joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001a8d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
call fcn.18001ac60
mov rdi, rax
or rcx, 0xffffffffffffffff
cmp word [rbx + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x18001a8f1
lea eax, [rcx*2 + 2]
test rdi, rdi
jne 0x18001a91c
lea eax, [rdi + 1]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x48]
xor eax, eax
test ebx, ebx
mov rbx, qword [rsp + 0x40]
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x18001a970
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, r8
mov rsi, rdx
call fcn.18001ac60
mov rdi, rax
test rax, rax
jne 0x18001a9a5
lea eax, [rdi + 1]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x18001a9b0
inc eax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x48]
xor eax, eax
test ebx, ebx
mov rbx, qword [rsp + 0x40]
sete al
add rsp, 0x30
pop rdi
ret

Function at 0x18001aa90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov edi, r9d
mov rsi, r8
mov r14, rdx
call fcn.18001ac60
mov rbp, rax
test rax, rax
je 0x18001ab27
lea rax, [rsp + 0x34]
mov qword [rsp + 0x50], rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbp
mov r14d, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], 1
je 0x18001ab1a
lea r8, [0x18006ec94]
mov rdx, rdi
or r9, 0xffffffffffffffff
mov rcx, rsi
call fcn.18002bfb0
xor eax, eax
jmp 0x18001ab22
test r14d, r14d
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001ab50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ebx, r9d
mov rsi, r8
mov rbp, rdx
call fcn.18001ac60
mov rdi, rax
test rax, rax
jne 0x18001ab7f
lea eax, [rdi + 1]
jmp 0x18001abb8
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test ebx, ebx
sete al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x18001abe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov edi, r8d
mov rbx, rdx
call fcn.18001ac60
mov rsi, rax
test rax, rax
je 0x18001ac44
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x180021720
Capabilities:
List user accounts for group
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor r12d, r12d
mov r15, rcx
mov rsi, rdx
lea rcx, [rbp + 0x61]
xor edx, edx
mov r8d, 0xfe
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x50], r12d
mov byte [rbp + 0x60], r12b
call fcn.1800292e0
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x60], r12b
call fcn.1800292e0
cmp dword [0x18009caf4], 5
lea edi, [r12 + 1]
jl 0x1800217b0
lea rcx, str.ShowThisLocalGroupMembers
call fcn.1800169b0
nop dword [rax + rax]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov r8d, 3
mov qword [rsp + 0x28], rax
mov rdx, r15
xor ecx, ecx
mov dword [rsp + 0x20], 0xffffffff
mov qword [rsp + 0x48], r12
call sub.NETAPI32.dll_NetLocalGroupGetMembers
cmp dword [0x18009caf4], 5
mov r14, qword [rsp + 0x48]
mov ebx, eax
jl 0x180021807
lea rcx, str.grabbed_list_of_users__sending_data
call fcn.1800169b0
test ebx, ebx
je 0x18002184c
cmp ebx, 5
je 0x180021843
cmp ebx, 0xea
je 0x18002183a
cmp ebx, 0x560
je 0x180021831
cmp ebx, 0x92f
jne 0x180021858
lea rcx, str.NERR_InvalidComputer
jmp 0x180021853
lea rcx, str.ERROR_NO_SUCH_ALIAS
jmp 0x180021853
lea rcx, str.ERROR_MORE_DATA
jmp 0x180021853
lea rcx, str.ERROR_ACCESS_DENIED
jmp 0x180021853
lea rcx, str.NERR_Success
call fcn.1800169b0
cmp dword [rsp + 0x40], r12d
je 0x18002190a
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0x60]
mov r8, qword [r8]
mov qword [rsp + 0x30], r12
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0xfe
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rax, [rbp + 0x60]
or r8, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
mov edx, 0x100
lea rcx, [rsp + 0x60]
test edi, edi
jne 0x1800218c5
lea r9, [0x1800736ac]
jmp 0x1800218cf
mov edi, r12d
lea r9, [0x1800736f4]
call fcn.180029e64
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x1800218e0
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
add qword [rsp + 0x48], 8
dec dword [rsp + 0x40]
jne 0x180021870
test r14, r14
je 0x180021917
mov rcx, r14
call sub.NETAPI32.dll_NetApiBufferFree
cmp ebx, 0xea
je 0x1800217b0
cmp dword [0x18009caf4], 5
jl 0x180021938
lea rcx, str.finished_ShowThisLocalGroupMembers
call fcn.1800169b0
xor eax, eax
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180022500
Capabilities:
List user accounts for group
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r12d, r12d
mov r14, rcx
mov rsi, r8
mov r15, rdx
lea rcx, [rsp + 0x161]
mov r8d, 0xfe
xor edx, edx
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x50], r12d
mov byte [rsp + 0x160], r12b
call fcn.1800292e0
lea rcx, [rsp + 0x61]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x60], r12b
call fcn.1800292e0
cmp dword [0x18009caf4], 5
lea ebx, [r12 + 1]
jl 0x180022590
lea rcx, str.ShowThisDomainGroupMembersNT
call fcn.1800169b0
nop dword [rax + rax]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r14
mov rcx, r15
mov dword [rsp + 0x20], 0xffffffff
call sub.NETAPI32.dll_NetGroupGetUsers
mov rcx, qword [rsp + 0x48]
mov rdi, rcx
mov ebp, eax
cmp dword [rsp + 0x40], r12d
je 0x180022682
nop dword [rax]
mov r8, qword [rcx]
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x160]
mov qword [rsp + 0x30], r12
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0xfe
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rax, [rsp + 0x160]
or r8, 0xffffffffffffffff
mov edx, 0x100
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
test ebx, ebx
jne 0x180022638
lea r9, [0x18007498c]
jmp 0x180022642
mov ebx, r12d
lea r9, [0x1800749dc]
call fcn.180029e64
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x180022650
lea rdx, [rsp + 0x60]
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x48]
add rcx, 8
dec dword [rsp + 0x40]
mov qword [rsp + 0x48], rcx
jne 0x1800225e0
test rdi, rdi
je 0x18002268f
mov rcx, rdi
call sub.NETAPI32.dll_NetApiBufferFree
cmp ebp, 0xea
je 0x180022590
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800292b0
add rsp, 0x270
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180023200
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rcx
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x20], 0
call fcn.1800292e0
lea rcx, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x400
call fcn.1800232b0
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180023250
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
xor r9d, r9d
lea rdx, [0x180074bc4]
lea r8d, [r9 + 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov eax, 1
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.1800292b0
add rsp, 0x430
pop rbx
ret
Function at 0x180024320
Capabilities:
Make an http request with a cookie
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor eax, eax
mov edi, edx
mov rsi, rcx
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x41], rax
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov qword [rsp + 0x69], rax
mov qword [rsp + 0x71], rax
mov dword [rsp + 0x79], eax
mov word [rsp + 0x7d], ax
mov byte [rsp + 0x7f], al
cmp edx, 1
jne 0x18002438e
lea r8, str.text_html
jmp 0x1800243af
cmp edx, 2
jne 0x18002439c
lea r8, str.image_gif
jmp 0x1800243af
lea r8, str.text_javascript
cmp edx, 3
je 0x1800243af
lea r8, str.text_plain
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
lea edx, [rbx + 0x41]
mov r9, rbx
call fcn.18002a5b4
cmp dword [0x18009caf4], 5
jl 0x1800243dd
lea rdx, [rsp + 0x40]
lea rcx, str.DisplayHTMLHeader:__s
call fcn.1800169b0
lea rax, [rsp + 0x40]
lea r9, str.HTTP_1.0_200_OK_r_nServer:_SNARE_1.0_r_nMIME_version:_1.0_r_nContent_type:__s_r_n
lea rcx, [rsp + 0x80]
mov r8, rbx
mov edx, 0x200
mov qword [rsp + 0x20], rax
call fcn.180029e64
cmp edi, 1
jne 0x180024450
lea edx, [rdi + 0x3f]
lea rdi, [0x18009fd00]
mov rcx, rdi
call fcn.1800235a0
lea rax, [rsp + 0x80]
mov dword [rsp + 0x30], 0x384
lea r9, str._sSet_Cookie:_chtok_s__Path___Max_Age:__d__HttpOnly_r_n
lea rcx, [rsp + 0x80]
mov r8, rbx
mov edx, 0x200
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.180029e64
lea r8, [0x18007038c]
lea rcx, [rsp + 0x80]
mov r9, rbx
mov edx, 0x200
call fcn.180029f1c
lea rax, [rsp + 0x80]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180024474
lea rdx, [rsp + 0x80]
mov r8, rbx
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1800244c0
Capabilities:
Send data
Send data on socket
Send http request

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x230
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rcx
or rbx, 0xffffffffffffffff
lea r8, str.HTTP_1.0_404_Not_Found_r_nServer:_SNARE_1.0_r_nMIME_version:_1.0_r_nContent_type:_text_html_r_n_r_n_html__body__center__h2_Page_Not_Found__h2___center___body___html_
lea rcx, [rsp + 0x20]
mov edx, 0x200
mov r9, rbx
call fcn.18002a5b4
lea rax, [rsp + 0x20]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180024504
lea rdx, [rsp + 0x20]
mov r8, rbx
xor r9d, r9d
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1800292b0
mov rbx, qword [rsp + 0x248]
add rsp, 0x230
pop rdi
ret
Function at 0x180024550
Capabilities:
Get user security identifier

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, rcx
xor ecx, ecx
cmp dword [0x18009caf4], 5
mov r14, r9
mov r12, r8
mov r15, rdx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x80], ecx
mov esi, ecx
jl 0x180024590
lea rcx, str.GetUserSid
call fcn.1800169b0
xor ecx, ecx
test r13, r13
je 0x1800247a2
test r15, r15
je 0x1800247a2
mov qword [rsp + 0x90], rbp
mov rbp, qword [rsp + 0xa0]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x98], rdi
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x80], ecx
mov dword [rsp + 0x40], ecx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rsi
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
jne 0x18002461e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1800246dc
mov edx, dword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x18002478e
mov edx, dword [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180024771
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov r8, rdi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov rdx, r13
mov qword [rsp + 0x28], rax
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x18002475d
test r14, r14
je 0x18002471b
test rbp, rbp
je 0x18002471b
mov r8, r14
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800246b7
inc rax
test ecx, ecx
jne 0x1800246a4
test edx, edx
je 0x18002471b
test rsi, rsi
jne 0x18002471b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, rbp
xor ecx, ecx
jmp 0x1800245d0
mov edx, dword [r12]
or r9, 0xffffffffffffffff
lea r8, [0x180072d60]
mov rcx, r15
call fcn.18002a5b4
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov r8, r12
mov rdx, r15
mov rcx, rdi
call fcn.18001ae50
test eax, eax
jne 0x180024744
mov edx, dword [r12]
lea r8, [0x180072de8]
or r9, 0xffffffffffffffff
mov rcx, r15
call fcn.18002a5b4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1800246f5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1800246f3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [r12]
or r9, 0xffffffffffffffff
lea r8, [0x180072de0]
jmp 0x1800246eb
mov edx, dword [r12]
or r9, 0xffffffffffffffff
lea r8, [0x180072d68]
jmp 0x1800246eb
mov edx, dword [r12]
lea r8, [0x180072d18]
or r9, 0xffffffffffffffff
mov rcx, r15
call fcn.18002a5b4
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x180024f30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov r8, rcx
lea rcx, [0x180024fb0]
xor edx, edx
call fcn.18002c448
mov edx, dword [0x18009caf4]
mov rbx, rax
cmp edx, 5
jl 0x180024f73
lea rcx, str.DEBUG:_Starting_thread__d.._event_is__d
mov r8, rdi
mov edx, eax
call fcn.1800169b0
mov edx, dword [0x18009caf4]
cmp ebx, 0xffffffff
jne 0x180024f97
cmp edx, 5
jl 0x180024f89
lea rcx, str.Error_in_HTTPD_thread_creation
call fcn.1800169b0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800267b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
or rbx, 0xffffffffffffffff
mov rsi, rcx
mov rcx, rbx
mov rdi, rdx
nop dword [rax]
inc rcx
cmp byte [rdx + rcx], bpl
jne 0x1800267e0
inc rcx
call fcn.18002a67c
mov r14, rax
test rax, rax
jne 0x180026801
mov byte [rsi], bpl
jmp 0x1800268f9
mov rdx, rbx
inc rdx
cmp byte [rdi + rdx], bpl
jne 0x180026804
inc rdx
mov r9, rbx
mov r8, rdi
mov rcx, rax
call fcn.18002a5b4
nop
inc rbx
cmp byte [r14 + rbx], bpl
jne 0x180026820
test ebx, ebx
jle 0x1800268ec
lea eax, [rbx - 1]
lea r9, [r14 + 2]
shr eax, 2
inc eax
mov r11d, eax
xor edx, edx
lea rcx, [r9 - 2]
lea r8d, [rdx + 4]
nop word [rax + rax]
movzx eax, byte [rcx]
cmp al, 0x3d
jne 0x18002685b
inc edx
jmp 0x180026881
cmp al, 0x2b
jne 0x180026864
mov byte [rcx], 0x3e
jmp 0x180026881
cmp al, 0x2f
jne 0x18002686d
mov byte [rcx], 0x3f
jmp 0x180026881
cmp al, 0x39
jg 0x180026875
add al, 4
jmp 0x18002687f
cmp al, 0x5a
jg 0x18002687d
sub al, 0x41
jmp 0x18002687f
sub al, 0x47
mov byte [rcx], al
inc rcx
dec r8
jne 0x180026850
movzx ecx, byte [r9 - 1]
movzx eax, byte [r9 - 2]
inc ebp
sar cl, 4
shl al, 2
or cl, al
mov byte [rsi], cl
cmp edx, 2
jge 0x1800268d7
movzx ecx, byte [r9]
movzx eax, byte [r9 - 1]
inc ebp
sar cl, 2
shl al, 4
or cl, al
mov byte [rsi + 1], cl
cmp edx, 1
jge 0x1800268d1
movzx eax, byte [r9]
shl al, 6
or al, byte [r9 + 1]
inc ebp
mov byte [rsi + 2], al
jmp 0x1800268db
mov byte [rsi + 2], 0
jmp 0x1800268db
mov byte [rsi + 1], 0
add rsi, 3
add r9, 4
dec r11
jne 0x180026840
mov rcx, r14
mov byte [rsi], 0
call fcn.180029620
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180026920
Capabilities:
Encode data using base64

Disassembly:
xor r10d, r10d
mov r9, rcx
test r8d, r8d
jle 0x1800269d6
add rdx, 2
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop word [rax + rax]
movzx eax, byte [rdx - 2]
dec r8d
shr rax, 2
movzx eax, byte [rax + r11]
mov byte [r9], al
movzx eax, byte [rdx - 2]
and eax, 3
shl eax, 4
movsxd rcx, eax
movzx eax, byte [rdx - 1]
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [r9 + 1], al
test r8d, r8d
jle 0x180026996
movzx eax, byte [rdx - 1]
and eax, 0xf
shl eax, 2
movsxd rcx, eax
movzx eax, byte [rdx]
shr eax, 6
or rcx, rax
movzx eax, byte [rcx + r11]
jmp 0x180026998
mov al, 0x3d
dec r8d
mov byte [r9 + 2], al
test r8d, r8d
jle 0x1800269b1
movzx eax, byte [rdx]
and eax, 0x3f
movzx ecx, byte [rax + r11]
jmp 0x1800269b3
mov cl, 0x3d
dec r8d
mov byte [r9 + 3], cl
add rdx, 3
add r9, 4
inc r10d
test r8d, r8d
jg 0x180026940
mov byte [r9], 0
mov eax, r10d
ret
mov byte [rcx], r10b
mov eax, r10d
ret
Function at 0x1800269e0
Capabilities:
Access the windows event log
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x70
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp dword [0x18009caf4], 2
mov rbx, qword [0x18009ca10]
jl 0x18000cd48
lea rdx, str.Entering_CNTService::ServiceMain__
mov rcx, rbx
call fcn.18000cb60
lea rdx, [0x18000ce90]
lea rcx, [rbx + 8]
mov qword [rsp + 0x80], rdi
mov dword [rbx + 0x5c], 2
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov qword [rbx + 0x50], rax
test rax, rax
jne 0x18000cde0
xor edi, edi
xorps xmm0, xmm0
mov qword [rsp + 0x60], rdi
movdqu xmmword [rsp + 0x50], xmm0
cmp qword [rbx + 0x88], rdi
jne 0x18000cd9d
lea rdx, [rbx + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov qword [rbx + 0x88], rax
mov rcx, qword [rbx + 0x88]
test rcx, rcx
je 0x18000ce65
mov qword [rsp + 0x40], rdi
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
lea edx, [r8 + 1]
lea r9d, [r8 + 0x67]
mov word [rsp + 0x28], di
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_ReportEventA]
jmp 0x18000ce65
mov rcx, rbx
call fcn.18000c7d0
test eax, eax
je 0x18000ce05
mov rax, qword [rbx]
xor edi, edi
mov rcx, rbx
mov dword [rbx + 0x74], 1
mov dword [rbx + 0x64], edi
mov qword [rbx + 0x6c], rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [0x18009caf4], 2
jl 0x18000ce38
mov r8, qword [rbx + 0x50]
lea rdx, str.CNTService::SetStatus__lu___lu_
mov r9d, 1
mov rcx, rbx
call fcn.18000cb60
mov rcx, qword [rbx + 0x50]
lea rdx, [rbx + 0x58]
mov dword [rbx + 0x5c], 1
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp dword [0x18009caf4], 2
jl 0x18000ce65
lea rdx, str.Leaving_CNTService::ServiceMain__
mov rcx, rbx
call fcn.18000cb60
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800292b0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rsi
ret
xor edx, edx
jmp 0x18000cd10
Function at 0x18004a278
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x18004a28b
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rsp + 0x20]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.18004ae00
lea rdx, [0x180096178]
lea rcx, [rsp + 0x20]
call fcn.180028858
int3

Function at 0x180054c7c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1800a5d24]
xor edx, edx
jmp fcn.18004a278

Function at 0x180055630
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1800a5d24]
jmp fcn.18004a278

Function at 0x180055780
Capabilities:
Get thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x40]
jmp 0x180060d9c
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov r13, r9
mov r12, r8
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov qword [rax + 8], rcx
call fcn.18004ab58
nop
mov edi, dword [rbx + 4]
mov esi, dword [rbx + 4]
dec esi
mov eax, dword [rbx]
cmp esi, eax
jl 0x180060d76
lea ebp, [rsi + 1]
movsxd r15, esi
movsxd rcx, dword [rbx + 8]
and rcx, r15
mov rax, qword [rbx + 0x20]
mov r14, qword [rax + rcx*8]
test r14, r14
je 0x180060d6c
mov rdx, r12
mov rcx, r14
call qword [rsp + 0x78]
test al, al
je 0x180060d6c
mov rdx, r12
mov rcx, r14
call r13
test al, al
je 0x180060d6c
cmp ebp, edi
jne 0x180060d5c
dec edi
jmp 0x180060d6c
movsxd rcx, dword [rbx + 8]
and rcx, r15
mov rax, qword [rbx + 0x20]
and qword [rax + rcx*8], 0
dec esi
dec ebp
mov eax, dword [rbx]
cmp esi, eax
jge 0x180060d22
xchg dword [rbx + 4], edi
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.18004aba0
add rcx, 0xb0
jmp 0x180060cd8

Function at 0x180060ba0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r9, qword [rdx + 0x1a8]
mov r8, rcx
mov r9, qword [r9 + 8]
lea rdx, [0x180060c5c]
add rcx, 0x40
jmp fcn.180052620

Function at 0x180060c34
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r9, qword [rdx + 0x1a8]
mov r8, rcx
mov r9, qword [r9 + 8]
lea rdx, [0x180060c6c]
add rcx, 0x40
jmp fcn.180052620