joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013af0
Capabilities:
Get disk information via ioctl

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
mov ebx, 0x37
mov rcx, qword [section..data]
lea r14, section..data
cmp rcx, r14
je 0x140013b41
mov rcx, qword [rcx + 0x10]
lea edx, [rbx - 0x2d]
mov r9, rdi
lea r8, [0x1400ddd88]
call fcn.140013d90
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140013ce8
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], ntohl
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x2d1080
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140013caf
cmp dword [rsp + 0x48], 2
jne 0x140013c83
mov r9d, dword [rsp + 0x4c]
lea r8, str..CdRom_d
mov rdx, rbp
mov rcx, rsi
call fcn.140013d30
test eax, eax
js 0x140013c14
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140013c04
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ddd88]
mov edx, ntohl
mov r9, rsi
call fcn.140013d90
xor ebx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013d16
cmp eax, 0x8007007a
jne 0x140013c4f
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140013c3c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ddd88]
mov edx, ntohl
call fcn.140012400
mov rcx, rdi
mov ebx, 0x7a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013d16
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140013c70
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ddd88]
mov edx, ntohl
call fcn.140012400
mov rcx, rdi
mov ebx, 0x57
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013d16
mov rcx, qword [section..data]
cmp rcx, r14
je 0x140013cdd
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400ddd88]
mov edx, reloc.WS2_32.dll_ntohl
call fcn.140012400
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013d16
cmp qword [section..data], r14
je 0x140013cdd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [section..data]
lea r8, [0x1400ddd88]
mov r9d, eax
mov edx, 0xf
mov rcx, qword [rcx + 0x10]
call fcn.140013e20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140013d16
cmp qword [section..data], r14
je 0x140013d16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [section..data]
lea r8, [0x1400ddd88]
mov r9d, eax
mov edx, 0x10
mov rcx, qword [rcx + 0x10]
call fcn.140013e20
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400af8c0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140015ca0
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov r14, rdx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.1400b5f30
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
dec eax
cmp eax, 0x103
ja 0x140015e19
lea rdi, [rsp + 0x30]
cmp word [rsp + 0x30], 0
je 0x140015e19
call fcn.140004650
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140015e0e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
test rdi, 0xffffffffffff0000
jne 0x140015d69
movzx esi, di
xor edx, edx
mov ecx, esi
call fcn.140002cd0
test rax, rax
je 0x140015d8f
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400050f0
jmp 0x140015d8a
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140015d70
mov r8d, eax
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140007830
mov rbx, qword [rsp + 0x20]
mov r8, qword [r14]
test r8, r8
je 0x140015e03
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140015db4
add rax, 2
test ecx, ecx
jne 0x140015da0
test edx, edx
sete sil
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140015dd4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
test sil, sil
jne 0x140015dff
or rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], 0
jne 0x140015de0
lea rdi, [rdi + rax*2]
add rdi, 2
cmp word [rdi], 0
jne 0x140015d16
jmp 0x140015e19
xor eax, eax
jmp 0x140015e1e
mov ecx, 0x80004005
call fcn.140003970
int3
mov ecx, 0x80004005
call fcn.140003970
int3
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400af8c0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x1400169d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
cmp word [rcx + 0x54], 0
mov rbx, rcx
je 0x140016a41
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
nop dword [rax]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + SysAllocStringByteLen]
mov rcx, qword [rbx + 0x268]
movzx edx, word [rcx]
cmp dx, word [0x1400dd1f0]
jne 0x140016a1a
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1388
ja 0x140016a3c
mov rax, qword [rbx + 0x268]
movzx ecx, word [rax]
cmp cx, word [0x1400dd1f0]
je 0x1400169f0
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140017290
Capabilities:
Get disk information via ioctl

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rbp, rcx
call fcn.140004650
mov rcx, rax
xor edi, edi
mov edx, edi
test rax, rax
setne dl
test edx, edx
jne 0x1400172ca
mov ecx, 0x80004005
call fcn.140003970
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x80], rbx
mov rax, qword [rbp + 0x20]
cmp dword [rax - 8], 1
jle 0x1400172f2
mov edx, dword [rax - 0x10]
lea rcx, [rbp + 0x20]
call fcn.1400043b0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80
lea r8d, [r9 + 3]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140017378
mov dword [rsp + 0x78], edi
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ntohl
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2d1080
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
test eax, eax
jne 0x14001736d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140017378
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140017393
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.imgengine.dll_Ordinal_8 + 8]
mov eax, edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019b50
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor r9d, r9d
mov rbx, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 8], rax
mov r9, rbx
lea r8, [0x14001a130]
xor edx, edx
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
call fcn.1400bc4fc
mov qword [rbx], rax
test rax, rax
je 0x140019bab
mov rcx, qword [rbx + 8]
mov edx, 0x2710
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret

Function at 0x14001c1b0
Capabilities:
Create directory

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x58], rdi
mov rax, qword [rdx]
lea rdx, [r11 - 0x50]
mov rcx, rbx
call qword [rax + 0x38]
mov r9, qword [rsp + 0x28]
lea rcx, str.Directory
mov r8d, edi
nop
movzx eax, word [r9 + r8*2]
cmp ax, word [rcx + r8*2]
jne 0x14001c3b2
movzx eax, word [r9 + r8*2 + 2]
cmp ax, word [rcx + r8*2 + 2]
jne 0x14001c3b2
add r8, 2
cmp r8, 0xa
jne 0x14001c1f0
mov rax, qword [rbx]
lea rdx, [rsp + 0x98]
mov rcx, rbx
call qword [rax + 0x88]
test eax, eax
js 0x14001c3b2
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14001c3b2
mov rax, qword [rcx]
lea r8, [rsp + 0x20]
lea rdx, str.Name
call qword [rax + 0x38]
test eax, eax
js 0x14001c3b2
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14001c3b2
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x14001c290
mov rbx, rdi
mov qword [rsp + 0x30], rbx
jmp 0x14001c2ae
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x14001c2ae
mov ecx, 0x8007000e
call fcn.140003970
nop
mov rdx, rbx
lea rcx, [rsp + 0x90]
call fcn.14000c2c0
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, qword [rsp + 0x90]
cmp dword [rax - 0x10], 3
jg 0x14001c2e2
lea rdx, [rax - 0x18]
or ebx, 0xffffffff
jmp 0x14001c39f
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [rsp + 0x90]
call fcn.140014d40
call fcn.140004650
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x14001c313
mov ecx, 0x80004005
call fcn.140003970
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
movsx r8d, byte [rsi + 0x18]
lea rdx, str._c:_
lea rcx, [rsp + 0x88]
call fcn.140012950
mov rdx, qword [rsp + 0x90]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x88]
call fcn.1400127c0
nop
xor edx, edx
mov rbx, qword [rsp + 0x88]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop
jmp 0x14001c376
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001c393
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14001c3b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x140021e90
Capabilities:
Delete file
Get file size

Disassembly:
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x2a0], 0
mov rdi, rcx
je 0x140021f1d
mov rcx, qword [rcx + 8]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x60], rsi
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140021f18
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, dword [rsp + 0x50]
mov rcx, rsi
shl rbx, 0x20
add ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
mov rbx, qword [rsp + 0x58]
jne 0x140021f18
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140026c50
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSet_services_sptd_r0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140026cfd
mov rcx, qword [rsp + 0x48]
call fcn.14009d900
mov rcx, qword [rsp + 0x48]
test al, al
je 0x140026cca
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140026cc0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400dff50]
mov edx, ntohl
call fcn.140012400
mov eax, 1
add rsp, 0x38
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SYSTEMCurrentControlSet_services_sptd_r0
mov qword [rsp + 0x48], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140026cfd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x38
ret

Function at 0x1400277f0
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSet_services_sptd_r0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002789d
mov rcx, qword [rsp + 0x48]
call fcn.14009d900
mov rcx, qword [rsp + 0x48]
test al, al
je 0x14002786a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140027860
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e0258]
mov edx, 0x10
call fcn.140012400
mov eax, 1
add rsp, 0x38
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SYSTEMCurrentControlSet_services_sptd_r0
mov qword [rsp + 0x48], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14002789d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x38
ret
Function at 0x14002a580
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x50], rax
test rax, rax
je 0x14002a5e3
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x14002a9e0]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x14002a5eb
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], 0
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x14002a600
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rdx
lea rdx, [0x1401336e4]
mov ecx, 0x30
call fcn.1400af704
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14002a658
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov rcx, rax
call fcn.140029430
mov rbx, rax
jmp 0x14002a65a
xor ebx, ebx
test rbx, rbx
je 0x14002a6cf
lea rdx, [rdi + 8]
lea rcx, [rbx + 8]
call fcn.14001f100
lea rdx, [rdi + 0x18]
lea rcx, [rbx + 0x18]
call fcn.14000d550
mov rdx, rdi
mov rcx, rbx
call fcn.14000d2f0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x14002a6e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x14002a6c6
mov rcx, rbx
call fcn.140029530
mov edx, 0x30
mov rcx, rbx
call fcn.1400aee84
jmp 0x14002a6cf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14002b590
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x210
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rsp + 0x200], rax
xor ebx, ebx
mov rdi, rcx
mov qword [rsp + 0x20], rbx
mov rcx, qword [section..data]
lea rsi, section..data
cmp rcx, rsi
je 0x14002b606
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xe]
lea r8, [0x1400e0670]
call fcn.140012400
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14002b606
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0xf]
mov r9, rdi
lea r8, [0x1400e0670]
call fcn.140013d90
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14002b645
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14002b63e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e0670]
mov edx, 0x10
mov r9d, eax
call fcn.140013e20
xor eax, eax
jmp 0x14002b704
xor eax, eax
lea r9, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x28]
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x2c], 2
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 6
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
je 0x14002b6c4
mov rcx, qword [section..data]
cmp rcx, rsi
je 0x14002b6ba
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e0670]
mov edx, setsockopt
mov r9d, eax
call fcn.140013e20
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14002b704
mov rcx, qword [rsp + 0x20]
mov rax, rcx
test rcx, rcx
je 0x14002b6f6
cmp dword [rax + 4], 2
je 0x14002b6e2
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14002b6d1
jmp 0x14002b6f6
mov rax, qword [rax + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, ebx
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400af8c0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400441ec
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
mov dword [rax + 0x18], r8d
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov rax, rdx
mov rdi, r9
lea rdx, [rsp + 0x68]
mov r9d, 9
mov qword [rsp + 0x20], rdx
xor r8d, r8d
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
mov ebx, eax
test eax, eax
jne 0x140044399
mov dword [rsp + 0x70], esi
test rdi, rdi
je 0x14004429f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov qword [rsp + 0x48], rsi
xor edx, edx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
test eax, eax
jne 0x14004438e
mov eax, dword [rsp + 0x78]
mov dword [rdi], eax
mov eax, dword [rsp + 0x7c]
mov dword [rdi + 4], eax
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x60], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004438e
mov rdi, qword [rbp + 0x1c8]
mov rsi, qword [rbp + 0x1c0]
mov r9d, dword [rbp + 0x1b0]
lea rcx, [rbp - 0x80]
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rdi
call rsi
cmp eax, 2
je 0x140044389
test eax, eax
jne 0x14004433c
mov r8d, dword [rbp + 0x1b0]
lea rcx, [rbp - 0x80]
mov rdx, qword [rsp + 0x68]
inc r8d
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call fcn.1400441ec
mov ebx, eax
test eax, eax
jne 0x14004438e
mov eax, dword [rsp + 0x70]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x38], rcx
lea r9, [rsp + 0x60]
xor ecx, ecx
mov dword [rsp + 0x60], 0x104
mov qword [rsp + 0x30], rcx
lea r8, [rbp - 0x80]
mov qword [rsp + 0x28], rcx
inc eax
mov qword [rsp + 0x20], rcx
mov edx, eax
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x70], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400442ec
jmp 0x14004438e
mov ebx, 0x1f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x290]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140045a00
Capabilities:
Create thread

Disassembly:
movzx eax, byte [rsp + 0x28]
mov rcx, qword [rcx + 8]
mov byte [rsp + 0x28], al
jmp fcn.140045670

Function at 0x140046af0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rbx
push r15
sub rsp, 0x58
mov rax, qword [rdx]
lea r9, [r11 - 0x38]
mov rbx, rcx
lea r8, [r11 + 0x20]
lea rcx, [r11 + 0x10]
mov r15, rdx
mov qword [r11 - 0x40], rcx
lea rdx, [r11 + 0x18]
lea rcx, [r11 - 0x30]
mov qword [r11 - 0x48], rcx
mov rcx, r15
call qword [rax + reloc.imgengine.dll_Ordinal_8]
test eax, eax
jne 0x140046b3e
cmp qword [rsp + 0x38], 0
je 0x140046b3e
cmp dword [rsp + 0x80], 0x80
je 0x140046b4b
mov eax, 0x6f9
add rsp, 0x58
pop r15
pop rbx
ret
mov rax, qword [r15]
lea rdx, [rbx + 0x210]
mov qword [rsp + 0x50], rsi
lea r9, [rbx + 0x21c]
mov qword [rsp + 0x48], rdi
lea r8, [rbx + 0x218]
lea rdi, [rbx + 0x220]
mov qword [rsp + 0x40], r14
mov rcx, r15
mov qword [rsp + 0x20], rdi
call qword [rax + 0x18]
test eax, eax
jne 0x140046cc5
mov edx, dword [rdi]
cmp edx, 0x200
je 0x140046bb2
cmp edx, 0x400
je 0x140046bb2
cmp edx, 0x800
je 0x140046bb2
cmp edx, 0x1000
jne 0x140046cc5
mov eax, dword [rbx + 0x218]
dec eax
cmp eax, 0xfe
ja 0x140046cc5
mov eax, dword [rbx + 0x21c]
dec eax
cmp eax, 0xfffe
ja 0x140046cc5
mov ecx, dword [rsp + 0x78]
test ecx, ecx
je 0x140046bf6
cmp ecx, 0x1000
jb 0x140046cc5
imul eax, edx, 0xffff
cmp ecx, eax
jbe 0x140046c00
imul ecx, edx, 0xffff
mov dword [rsp + 0x78], ecx
test dword [rsp + 0x88], 0x10000
mov rax, qword [rsp + 0x38]
mov qword [rbx + 0x208], rax
mov dword [rbx + 0x204], ecx
je 0x140046c26
mov byte [rbx + 0x224], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x248], rax
test rax, rax
je 0x140046c9a
lea rax, [rsp + 0x34]
xor esi, esi
mov qword [rsp + 0x28], rax
lea r8, [0x1400468c0]
mov r9, rbx
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
test rax, rax
je 0x140046c7a
lea edx, [rsi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rbx + 0x250], rdi
test rdi, rdi
jne 0x140046ca1
mov rcx, qword [rbx + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x248], rsi
mov eax, 8
jmp 0x140046cca
mov rcx, qword [rbx + 8]
xor r8d, r8d
mov rdx, qword [rbx]
mov qword [rbx + 0x228], r15
mov rax, qword [rcx]
call qword [rax + reloc.imgengine.dll_Ordinal_8]
test eax, eax
je 0x140046cca
mov qword [rbx + 0x228], rsi
jmp 0x140046cca
mov eax, 0x6f9
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x40]
add rsp, 0x58
pop r15
pop rbx
ret