret
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
add rsp, 0x38
ret

Function at 0x1401d30a0
Capabilities:
Connect pipe

Disassembly:
sub rsp, 0x28
movzx eax, byte [rcx + 8]
and al, 3
cmp al, 3
jne 0x1401d30e4
mov rcx, qword [rcx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1401d30dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
je 0x1401d30dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1401d30dd
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
xor eax, eax
add rsp, 0x28
ret
mov eax, 0xffffffea
add rsp, 0x28
ret

Function at 0x1401d30f0
Capabilities:
Create pipe

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1401d31fb
test byte [rcx + 8], 1
je 0x1401d3128
mov eax, 0xffffffea
mov rbx, qword [r11 + 8]
mov rsi, qword [r11 + 0x18]
add rsp, 0x60
pop rdi
ret
mov r8, rdi
lea rdx, str..pipe_s
lea rcx, [rsp + 0x40]
call fcn.1400032c0
nop
mov rcx, rax
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1401dcb30
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.VBoxRT.dll_public_virtual:_void___cdecl_RTCString::destructor_void____ptr64]
mov rcx, qword [0x140378c60]
mov rax, qword [rsp + 0x78]
test rax, rax
cmovne rcx, rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0x400
lea r9d, [rax + 1]
xor r8d, r8d
mov edx, 0x80003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1401d31c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1401d31c1
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
or byte [rbx + 8], 3
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
lea rcx, [rbx + 0x20]
mov rdx, rdi
call qword [sym.imp.VBoxRT.dll_public:_class_RTCString____ptr64___cdecl_RTCString::operator_char_const____ptr64____ptr64]
nop
lea rcx, [rsp + 0x78]
call fcn.1401dc450
nop
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1401d3540
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
sub rsp, 0x38
test byte [rcx + 8], 1
mov rsi, rdx
mov rbx, rcx
jne 0x1401d355f
mov eax, 0xffffffea
add rsp, 0x38
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rbp
lea rdx, [rsp + 0x60]
xor ebp, ebp
mov qword [rsp + 0x60], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401d35a8
cmp dword [rsp + 0x50], 8
je 0x1401d35c2
mov rbp, qword [rsp + 0x58]
mov eax, 0xffffffff
add rsp, 0x38
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1401d3597
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
test eax, eax
js 0x1401d36c2
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
cmp rdx, 0xffffffffffffffff
jne 0x1401d35e4
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCString::setNull_void____ptr64]
mov rbp, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x38
pop rsi
pop rbx
ret
inc rdx
mov qword [rsp + 0x30], rdi
call qword [sym.imp.VBoxRT.dll_public:_void___cdecl_RTCString::reserve_unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rsi
call qword [sym.imp.VBoxRT.dll_public:_char____ptr64___cdecl_RTCString::mutableRaw_void____ptr64]
mov rcx, qword [rsp + 0x60]
mov byte [rax + rcx], bpl
mov rcx, rsi
mov rdi, qword [rsp + 0x60]
call qword [sym.imp.VBoxRT.dll_public:_char____ptr64___cdecl_RTCString::mutableRaw_void____ptr64]
test rax, rax
je 0x1401d36b8
test rdi, rdi
je 0x1401d36b8
test byte [rbx + 8], 1
jne 0x1401d3640
mov rdi, qword [rsp + 0x30]
mov eax, 0xffffffea
mov rbp, qword [rsp + 0x58]
add rsp, 0x38
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x50]
mov r8d, edi
mov dword [rsp + 0x50], ebp
mov rdx, rax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401d367f
mov eax, dword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
sub rax, rdi
mov rdi, qword [rsp + 0x30]
neg rax
sbb eax, eax
add rsp, 0x38
pop rsi
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401d369f
mov rdi, qword [rsp + 0x30]
mov eax, 0xffffffff
mov rbp, qword [rsp + 0x58]
add rsp, 0x38
pop rsi
pop rbx
ret
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x58]
add rsp, 0x38
pop rsi
pop rbx
ret
mov rdi, qword [rsp + 0x30]
mov eax, 0xfffffffe
mov rbp, qword [rsp + 0x58]
add rsp, 0x38
pop rsi
pop rbx
ret
Function at 0x1401d36d0
Capabilities:
Read file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test rdx, rdx
je 0x1401d3765
test r8, r8
je 0x1401d3765
test byte [rcx + 8], 1
jne 0x1401d36f8
mov eax, 0xffffffea
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401d3732
mov eax, dword [rsp + 0x48]
cmp rax, rdi
je 0x1401d3758
lea eax, [rbx - 1]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401d374e
mov ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 0xfffffffe
add rsp, 0x30
pop rdi
ret

Function at 0x1401d3770
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
lea rsi, [0x140000000]
mov dword [rsp + 0x50], edi
mov rbx, rcx
nop
test byte [rbx + 8], 1
je 0x1401d3843
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x48]
mov r8d, 4
mov dword [rsp + 0x48], edi
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1401d37dd
cmp dword [rsp + 0x48], 4
je 0x1401d37f3
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je case.0x1401d380f.101
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
test eax, eax
js 0x1401d3848
mov edx, dword [rsp + 0x50]
test edx, edx
je 0x1401d3831
lea eax, [rdx - 0x64]
cmp eax, 6
ja case.0x1401d380f.101
cdqe
mov ecx, dword [rsi + rax*4 + 0x1d3858]
add rcx, rsi
jmp rcx
mov rcx, rbx
call fcn.1401da7f0
test eax, eax
jns 0x1401d3790
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov eax, 0xffffffea
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1401d3990
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
test byte [rcx + 8], 1
mov rdi, rdx
mov rbx, rcx
jne 0x1401d39b6
mov eax, 0xffffffea
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_public:_bool___cdecl_RTCString::isEmpty_void_const___ptr64]
mov rcx, rbx
test al, al
je 0x1401d39dc
mov rdx, 0xffffffffffffffff
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401d2e80
mov qword [rsp + 0x30], rsi
mov rsi, qword [rdi + 0x10]
mov rdx, rsi
call fcn.1401d2e80
test eax, eax
js 0x1401d3a08
mov rcx, rdi
call qword [sym.imp.VBoxRT.dll_public:_char_const____ptr64___cdecl_RTCString::c_str_void_const___ptr64]
mov r8, rsi
mov rcx, rbx
mov rdx, rax
call fcn.1401d3a20
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401d3a20
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test rdx, rdx
je 0x1401d3ab5
test r8, r8
je 0x1401d3ab5
test byte [rcx + 8], 1
jne 0x1401d3a48
mov eax, 0xffffffea
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 0x18]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1401d3a82
mov eax, dword [rsp + 0x48]
cmp rax, rdi
je 0x1401d3aa8
lea eax, [rbx - 1]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401d3a9e
mov ebx, 0xffffffff
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, eax
call qword [sym.imp.VBoxRT.dll_RTErrConvertFromWin32]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 0xfffffffe
add rsp, 0x30
pop rdi
ret

Function at 0x1401d48b0
Capabilities:
Get local ipv4 addresses
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x40]
mov rsi, rdx
mov rdi, rcx
test rax, rax
je 0x1401d49bf
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x1401d4921
mov ecx, 0x200010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
test rax, rax
je 0x1401d49bf
mov dword [rsp + 0x20], ebx
lea r9, str.HostDnsServiceWin:_failed_to_open_key_TcpipParameters__error__d__n
mov rcx, rax
jmp 0x1401d49af
xor ebx, ebx
xor ecx, ecx
cmp rbx, 2
jne 0x1401d4938
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
jmp 0x1401d4948
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, rax
test rax, rax
je 0x1401d4988
mov rax, qword [rdi + 0x40]
mov qword [rax + rbx*8 + 0x10], rcx
inc rbx
cmp rbx, 3
jb 0x1401d4923
mov rdx, rsi
mov rcx, rdi
call fcn.14008ae10
test eax, eax
js 0x1401d49c4
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1401d50b0
mov ecx, 0x200010
call qword [sym.imp.VBoxRT.dll_RTLogRelGetDefaultInstanceEx]
mov rbx, rax
test rax, rax
je 0x1401d49bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.HostDnsServiceWin:_failed_to_create_event__error__d__n
mov rcx, rbx
mov r8d, 0x20
lea edx, [r8 - 0x10]
call qword [sym.imp.VBoxRT.dll_RTLogLoggerEx]
mov eax, 0x80004005
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401d7360
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub rsp, 0x178
mov rax, qword [0x140445eb8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1401d7445
cmp dword [rsp + 0x44], 6
jb 0x1401d7445
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 1
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1401d7423
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.EnableLUA
lea rax, [rsp + 0x30]
mov dword [rsp + 0x34], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [rsp + 0x30], 1
sete al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401db5e0
add rsp, 0x178
ret
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401db5e0
add rsp, 0x178
ret
Function at 0x1401d9270
Capabilities:
Get routing table

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea rdx, str.D:_tinderboxawin_7.0_srcVBoxMain_src_serverwinNetIf_win.cpp
mov dword [rsp + 0x30], 0x4b0
mov ecx, 0x4b0
mov edi, 0xffffffff
call qword [sym.imp.VBoxRT.dll_RTMemAllocTag]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
cmp eax, 0x7a
jne 0x1401d92d4
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTMemFree]
mov ecx, dword [rsp + 0x30]
lea rdx, str.D:_tinderboxawin_7.0_srcVBoxMain_src_serverwinNetIf_win.cpp
call qword [sym.imp.VBoxRT.dll_RTMemAllocTag]
mov rbx, rax
test rax, rax
je 0x1401d9317
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetIpForwardTable]
test eax, eax
jne 0x1401d930e
mov edx, dword [rbx]
test edx, edx
je 0x1401d930e
lea rcx, [rbx + 4]
cmp dword [rcx], 0
je 0x1401d9304
inc eax
add rcx, 0x38
cmp eax, edx
jb 0x1401d92f3
jmp 0x1401d930e
mov ecx, eax
imul rax, rcx, 0x38
mov edi, dword [rax + rbx + 0x14]
mov rcx, rbx
call qword [sym.imp.VBoxRT.dll_RTMemFree]
mov rbx, qword [rsp + 0x38]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x1401dd270
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x140445eb8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.VBoxRT.dll_RTUtf16Len]
lea ecx, [rdi + 1]
mov edx, ecx
lea r8, [rax + 1]
add rcx, r8
cmp rcx, 0x104
jbe 0x1401dd2c6
xor eax, eax
jmp 0x1401dd2ef
mov ecx, 0x5c
add r8, r8
mov word [rsp + rdi*2 + 0x20], cx
lea rcx, [rsp + 0x20]
lea rcx, [rcx + rdx*2]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401db5e0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x1401dd5d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [0x14037a720]
xor edx, edx
lea r8d, [rsi + 1]
lea rcx, [0x14037a730]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x1401dd729
mov qword [rsp + 0x80], rsi
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x18]
lea rdx, str.ROOTCIMV2
lea rcx, [rsp + 0x88]
call fcn.1401dc8c0
nop
mov rdx, qword [0x140378c60]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
cmovne rdx, rcx
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x78]
mov rax, rbx
call qword [case.0x140010858.0]
mov ebx, eax
lea rcx, [rsp + 0x88]
call fcn.1401dc450
nop
test ebx, ebx
js 0x1401dd6ff
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 0xa]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov ebx, eax
test eax, eax
js 0x1401dd6da
mov rax, qword [rsp + 0x80]
mov qword [rdi], rax
jmp 0x1401dd70d
mov edx, ebx
lea rcx, str.CoSetProxyBlanket_failed:__Rhrc_n
call fcn.1401dd1e0
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010858.0]
jmp 0x1401dd70d
mov edx, ebx
lea rcx, str.ConnectServer_failed:__Rhrc_n
call fcn.1401dd1e0
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010858.0]
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov edx, eax
lea rcx, str.CoCreateInstance_failed:__Rhrc_n
call fcn.1401dd1e0
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401dde90
Capabilities:
Reference sql statements
Reference wmi statements

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x140445eb8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, r8
mov rax, rdx
mov r14, rcx
mov r8d, 0x32
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
je 0x1401de062
lea r8, [rsp + 0x60]
lea rdx, str.SELECT__FROM_Win32_NetworkAdapterConfiguration_WHERE_SettingID____ls_
lea rcx, [rsp + 0x58]
call fcn.14002d9e0
nop
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov rax, qword [r14]
mov rdi, qword [rax + 0xa0]
mov rbx, qword [0x140378c60]
mov rax, qword [rsp + 0x58]
test rax, rax
cmovne rbx, rax
lea r8, [rbp - 1]
lea rdx, [0x140378fd8]
lea rcx, [rsp + 0x48]
call fcn.1401dcb30
nop
mov r10, qword [0x140378c60]
mov rdx, qword [rsp + 0x48]
test rdx, rdx
cmovne r10, rdx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9d, [rbp + 0x30]
mov r8, rbx
mov rdx, r10
mov rcx, r14
mov rax, rdi
call qword [case.0x140010858.0]
mov ebx, eax
lea rcx, [rsp + 0x48]
call fcn.1401dc450
nop
test ebx, ebx
js 0x1401de046
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401de033
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], ebp
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x48]
lea edx, [rbp - 1]
lea r8d, [rbp + 1]
mov rax, qword [rax + 0x20]
call qword [case.0x140010858.0]
mov ebx, eax
mov dword [rsp + 0x20], reloc.OLEAUT32.dll_SafeArrayCreateVectorEx
mov r9d, dword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov edx, eax
lea rcx, str.netIfWinFindAdapterClassById:_IEnumWbemClassObject::Next____hr0x_x_pclsObj_p_uReturn_u_42_u_n
call fcn.1401dd1e0
test ebx, ebx
js 0x1401de01f
cmp dword [rsp + 0x40], ebp
je 0x1401de01a
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1401de01a
mov qword [rsi], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010858.0]
mov rdx, qword [rsi]
lea rcx, str.netIfWinFindAdapterClassById:_S_OK_and__p_n
call fcn.1401dd1e0
nop
lea rcx, [rsp + 0x58]
call fcn.1401dc450
nop
xor eax, eax
jmp 0x1401de0a9
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140010858.0]
jmp 0x1401de055
lea rcx, str.ExecQuery_returned_no_enumerator_n
call fcn.1401dd1e0
mov ebx, 0x80004005
jmp 0x1401de055
mov edx, ebx
lea rcx, str.ExecQuery_failed__0x_x__n
call fcn.1401dd1e0
nop
lea rcx, [rsp + 0x58]
call fcn.1401dc450
nop
jmp 0x1401de096
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x1401de070
mov ecx, eax
jmp 0x1401de079
movzx ecx, ax
or ecx, 0x80070000
mov ebx, 0x80004005
test ecx, ecx
cmovns ecx, ebx
mov ebx, ecx
mov r8d, ecx
mov edx, eax
lea rcx, str.StringFromGUID2_failed_winEr_u__hr0x_x_n
call fcn.1401dd1e0
mov r8, qword [rsi]
mov edx, ebx
lea rcx, str.netIfWinFindAdapterClassById:_0x_x_and__p_n
call fcn.1401dd1e0
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401db5e0
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401df940
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
jne 0x1401df965
mov eax, 0x80070057
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea rax, [rsp + 0x58]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NetLuidIndex
mov dword [rsp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dfa26
mov dword [rsp + 0x68], eax
lea r9, [rsp + 0x60]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x28], rax
lea rdx, str.IfType
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dfa26
xor eax, eax
mov qword [rbx], rax
movzx eax, word [rsp + 0x68]
mov word [rbx + 6], ax
movabs rax, 0xffff000000ffffff
and qword [rbx], rax
mov eax, dword [rsp + 0x30]
and eax, 0xffffff
shl rax, 0x18
or qword [rbx], rax
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
xor ecx, ecx
mov qword [rbx], rcx
test eax, eax
jle 0x1401dfa37
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1401e07e0
Capabilities:
Get local ipv4 addresses

Disassembly:
push rbx
push rsi
push r13
push r14
push r15
sub rsp, 0x40
xor esi, esi
mov dword [rsp + 0x70], 0x3c00
mov dword [rcx], esi
mov r13, rdx
mov dword [rdx], esi
mov r15, rcx
lea rdx, str.D:_tinderboxawin_7.0_srcVBoxHostDriversVBoxNetFltwincfgVBoxNetCfg.cpp
mov ecx, 0x3c00
call qword [sym.imp.VBoxRT.dll_RTMemAllocZTag]
mov r14, rax
test rax, rax
je 0x1401e0995
lea rax, [rsp + 0x70]
mov r9, r14
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rsi + 0x10]
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov ebx, eax
cmp eax, 0x6f
jne 0x1401e0882
mov rcx, r14
call qword [sym.imp.VBoxRT.dll_RTMemFree]
mov ecx, dword [rsp + 0x70]
lea rdx, str.D:_tinderboxawin_7.0_srcVBoxHostDriversVBoxNetFltwincfgVBoxNetCfg.cpp
call qword [sym.imp.VBoxRT.dll_RTMemAllocZTag]
mov r14, rax
test rax, rax
je 0x1401e0995
lea rax, [rsp + 0x70]
mov r9, r14
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [rsi + 0x10]
xor ecx, ecx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov ebx, eax
test ebx, ebx
jne 0x1401e0951
mov qword [rsp + 0x80], rbp
lea rcx, str.192.168.0.0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
call qword [sym.imp.WS2_32.dll_inet_addr]
mov r12d, eax
mov edi, esi
nop
mov edx, 0xff
xor ecx, ecx
call qword [sym.imp.VBoxRT.dll_RTRandU32Ex]
mov ebp, eax
lea rcx, str.probing__RTnaipv4_n
shl ebp, 0x10
or ebp, r12d
mov edx, ebp
call fcn.1401dd1e0
lea r8, [rsp + 0x78]
mov byte [rsp + 0x7c], sil
lea rdx, [0x1401dfa50]
mov dword [rsp + 0x78], ebp
mov rcx, r14
call fcn.1401df530
cmp byte [rsp + 0x7c], sil
je 0x1401e0903
inc edi
cmp edi, 0x180
jl 0x1401e08b0
jmp 0x1401e0925
mov edx, ebp
lea rcx, str.found_unused_net__RTnaipv4_n
call fcn.1401dd1e0
lea rcx, str.255.255.255.0
mov dword [r15], ebp
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [r13], eax
cmp dword [r15], esi
mov eax, 0x1004
mov rcx, r14
cmove ebx, eax
call qword [sym.imp.VBoxRT.dll_RTMemFree]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x80]
test ebx, ebx
je 0x1401e0986
jmp 0x1401e0968
mov edx, ebx
lea rcx, str.GetAdaptersAddresses_err___u__n
call fcn.1401dd1e0
mov rcx, r14
call qword [sym.imp.VBoxRT.dll_RTMemFree]
test ebx, ebx
jg 0x1401e097d
mov esi, ebx
mov eax, ebx
add rsp, 0x40
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
movzx esi, bx
or esi, 0x80070000
mov eax, esi
add rsp, 0x40
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret
mov eax, 0x8007000e
add rsp, 0x40
pop r15
pop r14
pop r13
pop rsi
pop rbx
ret