joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006980
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov dword [rax + 0x20], r9d
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov rdi, rdx
mov r14, rcx
mov r10, qword [0x140106190]
lea r12, [0x140106190]
cmp r10, r12
je 0x1400069e0
test byte [r10 + 0x1c], 1
je 0x1400069e0
cmp byte [r10 + 0x19], 5
jb 0x1400069e0
mov r9, rcx
mov dword [rax - 0x40], r8d
mov rcx, qword [r10 + 0x10]
mov qword [rax - 0x48], rdx
call fcn.140005654
mov r10, qword [0x140106190]
xor ebx, ebx
mov dword [rsp + 0x88], ebx
lea r13, [0x1400dc2f8]
cmp r10, r12
je 0x140006a19
test byte [r10 + 0x1c], 2
je 0x140006a19
cmp byte [r10 + 0x19], 5
jb 0x140006a19
mov rcx, qword [r10 + 0x10]
lea edx, [rbx + 0x34]
mov r8, r13
call fcn.140003574
mov r10, qword [0x140106190]
cmp dword [rdi + 4], 1
je 0x140006b98
mov edx, 0x7530
mov ecx, dword [rdi + 0x18]
mov eax, edx
cmp ecx, edx
cmovb eax, ecx
cmp eax, 0x1f4
jae 0x140006a40
mov esi, 0x1f4
jmp 0x140006a47
cmp ecx, edx
mov esi, edx
cmovb esi, ecx
cmp r10, r12
je 0x140006a6e
test byte [r10 + 0x1c], 2
je 0x140006a6e
cmp byte [r10 + 0x19], 5
jb 0x140006a6e
mov rcx, qword [r10 + 0x10]
mov edx, 0x35
mov r9d, esi
mov r8, r13
call fcn.140003634
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x88]
mov r9d, 0x24
mov r8, rdi
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x140006b5b
cmp dword [rdi + 4], 1
je 0x140006b2a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
mov edx, 0x7530
cmp eax, edx
ja 0x140006ad0
cmp dword [rdi + 4], 1
mov r10, qword [0x140106190]
jne 0x140006a28
jmp 0x140006b98
mov ebx, 0x5b4
mov r10, qword [0x140106190]
cmp r10, r12
je 0x140006bcd
test byte [r10 + 0x1c], 2
je 0x140006b98
cmp byte [r10 + 0x19], 2
jb 0x140006b98
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140106190]
mov edx, 0x38
mov dword [rsp + 0x28], 0x7530
mov r9d, ebp
mov r8, r13
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.14000515c
jmp 0x140006b91
mov r10, qword [0x140106190]
cmp r10, r12
je 0x140006bcd
test byte [r10 + 0x1c], 2
je 0x140006b98
cmp byte [r10 + 0x19], 5
jb 0x140006b98
mov rcx, qword [r10 + 0x10]
mov edx, 0x37
mov r8, r13
call fcn.140003574
jmp 0x140006b91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r10, qword [0x140106190]
cmp r10, r12
je 0x140006bcd
test byte [r10 + 0x1c], 2
je 0x140006b98
cmp byte [r10 + 0x19], 2
jb 0x140006b98
mov rcx, qword [r10 + 0x10]
mov edx, 0x36
mov r9d, eax
mov r8, r13
call fcn.140003634
mov r10, qword [0x140106190]
cmp r10, r12
je 0x140006bcd
test byte [r10 + 0x1c], 1
je 0x140006bcd
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x140006bcd
mov rcx, qword [r10 + 0x10]
mov edx, 0x39
mov r9d, ebx
mov r8, r13
call fcn.140003634
mov rbp, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140006bec
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140109328]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov r9, rcx
mov rcx, qword [0x140106190]
lea r14, [0x140106190]
cmp rcx, r14
je 0x140006c40
test byte [rcx + 0x1c], 1
je 0x140006c40
cmp byte [rcx + 0x19], 5
jb 0x140006c40
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
call fcn.1400055e8
mov ebp, 0x24
lea rcx, [rsp + 0x38]
mov r8d, ebp
xor edx, edx
call sub.msvcrt.dll_memset
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
lea r8, [rsp + 0x38]
mov esi, eax
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x30]
mov r9d, ebp
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
lea rbp, [0x1400dc2f8]
test eax, eax
jne 0x140006cce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r10, qword [0x140106190]
cmp r10, r14
je 0x140006d88
test byte [r10 + 0x1c], 2
je 0x140006d53
cmp byte [r10 + 0x19], 2
jb 0x140006d53
mov rcx, qword [r10 + 0x10]
mov edx, 0x3b
mov r9d, eax
mov r8, rbp
call fcn.140003634
jmp 0x140006d4c
cmp dword [rsp + 0x3c], 1
jne 0x140006d06
mov r10, qword [0x140106190]
cmp r10, r14
je 0x140006d88
test byte [r10 + 0x1c], 2
je 0x140006d53
cmp byte [r10 + 0x19], 5
jb 0x140006d53
mov rcx, qword [r10 + 0x10]
mov edx, 0x3c
mov r8, rbp
call fcn.140003574
jmp 0x140006d4c
cmp dword [rsp + 0x3c], 3
jne 0x140006dac
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x140006d3a
test byte [rcx + 0x1c], 2
je 0x140006d3a
cmp byte [rcx + 0x19], 5
jb 0x140006d3a
mov rcx, qword [rcx + 0x10]
mov edx, 0x3d
mov r8, rbp
call fcn.140003574
mov r8d, esi
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140006980
mov ebx, eax
mov r10, qword [0x140106190]
cmp r10, r14
je 0x140006d88
test byte [r10 + 0x1c], 1
je 0x140006d88
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x140006d88
mov rcx, qword [r10 + 0x10]
mov edx, 0x3f
mov r9d, ebx
mov r8, rbp
call fcn.140003634
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400cc650
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x140006dd5
test byte [rcx + 0x1c], 2
je 0x140006dd5
cmp byte [rcx + 0x19], 5
jb 0x140006dd5
mov rcx, qword [rcx + 0x10]
mov edx, 0x3e
mov r8, rbp
call fcn.140003574
lea r8, [rsp + 0x38]
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140006d3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140006d4a
Function at 0x14000f804
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
call fcn.1400be0e8
mov esi, eax
lea rdx, str.SOFTWAREMicrosoftWindows_Media_Player_NSS3.0
lea rax, [rsp + 0x58]
xor ebx, ebx
and qword [rsp + 0x58], rbx
mov r9d, 0x2011f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14000f856
mov rbx, qword [rsp + 0x58]
mov rcx, qword [0x140106190]
lea rbp, [0x140106190]
mov r14d, 5
cmp rcx, rbp
je 0x14000f8a5
lea edx, [r14 - 3]
test byte [rcx + 0x1c], dl
je 0x14000f8a5
movzx eax, byte [rcx + 0x19]
test edi, edi
cmove edx, r14d
cmp eax, edx
jl 0x14000f8a5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400dd6d0]
mov edx, SysStringByteLen
mov r9d, edi
call fcn.140003634
mov rcx, qword [0x140106190]
test edi, edi
jne 0x14000f8da
lea r9d, [rdi + 4]
mov dword [rsp + 0x50], esi
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.WakeOnMagicPacketEnabled
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x140106190]
cmp rcx, rbp
je 0x14000f903
test byte [rcx + 0x1c], 1
je 0x14000f903
cmp byte [rcx + 0x19], r14b
jb 0x14000f903
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400dd6d0]
mov edx, SysStringByteLen
mov r9d, esi
call fcn.140003634
test rbx, rbx
je 0x14000f911
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
mov eax, esi
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140017704
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rcx, qword [0x140106190]
lea rsi, [0x140106190]
cmp rcx, rsi
je 0x14001774a
test byte [rcx + 0x1c], 1
je 0x14001774a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400dd6d0]
mov edx, 0x13c
call fcn.140003574
xor r13d, r13d
lea rax, [rbp + 0x48]
mov ebx, 1
mov qword [rbp + 0x58], r13
mov r8d, ebx
mov dword [rbp + 0x48], r13d
lea r9, [rbp + 0x58]
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
mov edi, eax
mov rcx, qword [0x140106190]
cmp rcx, rsi
je 0x1400177bd
test byte [rcx + 0x1c], 2
je 0x1400177bd
cmp byte [rcx + 0x19], 5
jb 0x1400177bd
mov eax, dword [rbp + 0x48]
lea r8, [0x1400dd6d0]
mov rcx, qword [rcx + 0x10]
mov edx, 0x13d
mov dword [rsp + 0x28], eax
mov r9d, edi
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.14000ae48
mov rcx, qword [0x140106190]
test edi, edi
je 0x1400178cd
cmp dword [rbp + 0x48], r13d
jne 0x1400177d3
mov ebx, r13d
jmp 0x1400178b8
mov esi, r13d
lea rbx, [0x140106190]
mov r14d, r13d
mov edi, r13d
cmp edi, dword [rbp + 0x48]
jae 0x1400178a1
mov rcx, qword [rbp + 0x58]
mov eax, edi
lea r15, [rax + rax*2]
mov eax, dword [rcx + r15*8 + 0x10]
test eax, eax
je 0x14001780b
add eax, 0xfffffffd
cmp eax, 1
ja 0x140017897
mov qword [rbp + 0x60], r13
lea rax, [rbp + 0x50]
mov dword [rbp + 0x50], r13d
lea r9, [rbp + 0x60]
mov edx, dword [rcx + r15*8]
mov r8d, 5
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
mov r12d, eax
mov rcx, qword [0x140106190]
cmp rcx, rbx
je 0x140017873
test byte [rcx + 0x1c], 2
je 0x140017873
cmp byte [rcx + 0x19], 5
jb 0x140017873
mov rax, qword [rbp + 0x60]
mov r9d, edi
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x58]
mov dword [rsp + 0x28], r12d
mov edx, dword [rax + r15*8]
mov dword [rsp + 0x20], edx
call fcn.14000ab9c
test r12d, r12d
je 0x140017891
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140017891
cmp r13w, word [rcx]
je 0x140017889
inc esi
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
jmp 0x140017897
mov r14d, 1
inc edi
test esi, esi
je 0x1400177e3
mov ebx, 1
test r14d, r14d
jne 0x1400178b1
test esi, esi
cmove ebx, r13d
lea rsi, [0x140106190]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov rcx, qword [0x140106190]
mov qword [rbp + 0x58], r13
cmp rcx, rsi
je 0x1400178f6
test byte [rcx + 0x1c], 1
je 0x1400178f6
cmp byte [rcx + 0x19], 5
jb 0x1400178f6
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400dd6d0]
mov edx, 0x13f
mov r9d, ebx
call fcn.140003634
mov eax, ebx
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003568c
Capabilities:
Monitor local ipv4 address changes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov esi, ebp
mov edi, ebp
call fcn.140036b24
test eax, eax
je 0x140035818
call fcn.140036ec4
test eax, eax
je 0x140035818
lea r14, [0x140109fd0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov dword [0x14010bd6c], ebp
lea r8d, [rbp + 0x20]
lea rcx, [0x14010bae0]
call sub.msvcrt.dll_memset
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x14010baf8], rax
test rax, rax
jne 0x140035713
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140035778
mov dword [rsp + 0x28], ebp
lea r8, [0x140035270]
or dword [rsp + 0x20], 0xffffffff
lea rcx, [0x14010bd70]
xor r9d, r9d
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x140035709
lea rdx, [0x14010bae0]
mov esi, 1
lea rcx, [0x14010bd78]
call qword [sym.imp.IPHLPAPI.DLL_NotifyAddrChange]
mov ebx, eax
cmp eax, 0x3e5
jne 0x140035778
lea rcx, [0x14010bd80]
mov edi, esi
call fcn.1400351f0
mov ebx, eax
test eax, eax
jne 0x140035780
mov ebx, ebp
mov dword [0x14010bd68], esi
test ebx, ebx
je 0x14003580b
mov rcx, r14
mov dword [0x14010bd6c], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x14010bd70]
test esi, esi
mov rcx, r14
cmovne rax, rbp
mov qword [0x14010bd70], rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x1400357c1
lea rcx, [0x14010bae0]
call qword [sym.imp.IPHLPAPI.DLL_CancelIPChangeNotify]
mov rcx, qword [0x14010baf8]
test rcx, rcx
je 0x1400357d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [0x14010bae0]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [0x14010bd80]
test rcx, rcx
je 0x1400357fe
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [0x14010bd80], rbp
mov qword [0x14010bd78], rbp
mov dword [0x14010bd68], ebp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x140035851
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x14003584c
test byte [rcx + 0x1c], 4
je 0x14003584c
cmp byte [rcx + 0x19], 2
jb 0x14003584c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400de478]
mov edx, SafeArrayAccessData
call fcn.140003574
mov eax, 0x8000ffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140036f3c
Capabilities:
Check http status code

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rax - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov ebx, edx
mov rdi, rcx
and dword [rax - 0x18], 0
lea rsi, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, rsi
je 0x140036f98
test byte [rcx + 0x1c], 1
je 0x140036f98
cmp byte [rcx + 0x19], 5
jb 0x140036f98
mov edx, 0xa
mov r9d, ebx
lea r8, str.in6u
mov rcx, qword [rcx + 0x10]
call fcn.140003634
mov rax, qword [0x140108fd0]
lea rcx, [0x140108fd0]
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rdi], rax
mov dword [rsp + 0x20], 1
cmp ebx, 0x192
je 0x140037006
cmp ebx, 0x194
je 0x140037006
cmp ebx, 0x1f5
je 0x140037006
lea eax, [rbx - 0x2bd]
cmp eax, 0x13
ja 0x140036fec
mov ecx, 0x81fbf
bt ecx, eax
jb 0x140037006
cmp ebx, 0x321
je 0x140037006
mov r8d, ebx
mov edx, 0x67
mov rcx, rdi
call fcn.140037598
jmp 0x140037020
mov ecx, ebx
call fcn.1400048f4
test rax, rax
je 0x140037020
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.140004a2c
mov rcx, qword [0x140106190]
cmp rcx, rsi
je 0x140037050
test byte [rcx + 0x1c], 1
je 0x140037050
cmp byte [rcx + 0x19], 5
jb 0x140037050
mov edx, reloc.WSOCK32.dll_inet_ntoa
mov r9, qword [rdi]
lea r8, str.in6u
mov rcx, qword [rcx + 0x10]
call fcn.140003598
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14004226c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x14004228f
mov eax, 0x8000ffff
jmp 0x1400423cb
add rcx, 0x38
call fcn.1400044b4
test eax, eax
js 0x1400423cb
xor r9d, r9d
mov byte [rbx + 0x60], 1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x68], rax
test rax, rax
jne 0x1400422d9
cmp byte [rbx + 0x60], al
je 0x1400422cf
lea rcx, [rbx + 0x38]
mov byte [rbx + 0x60], al
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.14001bbb4
jmp 0x1400423cb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
test rax, rax
jne 0x140042312
call fcn.14001bbb4
mov rcx, rbx
mov edi, eax
call fcn.140042478
test eax, eax
jns 0x1400423c9
test edi, edi
cmovns edi, eax
jmp 0x1400423c9
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.1400420b0
mov esi, eax
test eax, eax
jns 0x140042341
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140042478
mov eax, esi
jmp 0x1400423cb
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
je 0x1400422f1
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.1400420b0
mov edi, eax
test eax, eax
jns 0x140042383
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.140042478
jmp 0x1400423c9
lea rax, [rbx + 8]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140042450]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
test rax, rax
je 0x1400422f1
mov rcx, qword [rbx + 0x68]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400423c9
call fcn.14001bbb4
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140045b9c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [0x140106190]
lea rsi, [0x140106190]
cmp rcx, rsi
je 0x140045be7
test byte [rcx + 0x1c], 1
je 0x140045be7
cmp byte [rcx + 0x19], 5
jb 0x140045be7
mov eax, dword [rdi]
lea r8, [0x1400de990]
mov rcx, qword [rcx + 0x10]
mov edx, 0x2c
mov r9, rbx
mov dword [rsp + 0x20], eax
call fcn.140024b68
mov rcx, qword [rbx]
lea rax, [rsp + 0x60]
and dword [rsp + 0x50], 0
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400debc8]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x60], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x140045c34
mov eax, dword [rsp + 0x68]
sub eax, 4
neg eax
sbb ebx, ebx
and ebx, 0xd
mov r10, qword [0x140106190]
cmp r10, rsi
je 0x140045c75
test byte [r10 + 0x1c], 2
je 0x140045c75
cmp byte [r10 + 0x19], 5
jb 0x140045c75
mov eax, dword [rsp + 0x50]
lea r8, [0x1400de990]
mov rcx, qword [r10 + 0x10]
mov edx, 0x2d
mov r9d, ebx
mov dword [rsp + 0x20], eax
call fcn.1400054b8
mov r10, qword [0x140106190]
test ebx, ebx
jne 0x140045cb7
cmp r10, rsi
je 0x140045caa
test byte [r10 + 0x1c], 2
je 0x140045caa
cmp byte [r10 + 0x19], 4
jb 0x140045caa
mov eax, dword [rsp + 0x50]
lea edx, [rbx + 0x2e]
mov r9d, dword [rdi]
lea r8, [0x1400de990]
mov rcx, qword [r10 + 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400054b8
mov eax, dword [rsp + 0x50]
mov dword [rdi], eax
mov r10, qword [0x140106190]
cmp r10, rsi
je 0x140045cf6
test byte [r10 + 0x1c], 1
je 0x140045cf6
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x140045cf6
mov ecx, dword [rdi]
lea r8, [0x1400de990]
mov dword [rsp + 0x20], ecx
mov edx, 0x2f
mov rcx, qword [r10 + 0x10]
mov r9d, ebx
call fcn.1400054b8
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006cc70
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov r12, r9
mov r15, r8
mov r14, rdx
and qword [rbp - 0x18], 0
lea rax, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, rax
je 0x14006ccd8
test byte [rcx + 0x1c], 2
je 0x14006ccd8
cmp byte [rcx + 0x19], 5
jb 0x14006ccd8
mov edx, SafeArrayDestroy
lea r8, [0x1400e4838]
mov rcx, qword [rcx + 0x10]
call fcn.140003574
mov rax, qword [r14]
lea r8, [rbp - 0x18]
lea rdx, [0x1400e47e0]
mov rcx, r14
mov rax, qword [rax]
call qword [case.0x14006e230.0]
mov ebx, eax
test eax, eax
js 0x14006ce59
lea rcx, [rbp + 0x30]
call fcn.140074d30
mov ebx, eax
test eax, eax
js 0x14006ce59
mov rdi, qword [rbp + 0x30]
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
mov rsi, qword [rbp - 0x18]
xor ebx, ebx
mov qword [rdi + 0x48], r15
cmp qword [rdi + 0x50], rsi
je 0x14006cd62
test rsi, rsi
je 0x14006cd48
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x14006cd5e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006e230.0]
mov qword [rdi + 0x50], rsi
and qword [rsp + 0x28], rbx
and dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x14006c1e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x60], rax
test rax, rax
jne 0x14006cd9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14006ce48
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r12
mov r9, r14
mov r8d, 1
lea rdx, [0x1400e4848]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_ConnectToConnectionPoint]
mov ebx, eax
test eax, eax
js 0x14006ce48
and dword [rbp - 0x20], 0
and dword [rbp + 0x30], 0
and dword [rbp + 0x38], 0
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
lea r9, [rbp + 0x38]
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x20]
mov rax, qword [rax + 0x28]
call qword [case.0x14006e230.0]
cmp dword [rbp + 0x30], 0
jne 0x14006ce2a
cmp dword [rbp + 0x38], 0
jne 0x14006ce2a
and qword [rsp + 0x28], 0
mov qword [rsp + 0x20], r12
mov r9, r14
xor r8d, r8d
lea rdx, [0x1400e4848]
xor ecx, ecx
call qword [sym.imp.SHLWAPI.dll_ConnectToConnectionPoint]
mov ebx, 0x80070490
jmp 0x14006ce48
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
mov edx, 2
mov r8d, 0x3e8
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
mov ebx, eax
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x14006e230.0]
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14006ce6f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006e230.0]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14006d3f8
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, rdx
mov rdi, rcx
lea rdx, [rbp - 0x18]
call fcn.14006c4bc
nop
mov rax, qword [0x140108fd0]
lea rcx, [0x140108fd0]
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x18]
call fcn.14006c4e0
mov ebx, eax
test eax, eax
js 0x14006d550
lea rdx, str.SELECT_System.ItemNameDisplay__System.ItemUrl_FROM_SystemIndex_WHERE_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_stream__AND_NOT_System.Shell.SFGAOFlagsStrings__SOME_ARRAY_hidden__AND_System.Shell.OmitFromView___true_AND__System.ItemType__.wpl_OR_System.ItemType__.m3u_
lea rcx, [rbp + 0x30]
call fcn.140004b74
nop
mov r8d, 5
lea rdx, [0x1400e46e0]
lea rcx, [rbp + 0x30]
call fcn.140004588
mov rdx, qword [rbp - 0x30]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x30]
call fcn.140004588
mov r8d, 0x24
lea rdx, str._ORDER_BY_System.ItemNameDisplay_ASC
lea rcx, [rbp + 0x30]
call fcn.140004588
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
mov r8, qword [rbp + 0x30]
lea rdx, [0x1400e7c98]
mov rax, qword [rax + 0x38]
call qword [case.0x14006e230.0]
mov ebx, eax
test eax, eax
js 0x14006d52a
and qword [rbp + 0x38], 0
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8, str.:s_f
xor edx, edx
mov rax, qword [rax + 0x20]
call qword [case.0x14006e230.0]
mov ebx, eax
test eax, eax
js 0x14006d513
mov r8, rsi
mov rdx, qword [rbp + 0x38]
mov rcx, rdi
call fcn.14006c644
mov ebx, eax
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14006d52a
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14006e230.0]
nop
mov rdx, qword [rbp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d550
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006d576
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
nop
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret