joyce8/EMBER2024-capa huggingface dataset:
Function at 0x21015e7d0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x4f8
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 8]
mov rbx, qword [rdx - 0x1c08]
mov r12, rcx
test rbx, rbx
je 0x21015e898
lea r13, [r12 + 0xb0]
xor edx, edx
mov rcx, r13
call method.pthread_mutex.lock__LARGE_INTEGER_
cmp byte [r12 + 0x70], 0
je 0x21015e8f0
mov eax, dword [r12 + 0x78]
test eax, eax
je 0x21015e8d0
cmp dword [r12 + 0x74], 1
je 0x21015e8d0
cmp r12, rbx
je 0x21015e97e
mov rcx, qword [r12 + 0x10]
call sym.SuspendThread
mov rcx, qword [r12 + 0x10]
xor edx, edx
call sym.WaitForSingleObject
cmp eax, 0x102
je 0x21015e900
mov rcx, r13
call method.pthread_mutex.unlock__
mov byte [r12 + 0x72], 1
mov rcx, qword [r12 + 0x88]
call sym.SetEvent
mov rcx, qword [r12 + 0x10]
call sym.ResumeThread
xor eax, eax
add rsp, 0x4f8
pop rbx
pop r12
pop r13
pop r14
ret
mov rdx, qword [rax + 8]
lea rbx, [0x21032c4c0]
mov dword [0x21032c4c8], 0
sub rdx, 0x3200
mov qword [0x21032c540], rdx
mov rax, qword [rax + 8]
mov qword [rax - 0x1c08], rbx
jmp 0x21015e7fe
mov rcx, r13
call method.pthread_mutex.unlock__
mov byte [r12 + 0x72], 1
mov rcx, qword [r12 + 0x88]
call sym.SetEvent
jmp 0x21015e884
mov rcx, r13
call method.pthread_mutex.unlock__
jmp 0x21015e884
mov rcx, qword [r12 + 0x10]
lea r14, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100001
mov rdx, r14
call sym.GetThreadContext
mov rdx, qword [r12 + 0x80]
mov rcx, qword [0x21023d810]
call method.init_cygheap.find_tls__cygtls_
mov rcx, qword [r12 + 0x80]
mov rdx, r14
mov rbx, rax
call method._cygtls.inside_kernel__CONTEXT_
test al, al
je 0x21015e960
test rbx, rbx
je 0x21015e85f
mov rcx, qword [rbx + 8]
call sym.ReleaseMutex
jmp 0x21015e85f
mov rcx, qword [r12 + 0x10]
lea rax, [method.pthread.static_cancel_self__]
mov rdx, r14
mov qword [rsp + 0x118], rax
call sym.SetThreadContext
jmp 0x21015e945
mov rcx, r13
call method.pthread_mutex.unlock__
mov rcx, r12
call method.pthread.cancel_self__
nop
nop

Function at 0x210160320
Capabilities:
Suspend thread

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
xor r9d, r9d
mov edx, 0xdf0df045
mov qword [rsp + 0x20], 0
mov rbx, rcx
call sym.verifyable_object_isvalid_void_const__unsigned_int__void__void__void_
mov r8d, eax
mov eax, 3
test r8d, r8d
jne 0x210160359
mov rax, qword [rbx]
cmp byte [rax + 0x71], 0
je 0x210160360
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov byte [rax + 0x71], 1
mov rcx, qword [rax + 0x10]
call sym.SuspendThread
jmp 0x210160357

Function at 0x210160370
Capabilities:
Resume thread

Disassembly:
push r12
push rbx
sub rsp, 0x38
xor r9d, r9d
xor r8d, r8d
mov edx, 0xdf0df045
mov r12d, 3
mov qword [rsp + 0x20], 0
mov rbx, rcx
call sym.verifyable_object_isvalid_void_const__unsigned_int__void__void__void_
test eax, eax
jne 0x2101603a9
mov rax, qword [rbx]
xor r12d, r12d
cmp byte [rax + 0x71], 0
jne 0x2101603b8
mov eax, r12d
add rsp, 0x38
pop rbx
pop r12
ret
mov rcx, qword [rax + 0x10]
call sym.ResumeThread
mov rax, qword [rbx]
mov byte [rax + 0x71], 0
mov eax, r12d
add rsp, 0x38
pop rbx
pop r12
ret
Function at 0x210160cd0
Capabilities:
Set thread local storage value

Disassembly:
push r12
sub rsp, 0x30
xor r8d, r8d
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r12, rdx
mov edx, 0xdf0df047
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x40]
call sym.verifyable_object_isvalid_void_const__unsigned_int__void__void__void_
mov r8d, eax
mov eax, 0x16
test r8d, r8d
jne 0x210160d1b
mov rax, qword [rsp + 0x40]
mov rdx, r12
mov ecx, dword [rax + 0xc]
call sym.TlsSetValue
xor eax, eax
add rsp, 0x30
pop r12
ret

Function at 0x210160d30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
xor r8d, r8d
xor r9d, r9d
mov edx, 0xdf0df047
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x40]
call sym.verifyable_object_isvalid_void_const__unsigned_int__void__void__void_
mov r8d, eax
xor eax, eax
test r8d, r8d
jne 0x210160d6e
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0xc]
call sym.TlsGetValue
add rsp, 0x38
ret
Function at 0x210165f80
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
mov eax, dword [0x21034b024]
mov edi, dword [rcx + 0x4c]
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov esi, edx
call sym.GetCurrentProcessId
cmp edi, eax
je 0x210166106
lea rax, [rsp + 0x58]
mov qword [rbx + 0x40], 0
mov rcx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x58]
lea r8, [rbx + 0x40]
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.NtMapViewOfSection
test eax, eax
js 0x210166111
mov dword [rsp + 0x20], 0
lea rdi, [rsp + 0x60]
xor r9d, r9d
lea rcx, [rbx + 0x30]
mov r8, rdi
mov edx, 0x1f0003
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call sym.NtCreateEvent
test eax, eax
js 0x210166159
xor r9d, r9d
lea rcx, [rbx + 0x38]
mov r8, rdi
mov edx, 0x1f0003
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x60], 0x30
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
call sym.NtCreateEvent
test eax, eax
js 0x210166135
call sym.GetCurrentProcessId
mov ecx, 0x58
lea rsi, str.timerfd
mov dword [rbx + 0x4c], eax
call method.cygthread.operator_new_unsigned_long_
mov rcx, rax
mov rax, qword [rbx + 0x38]
mov qword [rcx + 0x28], rsi
lea rsi, [sym.timerfd_thread_void_]
mov qword [rcx + 0x30], rsi
mov dword [rcx + 0x38], 0
mov qword [rcx + 0x40], rbx
mov qword [rcx + 0x50], rax
call method.cygthread.create__
nop
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.fork
test sil, sil
lea rdx, str.execve
mov r8d, eax
cmove rdx, rcx
lea rcx, str.Cant_recreate_shared_timerfd_section_during__s__status__y_
call sym.api_fatal
lea rcx, str.fork
test sil, sil
lea rdx, str.execve
mov r8d, eax
cmove rdx, rcx
lea rcx, str.Cant_recreate_timerfd_sync_event_during__s__status__y_
call sym.api_fatal
lea rcx, str.fork
test sil, sil
lea rdx, str.execve
mov r8d, eax
cmove rdx, rcx
lea rcx, str.Cant_recreate_timerfd_cancel_event_during__s__status__y_
call sym.api_fatal
nop
nop
Function at 0x210166360
Capabilities:
Access peb ldr_data

Disassembly:
push rsi
push rbx
sub rsp, 0xa8
mov qword [rsp + 0xc0], rcx
mov rbx, rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x60]
mov rax, qword [rax - 0x1bf8]
mov qword [rsp + 0x60], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov rax, qword [rax - 0x2cc8]
mov qword [rsp + 0x68], rax
lea rax, [0x210166520]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rsp
mov rax, qword [rsp + 0xc0]
mov edx, 0xffffffff
mov rcx, qword [rax + 8]
call sym.WaitForSingleObject
and al, 0x7f
neg eax
sbb eax, eax
and eax, 0xfffffff7
mov dword [rsp + 0x3c], eax
mov rax, qword gs:[0x30]
mov rdx, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x80]
mov rax, qword [rax - 0x1bf8]
mov qword [rsp + 0x80], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov rax, qword [rax - 0x2cc8]
mov qword [rsp + 0x88], rax
lea rax, [0x210166570]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rsp
mov rax, qword [rsp + 0xc0]
xor edx, edx
mov r9d, 8
lea r8, [rsp + 0x48]
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], 0
call sym.NtQueryEvent
mov rsi, qword [rsp + 0xc0]
mov rdx, qword [rsi + 0x40]
test eax, eax
js 0x210166590
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x210166590
movdqu xmm0, xmmword [rdx + 8]
mov dword [rsp + 0x3c], 0
movups xmmword [rbx], xmm0
mov rax, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rdx
mov rax, qword gs:[0x30]
mov rdx, qword [rsp + 0x80]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rax + 8]
call sym.ReleaseMutex
mov eax, dword [rsp + 0x3c]
add rsp, 0xa8
pop rbx
pop rsi
ret
mov rcx, qword [rdx]
mov rsi, qword [rdx + 0x28]
call sym.get_clock_unsigned_long_
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, rax
mov rax, qword [rax]
call qword [rax]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x3c], 0
movabs rdx, 0xa3d70a3d70a3d70b
imul r8, qword [rsp + 0x50], 0x989680
mov rax, rcx
imul rdx
add rdx, rcx
sar rcx, 0x3f
sar rdx, 6
sub rdx, rcx
add r8, rdx
movabs rdx, 0xd6bf94d5e57a42bd
sub rsi, r8
mov rax, rsi
imul rdx
lea rax, [rdx + rsi]
mov rdx, rsi
sar rdx, 0x3f
sar rax, 0x17
sub rax, rdx
mov qword [rbx + 0x10], rax
imul rax, rax, 0xffffffffff676980
add rax, rsi
lea rax, [rax + rax*4]
lea rax, [rax + rax*4]
shl rax, 2
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax + 0x40]
mov rdx, qword [rax + 0x10]
mov rax, qword [rax + 8]
mov qword [rbx + 8], rdx
mov qword [rbx], rax
jmp 0x2101664de
Function at 0x210166b10
Capabilities:
Get system information on windows

Disassembly:
push r12
sub rsp, 0x90
mov qword [rsp + 0xa0], rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
lea rdx, [rsp + 0x70]
mov rax, qword [rax - 0x1bf8]
mov qword [rsp + 0x70], rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 8]
mov rax, qword [rax - 0x2cc8]
mov qword [rsp + 0x78], rax
lea rax, [0x210166ce8]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rsp
cmp qword [0x21032c6a0], 0
jne 0x210166bb0
xor r9d, r9d
mov r8d, 0x30
mov ecx, 3
lea rdx, [0x21032c6a0]
call sym.NtQuerySystemInformation
nop word [rax + rax]
mov r9d, 0x20
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], 0
mov edx, 4
mov rcx, 0xffffffffffffffff
call sym.NtQueryInformationProcess
mov rax, qword [0x21034b1a0]
test byte [rax + 0x10], 0x40
jne 0x210166de0
lea rcx, [rsp + 0x48]
call sym.GetSystemTimeAsFileTime
movabs r8, 0x346dc5d63886594b
mov rcx, qword [rsp + 0x48]
sub rcx, qword [0x21032c6a0]
mov rax, rcx
mov qword [rsp + 0x48], rcx
sar rcx, 0x3f
imul r8
sar rdx, 0xb
sub rdx, rcx
cmp qword [rsp + 0xa0], 0
mov r12, rdx
je 0x210166d55
mov rax, r8
mul qword [rsp + 0x60]
mov rax, qword [rsp + 0xa0]
movabs rcx, 0x19db1ded53e8000
mov r9, qword [0x21024fce8]
shr rdx, 0xb
mov qword [rax + 8], rdx
mov rax, r8
mul qword [rsp + 0x68]
mov rax, qword [rsp + 0xa0]
shr rdx, 0xb
mov qword [rax], rdx
mov rax, qword [r9 + 0xfce0]
imul rdx, qword [r9 + 0xfcd8], 0x989680
lea rax, [rax + rax*4]
lea rdx, [rdx + rax*2]
lea rax, [rdx + rcx]
mov qword [rsp + 0x60], rax
mov rax, rdx
mul r8
mov rax, qword [rsp + 0xa0]
shr rdx, 0xb
mov qword [rax + 0x18], rdx
mov rax, qword [r9 + 0xfcd0]
imul rdx, qword [r9 + 0xfcc8], 0x989680
lea rax, [rax + rax*4]
lea rdx, [rdx + rax*2]
mov rax, rdx
add rcx, rdx
mul r8
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x68], rcx
shr rdx, 0xb
mov qword [rax + 0x10], rdx
jmp 0x210166d55
mov rax, qword gs:[0x30]
mov rdx, qword [rsp + 0x70]
mov rax, qword [rax + 8]
mov qword [rax - 0x1bf8], rdx
test byte [0x210273880], 1
jne 0x210166d98
mov rax, r12
add rsp, 0x90
pop r12
ret
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], r12
lea r9, str._D__times__p_
lea r8, str.clock_t_times_tms_
mov edx, 0x10
lea rcx, [0x210273880]
mov qword [rsp + 0x28], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
mov rax, r12
add rsp, 0x90
pop r12
ret
lea rcx, [rsp + 0x48]
call fcn.21022cd90
jmp 0x210166bf0

Function at 0x210168ba0
Capabilities:
Print debug messages

Disassembly:
mov rax, qword [0x21024fce8]
mov edx, dword [rax + 0x10]
test edx, edx
jne 0x210168bb4
test byte [rax + 4], 0x80
je 0x210168bb8
ret
mov rax, qword [0x21023d810]
lea rcx, [rax + 0x4900]
jmp method.dtable.get_debugger_info__
Function at 0x210169bf0
Capabilities:
Query environment variable

Disassembly:
push r13
mov eax, 0x10038
push r12
push rsi
push rbx
call fcn.21021b550
sub rsp, rax
xor r13d, r13d
lea rsi, [rsp + 0x30]
mov r12, rdx
mov rbx, r8
mov r8d, 0x7fff
mov rdx, rsi
call sym.GetEnvironmentVariableW
lea edx, [rax - 1]
cmp edx, 0x7ffd
jbe 0x210169c40
mov rax, r13
add rsp, 0x10038
pop rbx
pop rsi
pop r12
pop r13
ret
mov r9d, eax
mov r8, rsi
mov rdx, rbx
mov rcx, r12
mov dword [rsp + 0x20], 0
call sym._sys_wcstombs_char__unsigned_long__wchar_t_const__unsigned_long__bool_
test eax, eax
je 0x210169c2a
mov r13d, eax
xor eax, eax
cmp r13, rbx
cmovae r13, rax
jmp 0x210169c2a
Function at 0x2101720c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x180], 0
mov rbx, rcx
je 0x2101720e0
add rsp, 0x20
pop rbx
ret
call sym.GetSystemInfo
mov dword [rbx + 0x30], 0x11c
lea rcx, [rbx + 0x30]
call sym.RtlGetVersion
lea rdx, [rbx + 0x38]
lea r8, [rbx + 0x3c]
lea rcx, [rbx + 0x34]
call sym.RtlGetNtVersionNumbers
movzx edx, word [rbx + 0x3c]
mov r8d, dword [rbx + 0x34]
mov dword [rbx + 0x3c], edx
cmp r8d, 6
je 0x210172180
cmp edx, 0x47b9
jbe 0x2101721f8
lea rax, [0x21034b1b0]
cmp byte [rbx + 0x14a], 1
mov r9d, dword [rbx + 0x38]
mov qword [rbx + 0x178], 0
mov qword [rbx + 0x180], rax
mov eax, dword [0x21034b1c0]
setne dl
lea rcx, [rbx + 0x14c]
and edx, 1
add dword [0x21034b1b0], 1
and eax, 0xfff7fdf4
or eax, edx
mov dword [0x21034b1c0], eax
lea rdx, str.NT__d._d
add rsp, 0x20
pop rbx
jmp sym.__small_sprintf
mov edx, dword [rbx + 0x38]
lea rax, [0x21034b2d0]
cmp edx, 1
je 0x2101721af
lea rax, [0x21034b2b0]
cmp edx, 2
je 0x2101721af
test edx, edx
lea rax, [0x21034b290]
lea rdx, [0x21034b2f0]
cmove rax, rdx
movzx edx, byte [rax + 0x10]
cmp byte [rbx + 0x14a], 1
mov qword [rbx + 0x180], rax
setne cl
and edx, 0xfffffffe
or edx, ecx
lea rcx, [rbx + 0x14c]
mov byte [rax + 0x10], dl
mov qword [rbx + 0x178], 0
add dword [rax], 1
mov r9d, dword [rbx + 0x38]
and dword [rax + 0x10], 0xfff7fdf5
mov r8d, dword [rbx + 0x34]
jmp 0x21017216e
lea rax, [0x21034b1d0]
cmp edx, 0x4562
ja 0x2101721af
lea rax, [0x21034b1f0]
cmp edx, 0x42ed
ja 0x2101721af
lea rax, [0x21034b210]
cmp edx, 0x3faa
ja 0x2101721af
lea rax, [0x21034b230]
cmp edx, 0x3ad6
ja 0x2101721af
cmp edx, 0x3839
lea rax, [0x21034b270]
lea rdx, [0x21034b250]
cmovae rax, rdx
jmp 0x2101721af
Function at 0x210181070
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov r11, rdx
cmp rdx, 2
jbe 0x210181208
movzx ebx, byte [rcx]
movzx eax, byte [rcx + 1]
lea r10, [rcx + 3]
sub r11, 3
movzx esi, byte [rcx + 2]
mov edi, ebx
shl ebx, 4
mov edx, eax
shr dl, 4
mov ecx, ebx
shl eax, 2
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
and ecx, 0x30
and eax, 0x3c
shr dil, 2
add ecx, edx
mov edx, esi
and esi, 0x3f
shr dl, 6
add edx, eax
mov eax, 4
cmp r9, 3
ja 0x210181118
jmp 0x2101811f8
movzx ecx, byte [r10]
add r10, 3
add rax, 4
sub r11, 3
movzx edx, byte [r10 - 2]
movzx esi, byte [r10 - 1]
mov edi, ecx
shl ecx, 4
mov ebp, edx
and ecx, 0x30
shl edx, 2
shr bpl, 4
and edx, 0x3c
shr dil, 2
add ecx, ebp
mov ebp, esi
and esi, 0x3f
shr bpl, 6
add edx, ebp
cmp r9, rax
jb 0x2101811f8
and ecx, 0x7f
and edx, 0x7f
and edi, 0x3f
movzx ecx, byte [rbx + rcx]
movzx edi, byte [rbx + rdi]
mov byte [r8 + rax - 3], cl
movzx ecx, byte [rbx + rdx]
mov rdx, rsi
and edx, 0x3f
mov byte [r8 + rax - 4], dil
movzx edx, byte [rbx + rdx]
mov byte [r8 + rax - 2], cl
mov byte [r8 + rax - 1], dl
cmp r11, 2
ja 0x2101810d0
test r11, r11
jne 0x210181170
cmp rax, r9
jae 0x2101811f8
mov byte [r8 + rax], 0
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx edx, byte [r10]
cmp r11, 2
jne 0x210181202
movzx ecx, byte [r10 + 1]
mov ebx, ecx
shl ecx, 2
shr bl, 4
and ecx, 0x3c
mov r10d, edx
shl edx, 4
lea rsi, [rax + 4]
and edx, 0x30
shr r10b, 2
add edx, ebx
cmp rsi, r9
ja 0x2101811f8
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
and r10d, 0x3f
and edx, 0x7f
movzx r10d, byte [rbx + r10]
movzx edx, byte [rbx + rdx]
mov byte [r8 + rax], r10b
lea r10, [r8 + rax + 2]
mov byte [r8 + rax + 1], dl
add rax, 3
mov edx, 0x3d
cmp r11, 1
je 0x2101811e1
movzx ecx, cl
movzx edx, byte [rbx + rcx]
mov byte [r10], dl
mov byte [r8 + rax], 0x3d
mov rax, rsi
jmp 0x21018115a
mov eax, 0xffffffff
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ecx, ecx
xor ebx, ebx
jmp 0x21018118e
mov r10, rcx
xor eax, eax
jmp 0x210181155
Function at 0x2101861d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rbx
sub rsp, 0x140
lea rbp, [rsp + 0x80]
lea r13, str.TcpipParameters
mov rdx, r13
mov r12, rcx
test byte [rcx + 8], 2
jne 0x210186340
mov ecx, 1
call sym.RtlCheckRegistryKey
test eax, eax
js 0x210186320
xor eax, eax
lea rdi, [rbp - 0x20]
mov ecx, 0x1c
xor r9d, r9d
rep stosq qword [rdi], rax
lea r15, [rbp - 0x50]
lea r14, [rbp - 0x40]
mov rdx, r13
lea rax, str.NameServer
lea rdi, [rbp - 0x30]
mov dword [rbp - 0x50], 0
mov ecx, 1
mov qword [rbp - 0x10], rax
lea rax, str.DhcpNameServer
lea r8, [rbp - 0x20]
mov qword [rbp + 0x28], rax
lea rax, str.SearchList
mov qword [rbp - 0x48], 0
mov dword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x18], 0x30
mov qword [rbp - 8], r15
mov dword [rbp + 0x20], 0x30
mov qword [rbp + 0x30], r14
mov dword [rbp + 0x58], 0x30
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rdi
mov qword [rsp + 0x20], 0
call sym.RtlQueryRegistryValues
test eax, eax
js 0x210186358
mov edx, dword [r12 + 0x10]
test edx, edx
je 0x210186370
cmp qword [r12 + 0x48], 0
je 0x2101863a0
cmp qword [rbp - 0x48], 0
je 0x2101862e9
mov rcx, r15
call sym.RtlFreeUnicodeString
cmp qword [rbp - 0x38], 0
je 0x2101862f8
mov rcx, r14
call sym.RtlFreeUnicodeString
cmp qword [rbp - 0x28], 0
je 0x210186308
mov rcx, rdi
call sym.RtlFreeUnicodeString
nop
lea rsp, [rbp + 0xc0]
pop rbx
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
test byte [r12 + 8], 2
je 0x210186308
mov edx, eax
lea rcx, str.RtlCheckRegistryKey:_status__p_n
call sym.minires_dprintf
jmp 0x210186308
lea rcx, str.key__s_n
call sym.minires_dprintf
mov rdx, r13
jmp 0x210186201
test byte [r12 + 8], 2
je 0x210186308
mov edx, eax
lea rcx, str.RtlQueryRegistryValues:_status__p_n
call sym.minires_dprintf
jmp 0x210186308
xor r8d, r8d
mov rdx, r12
mov rcx, r15
call sym.get_registry_dns_items
mov eax, dword [r12 + 0x10]
test eax, eax
jne 0x2101862ce
xor r8d, r8d
mov rdx, r12
mov rcx, r14
call sym.get_registry_dns_items
jmp 0x2101862ce
movzx r8d, word [rbp - 0x30]
test r8w, r8w
je 0x2101862da
lea rax, [r8 + 0xf]
mov r13, rsp
and eax, 0x1fff0
call fcn.21021b550
mov rdx, qword [rbp - 0x28]
sub rsp, rax
lea rbx, [rsp + 0x30]
mov rcx, rbx
call sym.msys_2.0.dll_wcstombs
mov rdx, r12
mov rcx, rbx
call sym.minires_get_search
mov rsp, r13
jmp 0x2101862da
Function at 0x210187ee0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13d, dword [rsp + 0x90]
mov r14, qword [rsp + 0xb0]
mov rsi, rcx
mov ebx, edx
mov r12, r8
mov edi, r9d
test edx, edx
jne 0x210188028
mov eax, dword [rsp + 0xb8]
lea rbp, [r14 + 0xc]
xor r9d, r9d
mov rcx, r12
mov qword [rsp + 0x20], 0
mov rdx, rbp
lea r8d, [rax - 0x10]
call sym.__dn_comp_1
test eax, eax
js 0x210188011
movzx edx, word [rsi + 0x44]
rol di, 8
mov qword [r14 + 2], 0x1000001
mov r8d, r13d
rol dx, 8
mov word [r14], dx
xor edx, edx
mov word [r14 + 0xa], dx
movsxd rdx, eax
add rbp, rdx
mov edx, r13d
rol dx, 8
mov word [rbp + 2], di
mov word [rbp], dx
movsx edx, byte [r12]
test dl, dl
je 0x210187f9a
nop
mov ecx, ebx
add r12, 1
add ebx, 3
and ecx, 0xf
shl edx, cl
xor r8d, edx
movsx edx, byte [r12]
test dl, dl
jne 0x210187f80
movzx ecx, word [rsi + 0x44]
mov edi, r8d
mov edx, ecx
imul ecx, ecx, 0x8889
mov r9d, edx
shr ecx, 0x13
mov r10d, ecx
shl r10d, 4
sub r10d, ecx
mov ecx, 0x10
sub r9d, r10d
mov r10d, r8d
add r9d, 1
movzx r9d, r9w
sub ecx, r9d
shr r10d, cl
mov ecx, r9d
shl edi, cl
mov ecx, 0x20
sub ecx, r9d
xor r10d, edi
shr r8d, cl
mov ecx, r10d
xor ecx, r8d
mov r8d, edx
add edx, 1
xor r8d, ecx
test cx, cx
cmovne edx, r8d
add eax, 0x10
mov word [rsi + 0x44], dx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test byte [rsi + 8], 2
jne 0x210188035
mov dword [rsi + 0x1f0], 0xffffffff
mov eax, 0xffffffff
jmp 0x210188002
call sym.msys_2.0.dll___errno
mov dword [rax], 0x58
jmp 0x210188017
mov rdx, r12
lea rcx, str.__s__invalid_or_buffer_too_short_n
call sym.minires_dprintf
jmp 0x210188017
Function at 0x21019dde0
Capabilities:
Read file on windows

Disassembly:
push r12
sub rsp, 0x50
mov r10, qword [rcx + 0x58]
test r10, r10
je 0x21019df07
cmp r10, 0xffffffffffffffff
je 0x21019dee8
cmp byte [rcx + 0x61], 0
jne 0x21019dec9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x4c]
mov rcx, r10
call sym.ReadFile
test eax, eax
je 0x21019de30
mov eax, dword [rsp + 0x4c]
add rsp, 0x50
pop r12
ret
mov r12, qword [0x2102c8eb0]
test byte [r12], 1
jne 0x21019de62
mov rax, qword [sym.msys_2.0.dll__impure_ptr]
mov rax, qword [rax]
mov dword [rax], 0x16
call sym.msys_2.0.dll___errno
mov dword [rax], 0x16
mov rax, 0xffffffffffffffff
jmp 0x21019de25
call sym.GetLastError
lea r9, str.error_reading_from_pipe___u_
mov edx, 0x40
mov rcx, r12
mov dword [rsp + 0x20], eax
lea r8, str.virtual_ssize_t_transport_layer_pipes::read_void__size_t_
call method.strace.prntf_unsigned_int__char_const__char_const__..._
test byte [r12], 1
je 0x21019de3e
mov dword [rsp + 0x30], 0x16
mov edx, 0x40
mov rcx, r12
lea rax, str.virtual_ssize_t_transport_layer_pipes::read_void__size_t_
mov dword [rsp + 0x28], 0xcf
lea r9, str._s:_d_setting_errno__d
lea r8, str.int___set_errno_const_char__int__int_
mov qword [rsp + 0x20], rax
call method.strace.prntf_unsigned_int__char_const__char_const__..._
jmp 0x21019de3e
lea r9, str.__is_listening_endpoint
lea r8, str.virtual_ssize_t_transport_layer_pipes::read_void__size_t_
mov edx, 0xc9
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
lea r9, str._hPipe___INVALID_HANDLE_VALUE
lea r8, str.virtual_ssize_t_transport_layer_pipes::read_void__size_t_
mov edx, 0xc8
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
lea r9, str._hPipe
lea r8, str.virtual_ssize_t_transport_layer_pipes::read_void__size_t_
mov edx, 0xc7
lea rcx, str._usr_src_MSYS2_packages_msys2_runtime_src_msys2_runtime_winsup_cygserver_transport_pipes.cc
call sym.msys_2.0.dll___assert_func
nop
nop
nop dword [rax + rax]