joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009bf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14d, r9d
mov r12, r8
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov r15d, 1
add r12, rdi
mov ecx, eax
shl r15d, cl
and r15d, dword [0x1406be690]
cmp rdi, r12
jae 0x140009dfe
mov qword [rsp + 0x58], r13
mov r13d, r14d
and r13d, 8
mov qword [rsp + 0x50], rbp
test r13d, r13d
je 0x140009cfd
mov r10, qword [0x1403f2630]
mov rax, qword [r10 + 0xa8]
mov r9, qword [rax + 8]
test r9, r9
je 0x140009d04
mov r8, r12
mov rdx, rdi
mov rcx, r10
call r9
movsxd rbp, eax
test eax, eax
je 0x140009cfd
mov rbx, rbp
mov r8, rbx
test r15d, r15d
je 0x140009c99
mov rcx, qword [0x1403f2630]
mov rdx, rdi
call fcn.14002d640
jmp 0x140009cbc
mov r9, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
je 0x140009cbc
lea rcx, [0x1400fd128]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
cmp byte [0x1406bdf4e], 0
je 0x140009cef
mov r9, qword [0x1406be718]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
je 0x140009cef
lea rcx, [0x1400fd128]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea eax, [rbp - 1]
movsxd rcx, eax
add rdi, rcx
jmp 0x140009de8
mov r10, qword [0x1403f2630]
test r14b, 4
je 0x140009d2e
movzx edx, byte [rdi]
lea rcx, [0x1403f27f0]
call fcn.140004a60
test rax, rax
je 0x140009d2e
mov rdx, rsi
mov rcx, rax
call fcn.140009a40
jmp 0x140009de8
test r14b, 2
je 0x140009d4b
cmp byte [rdi], 0
jne 0x140009d4b
mov rdx, rsi
mov ecx, 0x20
call fcn.140009b60
jmp 0x140009de8
test r14b, 1
je 0x140009d6a
cmp byte [rdi], 0
jne 0x140009d6a
mov rdx, rsi
lea rcx, [0x1400fd130]
call fcn.140009a40
jmp 0x140009de8
test r14b, 0x10
je 0x140009db2
movzx eax, byte [rdi]
cmp al, 9
jne 0x140009d88
mov rdx, rsi
lea rcx, [0x1400fd134]
call fcn.140009a40
jmp 0x140009de8
cmp al, 0xa
jne 0x140009d9d
mov rdx, rsi
lea rcx, [0x1400fd138]
call fcn.140009a40
jmp 0x140009de8
cmp al, 0x5c
jne 0x140009db2
mov rdx, rsi
lea rcx, [0x1400fd13c]
call fcn.140009a40
jmp 0x140009de8
movsx ecx, byte [rdi]
test r15d, r15d
je 0x140009dc6
mov edx, ecx
mov rcx, r10
call fcn.14002d450
jmp 0x140009dcf
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_putc]
cmp byte [0x1406bdf4e], 0
je 0x140009de8
movsx ecx, byte [rdi]
mov rdx, qword [0x1406be718]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_putc]
inc rdi
cmp rdi, r12
jb 0x140009c42
mov r13, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x140009ef0
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
jne 0x140009f08
mov rdx, qword [0x1406be458]
lea rcx, str.NULL
jmp fcn.140009a40
mov r8d, edx
mov r9d, recv
mov rdx, rcx
mov rcx, qword [0x1406be458]
jmp fcn.140009bf0
Function at 0x14000acb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [0x1406bed38]
mov ebx, ecx
test rdx, rdx
je 0x14000acd0
lea rcx, [0x1406bdf50]
call fcn.1400254c0
lea rcx, [0x1406bdf50]
call fcn.140024b80
mov rcx, qword [0x1406be400]
call fcn.140010ad0
mov rcx, qword [0x1406be708]
call fcn.140010ad0
mov rcx, qword [0x1406be710]
call fcn.140010ad0
cmp byte [0x1406be6e2], 0
je 0x14000ad0e
call fcn.14002bbb0
test ebx, ebx
js 0x14000ad33
lea rax, str.Aborted
lea rcx, [0x1400fc680]
cmovne rcx, rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
call fcn.140008480
lea rcx, [0x1403f2758]
call fcn.140006f40
lea rcx, [0x1403f2778]
call fcn.140006f40
lea rcx, [0x1403f2798]
call fcn.140006f40
mov rcx, qword [0x1406be698]
call fcn.140010ad0
call fcn.14000c3b0
mov rcx, qword [0x1406be3b8]
call fcn.140010ad0
mov rcx, qword [0x1406be3d8]
call fcn.140010ad0
mov rcx, qword [0x1406be3c8]
call fcn.140010ad0
mov rcx, qword [0x1406be3d0]
call fcn.140010ad0
mov rcx, qword [0x1406be3e0]
call fcn.140010ad0
mov rcx, qword [0x1406be6f8]
call fcn.140010ad0
mov rcx, qword [0x1406be700]
call fcn.140010ad0
mov rcx, qword [0x1406be408]
call fcn.140010ad0
mov rcx, qword [0x1406be668]
call fcn.140010ad0
mov rcx, qword [0x1406be3e8]
call fcn.140010ad0
call fcn.1400192b0
mov ecx, dword [0x1406be6f0]
call fcn.14002c3b0
mov rcx, qword [0x1406bf158]
test rcx, rcx
je 0x14000ae11
mov edx, 1
call fcn.140003f30
mov qword [0x1406bf158], 0
mov ecx, dword [0x1406be410]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x14000f8e0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x20
test rcx, rcx
mov r14d, edx
mov esi, 1
lea rdx, [0x140010410]
cmovne rsi, rcx
lea rcx, [0x1406bf1a0]
call fcn.14000e9c0
mov rcx, rsi
test r14b, 0x20
je 0x14000f924
mov rax, qword [0x1406bf188]
mov edx, 1
call rax
jmp 0x14000f92d
mov rax, qword [0x1406bf180]
call rax
mov rdi, rax
test rax, rax
jne 0x14000f9ae
mov qword [rsp + 0x50], rbp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call fcn.140040d80
mov ebp, r14d
and ebp, 8
je 0x14000f981
lea rax, [fcn.140041690]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14000e2e0
lea rcx, fcn.140041690
mov rbx, rax
call fcn.14000e2d0
xchg qword [rax], rbx
mov rbx, qword [rsp + 0x48]
test r14b, 0x18
je 0x14000f999
mov r8, rsi
mov edx, 0x440
mov ecx, 5
call fcn.140040f40
test ebp, ebp
mov rbp, qword [rsp + 0x50]
je 0x14000f9ae
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rdi
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000f9c0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x20
test rcx, rcx
mov edi, 1
mov r14d, edx
cmovne rdi, rcx
mov rcx, rdi
test dl, 0x20
je 0x14000f9ed
mov edx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
jmp 0x14000f9f3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x14000fa74
mov qword [rsp + 0x50], rbp
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call fcn.140040d80
mov ebp, r14d
and ebp, 8
je 0x14000fa47
lea rax, [fcn.140041690]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14000e2e0
lea rcx, fcn.140041690
mov rbx, rax
call fcn.14000e2d0
xchg qword [rax], rbx
mov rbx, qword [rsp + 0x48]
test r14b, 0x18
je 0x14000fa5f
mov r8, rdi
mov edx, 0x440
mov ecx, 5
call fcn.140040f40
test ebp, ebp
mov rbp, qword [rsp + 0x50]
je 0x14000fa74
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, rsi
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1400127f0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1406bd868]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x1406c31f8]
test rax, rax
jne 0x1400128a7
movzx eax, word [0x1400fe86c]
lea r8, [rsp + 0x22]
mov word [rsp + 0x20], ax
mov edx, 0x1004
movzx eax, byte [0x1400fe86e]
mov ecx, 0x800
mov byte [rsp + 0x22], al
xor eax, eax
mov dword [rsp + 0x23], eax
mov word [rsp + 0x27], ax
mov byte [rsp + 0x29], al
lea r9d, [rax + 7]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor edx, edx
lea r8, [rsp + 0x20]
mov eax, edx
lea r9, str.cp932
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
cmp cl, byte [r9 + rax - 1]
jne 0x140012887
cmp rax, 6
jne 0x140012870
jmp 0x14001288c
sbb edx, edx
or edx, 1
test edx, edx
lea rcx, [0x140531a70]
lea rax, [0x1403f6e80]
cmove rax, rcx
mov qword [0x1406c31f8], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400f2410
add rsp, 0x48
ret
Function at 0x140014240
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
lea rcx, str.LIBMYSQL_PLUGINS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea rcx, str.LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140014296
movsx edx, byte [rax]
lea rcx, [0x1400fe9bc]
call sub.VCRUNTIME140.dll_strchr
movzx ecx, byte [0x1406c3270]
test rax, rax
mov edx, 1
cmovne ecx, edx
mov byte [0x1406c3270], cl
test rbx, rbx
je 0x140014307
mov ecx, dword [0x1406c3204]
mov r8d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rbp
mov rdx, rbx
mov qword [rsp + 0x38], rdi
call fcn.140010b80
mov rdi, rax
mov rbp, rax
nop
mov edx, 0x3b
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
xor r9d, r9d
mov rbx, rax
mov rdx, rdi
mov rcx, rsi
lea r8d, [r9 - 1]
test rax, rax
je 0x1400142f0
mov byte [rax], r9b
call fcn.1400147d0
lea rdi, [rbx + 1]
jmp 0x1400142c0
call fcn.1400147d0
mov rcx, rbp
call fcn.140010ad0
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x1400178c0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.USER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea rdx, str.ODBC
mov r8d, 0x60
test rax, rax
mov rcx, rbx
cmovne rdx, rax
add rsp, 0x20
pop rbx
jmp fcn.14002b5b0

Function at 0x140019310
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp byte [0x1406c3268], bl
jne 0x1400193fe
movzx eax, byte [0x1406c34b8]
mov byte [0x1406c3269], al
mov byte [0x1406c3268], 1
call fcn.14002c4c0
test al, al
jne 0x1400193f3
call fcn.140065380
call fcn.1400144a0
test eax, eax
jne 0x1400193f3
call fcn.14006f8a0
cmp dword [0x1406c3278], ebx
jne 0x1400193bb
lea rdx, [0x1400feb20]
mov dword [0x1406c3278], 0xcea
lea rcx, str.mysql
call qword [sym.imp.WS2_32.dll_getservbyname]
test rax, rax
je 0x14001939a
movzx ecx, word [rax + 0x18]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [0x1406c3278], eax
lea rcx, str.MYSQL_TCP_PORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400193bb
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x1406c3278], eax
cmp qword [0x1406c3280], rbx
jne 0x140019406
lea rax, str.MySQL
lea rcx, str.MYSQL_UNIX_PORT
mov qword [0x1406c3280], rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140019406
mov qword [0x1406c3280], rax
mov eax, ebx
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
call fcn.140040df0
movzx ebx, al
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140021d30
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, [0x1400ff718]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140021d60
lea rdx, str.Windows_NT
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140021d60
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14002b170
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1406bd868]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r8
mov rdi, rdx
mov r15, rcx
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov rbx, qword [rcx]
mov r8, qword [rbx + 8]
mov rdx, rcx
call fcn.14002a420
mov qword [rbx + 8], rbx
mov qword [rbx], rbx
mov qword [rbx + 0x10], rbx
mov qword [r15 + 8], r12
lea edx, [r12 + 0x21]
mov qword [rsp + 0x28], r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call sub.DNSAPI.dll_DnsQuery_A
mov r14d, eax
test eax, eax
jne 0x14002b2cd
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x14002b2b7
nop dword [rax + rax]
cmp word [rbx + 0x10], 0x21
jne 0x14002b2a6
movzx edi, word [rbx + 0x2a]
movzx esi, word [rbx + 0x28]
movzx ebp, word [rbx + 0x2c]
mov rdx, qword [rbx + 0x20]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14002b240
lea rcx, [rsp + 0x38]
call fcn.140004a90
nop
mov dword [rsp + 0x20], edi
mov r9d, esi
mov r8d, ebp
lea rdx, [rsp + 0x38]
mov rcx, r15
call fcn.14002ae50
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14002b2a6
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b2a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b2c6
call fcn.1400f1aa0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14002b200
mov rbx, qword [rsp + 0x30]
mov edx, 1
mov rcx, rbx
call sub.DNSAPI.dll_DnsFree
jmp 0x14002b2d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov dword [rsi], r14d
test r14d, r14d
setne al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f2410
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002bc80
Capabilities:
Access the windows event log

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x870
mov rax, qword [0x1406bd868]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r9, r8
mov ebx, 4
test r8, r8
je 0x14002bda4
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [r9 + r8], 0
jne 0x14002bcc0
test r8, r8
je 0x14002bda4
cmp r8, 0x400
mov eax, 0x3ff
mov edi, 1
cmovae r8, rax
test edx, edx
je 0x14002bcfb
sub edx, edi
je 0x14002bcf9
sub edx, edi
jne 0x14002bcfb
lea ebx, [rdi + 1]
jmp 0x14002bcfb
mov ebx, edi
cmp qword [0x1406c34b0], 0
je 0x14002bda4
lea rax, [rsp + 0x50]
mov edx, 0x7fe
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea r8, [0x140406c60]
call fcn.140030390
shr rax, 1
add rax, rax
cmp rax, 0x800
jae 0x14002bdc7
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x40], rcx
mov r9d, 0xc0000064
mov word [rsp + rax + 0x60], cx
movzx edx, bx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x1406c34b0]
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x14002bda4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140075c50
mov eax, 0xffffffff
jmp 0x14002bda6
xor eax, eax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.1400f2410
mov rbx, qword [rsp + 0x888]
add rsp, 0x870
pop rdi
ret
call fcn.1400f1ff4
int3
Function at 0x14002bdd0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x160
mov rax, qword [0x1406bd868]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
mov r14, 0xffffffffffffffff
mov qword [rsp + 0x30], rdi
mov rbx, r14
mov rsi, rcx
nop dword [rax + rax]
cmp byte [rcx + rbx + 1], dil
lea rbx, [rbx + 1]
jne 0x14002be10
xor r8d, r8d
lea rdx, [rbx + 0x39]
xor ecx, ecx
call fcn.140010ae0
mov rbp, rax
test rax, rax
je 0x14002be89
lea r9, [0x1400fffe8]
mov qword [rsp + 0x20], rsi
lea r8, [0x140100020]
mov rcx, rax
lea rdx, [rbx + 0x39]
call fcn.14000ae80
lea r8, [rsp + 0x30]
mov rdx, rbp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov rcx, rbp
mov ebx, eax
call fcn.140010ad0
test ebx, ebx
je 0x14002beb4
cmp ebx, 5
jne 0x14002be89
xor r8d, r8d
lea rdx, str.Could_not_create_or_access_the_registry_key_needed_for_the_MySQL_application_nto_log_to_the_Windows_EventLog._Run_the_application_with_sufficient_nprivileges_once_to_create_the_key__add_the_key_manually__or_turn_off_nlogging_for_that_application.
xor ecx, ecx
call fcn.140041690
mov eax, r14d
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400f2410
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x40]
mov rax, r14
nop
inc rax
cmp byte [rcx + rax], dil
jne 0x14002bed0
mov rcx, qword [rsp + 0x30]
lea rdx, str.EventMessageFile
inc eax
mov r9d, 2
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14002bf0f
cmp eax, 5
cmovne edi, r14d
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea rdx, str.TypesSupported
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14002bf4f
cmp eax, 5
cmovne edi, r14d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x14002be8c
Function at 0x14002c4c0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp byte [0x1406c34b8], 0
jne 0x14002c581
lea rcx, str.UMASK
mov byte [0x1406c34b8], 1
mov dword [0x1403f6e08], 0x1a0
mov dword [0x1403f6e0c], 0x1e8
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002c511
mov rcx, rax
call fcn.14002c320
or eax, 0x180
mov dword [0x1403f6e08], eax
lea rcx, str.UMASK_DIR
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002c536
mov rcx, rax
call fcn.14002c320
or eax, 0x1c0
mov dword [0x1403f6e0c], eax
call fcn.1400409b0
test al, al
jne 0x14002c588
call fcn.140040df0
test al, al
jne 0x14002c588
lea rcx, str.HOME
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [0x140713bb8], rax
test rax, rax
je 0x14002c577
mov rdx, rax
lea rcx, [0x140713de0]
call fcn.14002cf40
mov qword [0x140713bb8], rax
call fcn.14002c680
call fcn.140075f40
xor al, al
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret

Function at 0x14002c6c0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002c767
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesWinsock2Parameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002c767
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesWinsockParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14002c767
lea rcx, str.HAVE_TCPIP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14002c760
cmp byte [0x1406c34b9], 0
je 0x14002c767
xor al, al
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x38
ret

Function at 0x14002c780
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1406bd868]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call fcn.14002c6c0
test al, al
je 0x14002c807
mov qword [rsp + 0x1d0], rbx
lea rdx, [rsp + 0x20]
mov ebx, 0x202
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14002c7c7
cmp word [rsp + 0x20], bx
je 0x14002c7de
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, ebx
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14002c7e5
mov byte [0x1406c34b9], 1
mov rbx, qword [rsp + 0x1d0]
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400f2410
add rsp, 0x1d8
ret
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400f2410
add rsp, 0x1d8
ret
Function at 0x14002c830
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov rax, qword [0x1406bd868]
xor rax, rsp
mov qword [rbp + 0x970], rax
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMySQL
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002c9ae
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x44]
mov qword [rsp + 0xa90], rbx
lea r8, [rsp + 0x60]
lea ebx, [rax + 1]
mov qword [rsp + 0xa98], rdi
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x38], rax
xor edi, edi
lea rax, [rbp + 0x60]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x14002c993
nop word [rax + rax]
cmp eax, 0xea
je 0x14002c93d
test eax, eax
jne 0x14002c993
cmp dword [rsp + 0x48], 1
jne 0x14002c93d
lea r9, [rbp + 0x60]
mov qword [rsp + 0x20], rdi
lea r8, [0x1401004d8]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x460]
call fcn.1400440b0
lea rcx, [rbp + 0x460]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x60]
mov dword [rsp + 0x44], 0xff
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], 0x3ff
mov qword [rsp + 0x28], rax
mov edx, ebx
mov qword [rsp + 0x20], rdi
inc ebx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x14002c8f0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xa98]
mov rbx, qword [rsp + 0xa90]
mov rcx, qword [rbp + 0x970]
xor rcx, rsp
call fcn.1400f2410
add rsp, 0xa80
pop rbp
ret
Function at 0x14002d6c0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r15
sub rsp, 0x68
mov r13, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0xa8]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r9d, dword [rsp + 0xa8]
mov edx, 0x20
inc r9d
mov qword [rsp + 0x48], rax
movsxd rcx, r9d
mov r12, rax
shl rcx, 3
call fcn.140044f40
mov ecx, dword [rsp + 0xa8]
xor r15d, r15d
mov rbp, rax
test ecx, ecx
jle 0x14002d7e3
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x60], rsi
mov rsi, rax
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r14
mov r14, r12
sub r14, rax
lea r12, [0x140406c60]
nop
mov rax, qword [r14 + rsi]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14002d760
mov edi, dword [r13 + 0x94]
xor edx, edx
imul rdi, rbx
lea rcx, [rdi + 1]
call fcn.140044f40
lea rcx, [rsp + 0x40]
mov qword [rsi], rax
mov r9, qword [r14 + rsi]
lea rdx, [rdi + 1]
mov qword [rsp + 0x30], rcx
add rbx, rbx
mov qword [rsp + 0x28], r12
mov rcx, rax
mov r8, r13
mov qword [rsp + 0x20], rbx
call fcn.140030390
mov rcx, qword [rsi]
inc r15d
add rsi, 8
mov byte [rax + rcx], 0
mov ecx, dword [rsp + 0xa8]
cmp r15d, ecx
jl 0x14002d750
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x90]
mov rax, qword [rsp + 0xa0]
mov qword [rax], rbp
mov rax, qword [rsp + 0x98]
mov dword [rax], ecx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x68
pop r15
pop r13
pop r12
pop rbp
ret