joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009517
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180012248]
jne 0x180007bba
rol rcx, 0x10
test cx, 0xffff
jne 0x180007bb6
repz ret
ror rcx, 0x10
jmp 0x180009470
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180012fd0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1800130c8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800094f5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180012fd0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180009517
mov rax, qword [rsp + 0x88]
mov qword [0x1800130c8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180013068], rax
mov rax, qword [0x1800130c8]
mov qword [0x180012f40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180013050], rax
mov dword [0x180012f30], 0xc0000409
mov dword [0x180012f34], 1
mov rax, qword [0x180012248]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180012250]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180012fc8], eax
mov ecx, 1
call fcn.180007bc0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000e630]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180012fc8], 0
jne 0x18000959e
mov ecx, 1
call fcn.180007bc0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140003324
Capabilities:
Encode data using xor

Disassembly:
and al, 0x52
or dx, 0x452d
mov word [rsp + 0xd8], dx
mov dword [rsp + 0xd8], edx
movzx ecx, cx
mov word [rsp + 0x22], ax
call sym.DUI70.dll_public:_struct_DirectUI::Cursor____ptr64___cdecl_DirectUI::Value::GetCursor_void____ptr64
add byte [rdx], ah
add byte [rax], al
invalid
invalid
push rsp
invalid

Function at 0x1400058d8
Capabilities:
Encode data using xor

Disassembly:
cmp r10d, r9d
mov dword [rsp + 8], r10d
mov dword [rsp + 8], edx
Function at 0x140f12688
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f1280f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f126b9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f1269f
add dl, dl
jne 0x140f126c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f12726
xor eax, eax
add dl, dl
jne 0x140f126d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f127dd
add dl, dl
jne 0x140f126e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f126f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f12700
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f1270d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f1271a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f126ae
mov eax, 1
add dl, dl
jne 0x140f12736
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f12743
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f1272b
sub eax, ebx
mov ebx, 1
jne 0x140f1277c
mov ecx, 1
add dl, dl
jne 0x140f1275e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f1276b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f12753
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f126ae
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f12798
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f127a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f1278d
cmp eax, 0x7d00
jae 0x140f127cb
cmp eax, 0x500
jb 0x140f127c6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f126ae
cmp eax, 0x7f
ja 0x140f127ce
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f126ae
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f12802
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f126ae
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
pop rsi
pop rcx
add rax, rdx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14000612c
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f170]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007200
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007190
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x1400211d0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020600]
jmp 0x14000723c
cmp qword [rbx + 0x18], rdi
je 0x140007243
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007233
jmp 0x14000725d
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020600]
call fcn.140011f98
lea rcx, [0x1400211d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push rdx
add al, 0x2c
int3
push rbp
invalid
insd dword [rdi], dx
je 0x14003f621
cmp byte [rax - 0x6dcf7617], ah
xchg ebx, eax
fld dword [rdx]
mov al, 0x38
cmp edx, dword [rdi]
cmp dword [rdx], ecx
adc byte [rcx], bl
xchg byte [rax + rbp*2 - 0x80], ah
retf 0xc2e8
xor eax, 0xc092a648
in al, 0xd8
call 0xe7ff7a16
invalid
mov al, 0xeb
fild dword [rsi + 0x41]
invalid
sub eax, dword [rax - 0x3c0a754]
invalid
mov al, 0xd4
push 0xffffffffffffffbb
jo 0x14003f668
int1
xchg ebx, eax
shr byte [rbx], 0x3f
inc dword [rbp + 0x71]
invalid
invalid
shr byte [rcx + 0x13310a75], 1
xor bl, dh
lodsd eax, dword [rsi]
out 0xf7, al
mov dh, 0x45
jnp case.0x14000726e.8
fucompi st(1)
add byte [rsi + 0xcba1a12], al
mov edx, 0x5914240c
jmp 0x15a167c9e
mov edx, 0x5914240c
and eax, dword [rsp + rbx]
stosd dword [rdi], eax
out 0x6c, eax
insb byte [rdi], dx
invalid
and byte [rdx + 0x17f57c92], 0xbe
jl 0x14003f699
mov edi, 0xfdbc093c
invalid
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004128f0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00412900]
mov dword [rax], 1
mov rax, qword [0x00412910]
mov dword [rax], 1
mov rax, qword [0x004128e0]
mov dword [rax], 1
mov rax, qword [0x004127d0]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x004128d0]
mov dword [0x0041500c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00412890]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00412780]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x402a7d
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov rax, qword [rbp + 0x18]
movzx eax, byte [rax]
cmp al, 2
jne 0x402b48
mov word [rbp - 0x50], 2
mov rax, qword [rbp + 0x18]
movzx eax, word [rax + 2]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp - 0x4e], ax
mov rax, qword [rbp + 0x18]
add rax, 4
mov eax, dword [rax]
mov dword [rbp - 0x4c], eax
mov rdx, qword [rbp + 0x18]
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.sock_to_cstr
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rsp + 0x20], rax
lea r9, str.sendto_sock__lu_to___s_
mov r8d, 0xac
lea rdx, str._n2n_v2_sn.c
mov ecx, 4
call sym.traceEvent
mov rax, qword [rbp + 0x28]
mov r8d, eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x48]
cdqe
mov rdx, qword [rbp + 0x20]
mov dword [rsp + 0x28], 0x10
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_sendto]
call rax
cdqe
jmp 0x402b5e
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov dword [rax], 0x273f
mov rax, 0xffffffffffffffff
sub rsp, 0xffffffffffffff80
pop rbp
ret
Function at 0x40938a
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov dword [rbp + 0x10], ecx
mov dword [rbp + 0x18], edx
mov r8d, 0
mov edx, 2
mov ecx, 2
mov rax, qword [sym.imp.WS2_32.dll_socket]
call rax
mov qword [rbp - 8], rax
mov dword [rbp - 0x24], 1
lea rdx, [rbp - 0x24]
mov rax, qword [rbp - 8]
mov dword [rsp + 0x20], 4
mov r9, rdx
mov r8d, 4
mov edx, 0xffff
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_setsockopt]
call rax
lea rax, [rbp - 0x20]
mov r8d, 0x10
mov edx, 0
mov rcx, rax
call sym.memset
mov word [rbp - 0x20], 2
mov eax, dword [rbp + 0x10]
movzx eax, ax
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htons]
call rax
mov word [rbp - 0x1e], ax
cmp dword [rbp + 0x18], 0
je 0x409425
mov eax, 0
jmp 0x40942a
mov eax, 0x7f000001
mov ecx, eax
mov rax, qword [sym.imp.WS2_32.dll_htonl]
call rax
mov dword [rbp - 0x1c], eax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp - 8]
mov r8d, 0x10
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_bind]
call rax
cmp eax, 0xffffffff
jne 0x40949c
mov rax, qword [sym.imp.msvcrt.dll__errno]
call rax
mov eax, dword [rax]
mov ecx, eax
call sym.strerror
mov qword [rsp + 0x28], rax
mov eax, dword [rbp + 0x10]
mov dword [rsp + 0x20], eax
lea r9, str.Bind_error_on_local_port__u___s__n
mov r8d, 0x3a
lea rdx, str._n2n_v2_n2n.c
mov ecx, 0
call sym.traceEvent
mov rax, 0xffffffffffffffff
jmp 0x4094a0
mov rax, qword [rbp - 8]
add rsp, 0x60
pop rbp
ret

Function at 0x40ba0b
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, dword [0x00410020]
mov dword [0x004150f4], eax
mov eax, dword [0x004150f4]
mov dword [0x004150f0], eax
mov qword [0x004150d8], 0
lea rcx, str.POSIXLY_CORRECT
call sym.getenv
mov qword [0x004150e8], rax
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2d
jne 0x40ba70
mov dword [0x004150e0], 2
add qword [rbp + 0x20], 1
jmp 0x40baae
mov rax, qword [rbp + 0x20]
movzx eax, byte [rax]
cmp al, 0x2b
jne 0x40ba8c
mov dword [0x004150e0], 0
add qword [rbp + 0x20], 1
jmp 0x40baae
mov rax, qword [0x004150e8]
test rax, rax
je 0x40baa4
mov dword [0x004150e0], 0
jmp 0x40baae
mov dword [0x004150e0], 1
mov rax, qword [rbp + 0x20]
add rsp, 0x20
pop rbp
ret

Function at 0x40cb30
Capabilities:
Initialize winsock library

Disassembly:
push rbp
sub rsp, 0x1c0
lea rbp, [rsp + 0x80]
lea rax, [rbp - 0x60]
mov rdx, rax
mov ecx, 0x202
mov rax, qword [sym.imp.WS2_32.dll_WSAStartup]
call rax
mov dword [rbp + 0x13c], eax
cmp dword [rbp + 0x13c], 0
je 0x40cb7a
lea rcx, str.FATAL_ERROR:_unable_to_initialise_Winsock_2.x.
call sym.printf
mov ecx, 1
call sym.exit
nop
add rsp, 0x1c0
pop rbp
ret
Function at 0x40cc01
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0xc70
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc00], rcx
mov qword [rbp + 0xc08], rdx
mov dword [rbp + 0xbe8], 0
lea rax, [rbp + 0xbd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp + 0xbe4], eax
cmp dword [rbp + 0xbe4], 0
je 0x40cc85
mov eax, dword [rbp + 0xbe4]
mov edx, eax
lea rcx, str.Unable_to_read_registry:__rc_d__n
call sym.printf
mov ecx, 1
call sym.exit
mov dword [rbp + 0xbec], 0
mov dword [rbp + 0x7cc], 0x400
mov edx, dword [rbp + 0xbec]
mov rax, qword [rbp + 0xbd8]
lea r8, [rbp + 0x7cc]
lea rcx, [rbp - 0x40]
add rcx, 8
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call rax
test eax, eax
jne 0x40ce2a
lea rax, [rbp + 0x7d0]
lea rdx, [rbp - 0x40]
add rdx, 8
mov qword [rsp + 0x20], rdx
lea r9, str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
lea r8, str._s_sConnection
mov edx, 0x400
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
call rax
lea rax, [rbp + 0x7d0]
lea rdx, [rbp + 0xbd0]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x40ce1a
mov dword [rbp + 0x7cc], 0x400
mov rax, qword [rbp + 0xbd0]
lea rdx, [rbp + 0x7cc]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x40]
add rdx, 0x408
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.Name
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp + 0xbe0], eax
mov rax, qword [rbp + 0xbd0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
cmp dword [rbp + 0xbe0], 0
jne 0x40ce1d
lea rax, [rbp - 0x40]
add rax, 8
mov rcx, rax
call sym.open_tap_device
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
cmp rax, 0xffffffffffffffff
je 0x40ce1e
mov rdx, qword [rbp + 0xc08]
lea rax, [rbp - 0x40]
mov r8, qword [rbp + 0xc00]
mov rcx, rax
call r8
test eax, eax
je 0x40ce2d
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
jmp 0x40ce1e
nop
jmp 0x40ce1e
nop
add dword [rbp + 0xbec], 1
jmp 0x40cc8f
nop
jmp 0x40ce2e
nop
mov rax, qword [rbp + 0xbd8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
nop
add rsp, 0xc70
pop rbp
ret
Function at 0x40ceab
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xc0
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov dword [rbp - 8], 0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
je 0x40cf21
mov eax, dword [rbp - 0xc]
mov r8d, eax
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
lea rcx, str.Unable_to_read_registry:__s___rc_d__n
call sym.printf
mov ecx, 1
call sym.exit
mov dword [rbp - 4], 0
mov dword [rbp - 0x24], 0x10
mov edx, dword [rbp - 4]
mov rax, qword [rbp - 0x18]
lea r8, [rbp - 0x24]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call rax
test eax, eax
jne 0x40d056
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
lea r9, str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
lea r8, str._s_s
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
call rax
mov rax, qword [rbp + 0x18]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x40d049
mov dword [rbp - 0x24], 0x40
mov rax, qword [rbp - 0x20]
lea rdx, [rbp - 0x24]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.NetCfgInstanceId
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov dword [rbp - 0x10], eax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
cmp dword [rbp - 0x10], 0
jne 0x40d04c
lea rax, [rbp - 0x80]
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x40d04d
mov dword [rbp - 8], 1
jmp 0x40d057
nop
jmp 0x40d04d
nop
add dword [rbp - 4], 1
jmp 0x40cf28
nop
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, dword [rbp - 8]
add rsp, 0xc0
pop rbp
ret
Function at 0x40d073
Capabilities:
Execute command
Set registry value

Disassembly:
push rbp
sub rsp, 0x570
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x500], rcx
mov qword [rbp + 0x508], rdx
mov qword [rbp - 0x48], 0
lea rax, [rbp - 0x48]
mov qword [rbp + 0x4e0], rax
mov rax, qword [rbp + 0x508]
mov rcx, rax
call sym.strlen
cmp rax, 0x11
je 0x40d0d9
mov rax, qword [rbp + 0x508]
mov rdx, rax
lea rcx, str.Invalid_MAC:__s_n
call sym.printf
mov ecx, 1
call sym.exit
mov dword [rbp + 0x4ec], 0
jmp 0x40d14f
mov edx, dword [rbp + 0x4ec]
mov eax, edx
add eax, eax
add eax, edx
movsxd rdx, eax
mov rax, qword [rbp + 0x508]
add rax, rdx
mov edx, dword [rbp + 0x4ec]
lea ecx, [rdx + rdx]
movzx edx, byte [rax]
movsxd rax, ecx
mov byte [rbp + rax + 0x3c0], dl
mov edx, dword [rbp + 0x4ec]
mov eax, edx
add eax, eax
add eax, edx
cdqe
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x508]
add rax, rdx
mov edx, dword [rbp + 0x4ec]
add edx, edx
lea ecx, [rdx + 1]
movzx edx, byte [rax]
movsxd rax, ecx
mov byte [rbp + rax + 0x3c0], dl
add dword [rbp + 0x4ec], 1
cmp dword [rbp + 0x4ec], 5
jle 0x40d0e5
mov byte [rbp + 0x3cc], 0
mov rax, qword [rbp + 0x500]
mov rax, qword [rax + 8]
lea rdx, [rbp - 0x40]
mov r8d, 0x400
mov rcx, rax
call sym.lookup_adapter_info_reg
test eax, eax
jne 0x40d196
lea rcx, str.Could_not_determine_adapter_MAC_registry_key
call sym.puts
mov ecx, 1
call sym.exit
lea rcx, [rbp - 0x40]
lea rax, [rbp + 0x3e0]
lea rdx, [rbp + 0x3c0]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str.reg_add_HKEY_LOCAL_MACHINE_s__v_MAC__d__s__f
mov edx, 0x100
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
call rax
lea rax, [rbp + 0x3e0]
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x500]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
call rax
mov rax, qword [rbp + 0x500]
mov rdx, qword [rax + 0x10]
lea rax, [rbp + 0x3e0]
mov r9, rdx
lea r8, str.netsh_interface_set_interface___s__disabled
mov edx, 0x100
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
call rax
lea rax, [rbp + 0x3e0]
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x500]
mov rdx, qword [rax + 0x10]
lea rax, [rbp + 0x3e0]
mov r9, rdx
lea r8, str.netsh_interface_set_interface___s__enabled
mov edx, 0x100
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
call rax
lea rax, [rbp + 0x3e0]
mov rcx, rax
call sym.system
mov rax, qword [rbp + 0x500]
mov rax, qword [rax + 8]
mov rcx, rax
call sym.open_tap_device
mov rdx, qword [rbp + 0x500]
mov qword [rdx], rax
mov rax, qword [rbp + 0x500]
mov rax, qword [rax]
cmp rax, 0xffffffffffffffff
jne 0x40d2b6
mov rax, qword [rbp + 0x500]
mov rax, qword [rax + 8]
mov rdx, rax
lea rcx, str.Reopening_TAP_device___s__failed_n
call sym.printf
mov ecx, 1
call sym.exit
nop
add rsp, 0x570
pop rbp
ret
Function at 0x40d85d
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_ResetEvent]
call rax
mov rax, qword [rbp + 0x10]
lea rcx, [rax + 0x18]
mov r8d, dword [rbp + 0x20]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea r9, [rbp - 8]
mov rdx, qword [rbp + 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_ReadFile]
call rax
test eax, eax
je 0x40d8ba
mov eax, dword [rbp - 8]
jmp 0x40d92c
mov rax, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rax
mov dword [rbp - 4], eax
cmp dword [rbp - 4], 0x3e5
jne 0x40d915
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x30]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x10]
lea rdx, [rax + 0x18]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea rcx, [rbp - 8]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
call rax
mov eax, dword [rbp - 8]
jmp 0x40d92c
mov eax, dword [rbp - 4]
mov edx, eax
lea rcx, str.GetLastError___returned__d_n
call sym.printf
nop
mov eax, 0xffffffff
add rsp, 0x40
pop rbp
ret

Function at 0x40d932
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_ResetEvent]
call rax
mov rax, qword [rbp + 0x10]
lea rcx, [rax + 0x38]
mov r8d, dword [rbp + 0x20]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea r9, [rbp - 4]
mov rdx, qword [rbp + 0x18]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_WriteFile]
call rax
test eax, eax
je 0x40d98f
mov eax, dword [rbp - 4]
jmp 0x40d9eb
mov rax, qword [sym.imp.KERNEL32.DLL_GetLastError]
call rax
cmp eax, 0x3e5
jne 0x40d9e5
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x50]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x10]
lea rdx, [rax + 0x38]
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
lea rcx, [rbp - 4]
mov r9d, 0
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.DLL_GetOverlappedResult]
call rax
mov eax, dword [rbp - 4]
jmp 0x40d9eb
nop
mov eax, 0xffffffff
add rsp, 0x40
pop rbp
ret

Function at 0x40e050
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]