joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002f8c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rcx]
xor esi, esi
xor edi, edi
and dword [rbp - 0x30], esi
and qword [rbp - 0x28], rsi
mov r14, r8
mov r15, rdx
movdqu xmmword [rbp - 0x20], xmm0
test rdx, rdx
je 0x180056bcc
test r8, r8
je 0x180056bcc
and qword [r8], rsi
and dword [rdx], esi
lea rcx, [rbp - 0x20]
lea r8, [rbp - 0x28]
xor edx, edx
call fcn.18002f970
mov ebx, eax
test eax, eax
je 0x180056aed
mov rcx, rdi
call fcn.180008b84
mov rcx, rsi
call fcn.180008b84
mov rcx, qword [rbp - 0x28]
test rcx, rcx
jne 0x18003e312
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180001000
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x18002f947
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
lea r8, [0x180082630]
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], rsi
and qword [rsp + 0x20], rsi
mov r9d, 0x20
xor edx, edx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x18002f92a
mov ecx, dword [rbp - 0x30]
cmp ecx, 4
jbe 0x18002f92a
call fcn.180008d40
mov ecx, dword [rbp - 0x30]
shr ecx, 1
mov rsi, rax
call fcn.180008d40
mov rdi, rax
test rsi, rsi
je 0x180056bc2
test rax, rax
je 0x180056bc2
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
lea r9d, [rbx + 0x20]
mov qword [rsp + 0x30], rax
lea r8, [0x180082630]
xor edx, edx
mov qword [rsp + 0x28], rsi
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x18002f92a
mov edx, dword [rbp - 0x30]
cmp edx, 2
jbe 0x18002f92a
shr edx, 1
mov r8, rdi
mov rcx, rsi
mov r9d, edx
call fcn.1800771d4
test eax, eax
jne 0x180056bab
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x180056bbb
mov r9, r15
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.1800732f0
mov ebx, eax
jmp 0x18002f92a
mov ebx, reloc.WS2_32.dll_ntohl
jmp 0x18002f92a
mov eax, 0x57
jmp 0x18002f949

Function at 0x1800302c0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, edx
lea rbx, [0x18008b1f0]
mov edx, 1
add rax, rax
mov dword [rsp + 0x48], r8d
mov rbx, qword [rbx + rax*8]
call fcn.180019450
mov rdi, rax
test rax, rax
je 0x18003e54f
lea rax, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], r9d
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x18003033d
lea ecx, [rbx + 1]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call sym.DNSAPI.dll_DnsNotifyResolverEx
call fcn.18002fd2c
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
jmp 0x180030324
Function at 0x180031a10
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov esi, r9d
mov rbx, r8
movzx r14d, dx
mov rdi, rcx
mov rcx, qword [0x18008a130]
mov ebp, dword [rsp + 0xc0]
lea r15, [0x18008a130]
cmp rcx, r15
je 0x180031a60
test byte [rcx + 0x1c], 8
jne 0x180046ca6
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180046cd6
test esi, esi
je 0x180046cce
cmp word [rbx], 2
jne 0x180031adb
mov eax, dword [rbx + 4]
movzx ecx, r14w
mov dword [rsp + 0x40], eax
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov r8d, reloc.WS2_32.dll_inet_ntoa
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x180046ce0
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180001000
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
movups xmm0, xmmword [rbx + 8]
movzx eax, r14w
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
lea r9, [rsp + 0x48]
mov edx, 0x29
mov dword [rsp + 0x58], eax
movdqu xmmword [rsp + 0x48], xmm0
jmp 0x180031aa0
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], r9d
movzx eax, r14w
mov r9d, edi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
call fcn.180062a2c
nop
jmp 0x180031a60
test ebp, ebp
jne 0x180031a76
mov eax, 0x57
jmp 0x180031aba
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
mov rcx, qword [0x18008a130]
cmp rcx, r15
je 0x180046d19
test dword [rcx + 0x1c], 0x10000000
je 0x180046d19
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082740]
mov edx, 0x21
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.18005b9d0
mov eax, ebx
jmp 0x180031aba
Function at 0x180031eb0
Capabilities:
Delete registry key

Disassembly:
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082710]
mov edx, 0x22
mov r9, r14
mov qword [rsp + 0x20], rbx
call fcn.18005b344
nop
jmp 0x180031f00
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x180031fcd
test dword [rcx + 0x1c], edi
je 0x180031fcd
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082710]
mov edx, 0x23
mov r9, r14
call fcn.18005b04c
nop
jmp 0x180031fcd
cmp dword [rax], 0
jne 0x180031f9d
mov rcx, qword [rbp - 0x11]
lea rdx, [0x180019160]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
mov rcx, qword [rdi]
call fcn.180008b84
and qword [rdi], 0
jmp 0x180031f9d
mov eax, dword [rbx + 0x20]
mov rcx, qword [rcx + 0x10]
mov r9, r14
mov dword [rsp + 0x48], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x38], eax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
call fcn.1800612c0
nop
jmp 0x18003200e
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
xor r15d, r15d
mov rbx, rdx
mov r14, rcx
xor r12d, r12d
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
mov edi, 0x400
cmp rcx, rax
je 0x180031f00
test dword [rcx + 0x1c], edi
jne 0x180019087
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x28]
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rcx, [rbp - 0x29]
call fcn.1800199b0
test eax, eax
jne 0x180032010
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.18000d19c
mov esi, eax
test eax, eax
jne 0x180031fcd
lea r15d, [rax + 1]
lea rax, [rbp + 0x1f]
lea r9, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 9]
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.18000d8ec
mov esi, eax
test eax, eax
jne 0x1800190aa
lea rdi, [rbx + 8]
lea r9d, [r15 + 5]
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x30], rdi
and dword [rsp + 0x28], eax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 7
mov r12d, r15d
call sym.DNSAPI.dll_Reg_GetValueEx
mov rax, qword [rdi]
test rax, rax
jne 0x1800190e8
mov rax, qword [rbp - 9]
and qword [rbp - 9], 0
mov edi, 0x400
mov qword [rbx], rax
mov rax, qword [rbp + 0xf]
and qword [rbp + 0xf], 0
mov qword [rbx + 0x10], rax
mov eax, dword [rbp + 0x2b]
mov dword [rbx + 0x18], eax
mov eax, dword [rbp + 0x2f]
mov dword [rbx + 0x1c], eax
mov eax, dword [rbp + 0x33]
mov dword [rbx + 0x20], eax
lea rcx, [rbp - 0x29]
call fcn.180019950
test r15d, r15d
je 0x180031fe4
lea rcx, [rbp - 9]
call fcn.18000d888
test r12d, r12d
je 0x180031ff2
lea rcx, [rbp + 0x1f]
call fcn.18000d830
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18003200e
test dword [rcx + 0x1c], edi
jne 0x180019119
mov eax, esi
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18003c350
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1d0
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18003c38b
test dword [rcx + 0x1c], 0x400
jne 0x180058690
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
and dword [0x18008a118], 0
mov ebx, eax
call fcn.18003c3cc
mov eax, ebx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180001000
add rsp, 0x1d0
pop rbx
ret
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082620]
mov edx, reloc.WS2_32.dll_inet_ntoa
call fcn.180058818
nop
jmp 0x18003c38b

Function at 0x18004d568
Capabilities:
Start service

Disassembly:
mov rcx, qword [rcx + 0x10]
lea r8, [0x18004d3f0]
mov edx, 0xa
mov r9d, eax
call fcn.180058fb0
nop
jmp 0x18004d62b
mov rcx, qword [rcx + 0x10]
lea r8, [0x18004d3f0]
mov edx, reloc.WS2_32.dll_inet_addr
mov r9d, ebx
call fcn.180058fb0
nop
jmp 0x18004d66d
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r15
sub rsp, 0x20
lea rax, [0x18004d690]
xor edi, edi
mov ebx, 0x426
mov qword [r11 + 8], rax
call fcn.180018f6c
lea r15, [0x18008a130]
test eax, eax
jne 0x18004d654
lea r8d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
je 0x18004d685
lea r8d, [rdi + 0x15]
lea rdx, [0x18004d6a8]
mov rcx, rax
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x18004d685
mov rcx, rax
call fcn.18004d6c0
test eax, eax
jne 0x18004d638
lea r8, [rsp + 0x30]
lea edx, [rax + 1]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_StartServiceW]
xor r9d, r9d
mov r8d, 0x7d0
lea edx, [r9 + 9]
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_private_l1_1_1.dll_WaitServiceState]
mov ebx, eax
mov rcx, qword [0x18008a130]
cmp rcx, r15
je 0x18004d62b
test dword [rcx + 0x1c], 0x400
jne 0x180048d86
sub ebx, 4
neg ebx
sbb ebx, ebx
and ebx, 0x41d
test rdi, rdi
je 0x18004d646
mov rcx, rdi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
test rsi, rsi
je 0x18004d654
mov rcx, rsi
call qword [sym.imp.api_ms_win_service_management_l1_1_0.dll_CloseServiceHandle]
mov rcx, qword [0x18008a130]
cmp rcx, r15
je 0x18004d66d
test dword [rcx + 0x1c], 0x400
jne 0x180048da4
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop r15
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
jmp 0x18004d638

Function at 0x18004d78c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
Function at 0x18005a1d0
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rcx]
lea r8, [r11 - 0x28]
lea rcx, [r11 - 0x20]
xor edi, edi
xor edx, edx
mov qword [r11 - 0x28], rdi
movdqu xmmword [rsp + 0x28], xmm0
call fcn.18002f970
mov ebx, eax
cmp eax, 2
jne 0x18005a214
xor eax, eax
jmp 0x18005a244
test eax, eax
jne 0x18005a232
mov rcx, qword [rsp + 0x20]
lea rdx, [0x180082630]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov ebx, eax
cmp eax, 2
cmove ebx, edi
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x18005a242
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180001000
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x18005a270
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rcx]
xor esi, esi
mov r14, r8
and qword [r11 - 0x48], rsi
mov ebp, edx
movdqu xmmword [rsp + 0x38], xmm0
test edx, edx
je 0x18005a373
test r8, r8
je 0x18005a373
lea r8, [r11 - 0x48]
lea edx, [rsi + 1]
lea rcx, [r11 - 0x40]
call fcn.18002f970
mov ebx, eax
test eax, eax
jne 0x18005a378
imul rdi, rbp, 0xb
inc rdi
lea ecx, [rdi + rdi]
call fcn.180008d40
mov rsi, rax
test rax, rax
jne 0x18005a2ef
lea ebx, [rax + 0xe]
jmp 0x18005a378
xor r15d, r15d
mov rbx, rax
test ebp, ebp
je 0x18005a32c
mov r9d, dword [r14]
lea r8, [0x18005a3b8]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_crt_l1_1_0.dll_swprintf_s]
cmp eax, 1
jl 0x18005a338
inc eax
inc r15d
add r14, 4
movsxd rcx, eax
sub rdi, rcx
lea rbx, [rbx + rcx*2]
cmp r15d, ebp
jb 0x18005a2f9
test rdi, rdi
jne 0x18005a33f
mov ebx, 0x50c
jmp 0x18005a378
mov ebx, reloc.WS2_32.dll_listen
jmp 0x18005a378
mov rcx, qword [rsp + 0x30]
sub rbx, rsi
lea rdx, [0x180082630]
add rbx, 2
mov r9d, 7
xor r8d, r8d
sar rbx, 1
add ebx, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
jmp 0x18005a378
mov ebx, 0x57
mov rcx, rsi
call fcn.180008b84
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x18005a390
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001000
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005be60
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
or eax, 0xffffffff
test edx, edx
mov ebx, edx
cmove ebx, eax
mov rdi, rcx
test bl, 3
je 0x18005bee5
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x2c]
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
and qword [rsp + 0x70], 0
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x20]
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x18005bee5
mov rcx, qword [rsp + 0x70]
mov edi, dword [rcx + 4]
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
cmp edi, 0x17
jne 0x18005beda
lea eax, [rdi - 0x16]
test al, bl
jne 0x18005becf
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov eax, 2
cmp edi, eax
jne 0x18005becd
jmp 0x18005bec9
bt ebx, 9
jae 0x18005bf0a
mov edx, 3
mov rcx, rdi
call sym.DNSAPI.dll_DnsValidateName_W
test eax, eax
je 0x18005bf03
cmp eax, 0x2554
jne 0x18005bf0a
mov eax, 0x200
jmp 0x18005becf
bt ebx, 8
jae 0x18005becd
mov edx, 3
mov rcx, rdi
call sym.DNSAPI.dll_DnsValidateName_W
test eax, eax
je 0x18005bf28
cmp eax, 0x2554
jne 0x18005becd
mov eax, 0x100
jmp 0x18005becf
Function at 0x18005c850
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov eax, edx
xor esi, esi
mov rdi, rcx
test eax, eax
lea rcx, [0x180023270]
lea rax, [rsp + 0x40]
lea rdx, [0x18005c9d0]
mov r9d, 0x20019
mov qword [rsp + 0x40], rsi
cmove rdx, rcx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rsi
mov ebx, esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x18005c923
lea rcx, [0x18005ca50]
mov edx, eax
call fcn.18000f00c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18005c8e8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18005c8f8
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.180001000
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x18005c8ca
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x180022158]
xor r8d, r8d
mov dword [rsp + 0x30], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x18005c8d8
cmp dword [rsp + 0x48], 1
jne 0x18005c8d8
mov eax, dword [rsp + 0x30]
shr rax, 1
add rax, rax
cmp rax, 0x802
jae 0x18005c9c5
mov word [rsp + rax + 0x50], si
cmp word [rsp + 0x50], si
je 0x18005c8d8
lea rcx, [rsp + 0x50]
call fcn.180001be0
mov rbx, rax
jmp 0x18005c8d8
call fcn.18004d94c
int3

Function at 0x18005fd10
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [0x18008a130]
lea rax, [0x18008a130]
cmp rcx, rax
je 0x18005fd5a
test dword [rcx + 0x1c], 0x400
je 0x18005fd5a
mov rax, qword [rbx + 0x40]
movzx edx, word [rbx + 0x10]
mov r9, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
mov eax, dword [rbx + 0x14]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
call fcn.1800602cc
test rbx, rbx
je 0x18005fd7b
mov edx, 1
cmp dword [rbx + 4], edx
jne 0x18005fd7b
cmp dword [rbx], 0x70
jb 0x18005fd7b
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp 0x18005fa7c
mov eax, 0x57
add rsp, 0x40
pop rbx
ret
Function at 0x18006114c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rdi, rdx
xor ebx, ebx
mov rcx, qword [0x18008a130]
lea r12, [0x18008a130]
lea esi, [rbx + 0x13]
cmp rcx, r12
je 0x1800611a3
test dword [rcx + 0x1c], 0x400
je 0x1800611a3
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x29]
lea r8, [0x180082710]
mov r9d, esi
mov qword [rax - 0x18], rdi
call fcn.18005c308
mov ecx, 0x410
mov qword [rdi], rsi
mov dword [rdi + 8], ebx
call fcn.180008d40
mov rsi, rax
test rax, rax
je 0x180061294
lea r8, [0x1800612b0]
mov edx, 0x104
mov rcx, rax
lea rbp, [rax + 0x208]
call fcn.1800091c0
mov r8, qword [0x18008b320]
mov edx, 0x104
mov rcx, rsi
call fcn.180018090
mov rcx, qword [0x18008a130]
cmp rcx, r12
je 0x18006121b
test dword [rcx + 0x1c], 0x400
je 0x18006121b
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082710]
mov edx, 0x2a
mov r9, rsi
call fcn.18005b04c
mov r8d, 0x104
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_2_0.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x102
ja 0x18006124d
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 0xa]
call qword [sym.imp.api_ms_win_core_crt_l1_1_0.dll_wcstoul]
mov ebx, 1
mov dword [rdi + 4], eax
mov dword [rdi + 8], ebx
mov rcx, qword [0x18008a130]
cmp rcx, r12
je 0x18006128a
test dword [rcx + 0x1c], 0x400
je 0x18006128a
mov r9d, dword [rdi + 4]
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082710]
mov dword [rsp + 0x28], r9d
mov edx, 0x2b
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.180058914
mov rcx, rsi
call fcn.180008b84
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x180061868
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
and dword [rsp + 0x68], 0
lea rax, [r11 - 0x18]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], r8
xor r8d, r8d
mov dword [rsp + 0x30], 4
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1800618ac
cmp dword [rsp + 0x68], 4
jne 0x1800618a7
cmp dword [rsp + 0x30], 4
je 0x1800618ac
mov eax, 0x3f2
add rsp, 0x48
ret

Function at 0x180062544
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rsp + 0x28], r8d
xor r9d, r9d
mov dword [rsp + 0x20], edx
lea edx, [r9 + 2]
xor r8d, r8d
call fcn.1800153fc
mov rbx, rax
test rax, rax
je 0x180062593
lea r9, [rsp + 0x58]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov rcx, rax
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1800625b0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov ebx, ecx
mov rcx, qword [0x18008a130]
lea rdi, [0x18008a130]
cmp rcx, rdi
je 0x180062609
test byte [rcx + 0x1c], 8
je 0x180062609
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082740]
mov edx, 0xa
mov r9d, ebx
call fcn.180058fb0
mov rcx, qword [0x18008a130]
test ebx, ebx
jne 0x180062619
cmp dword [0x18008a01c], ebx
jne 0x1800626c8
mov ebx, 0x202
cmp rcx, rdi
je 0x180062644
test dword [rcx + 0x1c], 0x400
je 0x180062644
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082740]
mov edx, reloc.WS2_32.dll_inet_addr
mov r9d, ebx
call fcn.180058fb0
lea rdx, [rsp + 0x30]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov ebx, eax
test eax, eax
je 0x180062688
mov rcx, qword [0x18008a130]
cmp rcx, rdi
je 0x180062684
test dword [rcx + 0x1c], 0x400
je 0x180062684
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082740]
mov edx, reloc.WS2_32.dll_inet_ntoa
mov r9d, eax
call fcn.180058fb0
mov eax, ebx
jmp 0x1800626ca
mov rcx, qword [0x18008a130]
cmp rcx, rdi
je 0x1800626c1
test dword [rcx + 0x1c], 0x400
je 0x1800626c1
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x32]
mov rcx, qword [rcx + 0x10]
lea r8, [0x180082740]
mov edx, reloc.WS2_32.dll_listen
mov dword [rsp + 0x20], eax
call fcn.18005b9d0
lock inc dword [0x18008a01c]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180001000
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1e0
pop rdi
ret