joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b6b0
Capabilities:
Create directory
Delete file
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x40
xor eax, eax
mov rdi, rcx
mov ecx, 0x410
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], 0x18
call fcn.18001ab88
mov ecx, 0x410
mov r14, rax
call fcn.18001ab88
mov ecx, 0x410
mov r12, rax
call fcn.18001ab88
mov ecx, 0x410
mov rbp, rax
call fcn.18001ab88
mov ecx, 0x410
mov r13, rax
call fcn.18001ab88
mov rdx, r14
mov ecx, 0x208
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.18001d31c
call fcn.18001d334
lea rdx, [0x180039a88]
mov r9d, eax
mov r8, r14
mov rcx, r12
lea ebx, [rax + 1]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r9, [0x180039af0]
lea rdx, [0x180039ad8]
mov r8, r12
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str._s_d
mov r9d, ebx
mov r8, rbp
mov rcx, r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, r13
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
lea rdx, str._s_d
mov r9d, ebx
mov r8, r12
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test r14, r14
je 0x18000b809
mov rcx, r14
call fcn.18001c9dc
test r12, r12
je 0x18000b816
mov rcx, r12
call fcn.18001c9dc
test rbp, rbp
je 0x18000b823
mov rcx, rbp
call fcn.18001c9dc
test r13, r13
je 0x18000b830
mov rcx, r13
call fcn.18001c9dc
test rsi, rsi
je 0x18000b83d
mov rcx, rsi
call fcn.18001c9dc
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov al, 1
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x180011690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov dword [rcx + 0x6afc8], 2
mov esi, ebp
mov edi, ebp
cmp dword [rcx + 0x6afd8], ebp
je 0x1800118bc
cmp dword [rbx + 0x6afd8], 3
jb 0x180011721
mov r8d, dword [rbx + 0x6afcc]
lea eax, [r8 + 2]
movzx edx, byte [rax + rbx + 0x1afb8]
mov eax, dword [rbx + 0x6afc4]
shl eax, 5
xor edx, eax
and edx, 0x7fff
and r8d, 0x7fff
mov eax, edx
mov dword [rbx + 0x6afc4], eax
mov esi, dword [rbx + rdx*4 + 0x4afb8]
mov dword [rbx + r8*4 + 0x2afb8], esi
mov ecx, dword [rbx + 0x6afc4]
mov eax, dword [rbx + 0x6afcc]
mov dword [rbx + rcx*4 + 0x4afb8], eax
test esi, esi
je 0x18001175f
mov eax, dword [rbx + 0x6afcc]
sub eax, esi
cmp eax, 0x7efa
ja 0x18001175f
mov eax, dword [rbx + 0x6afd8]
cmp dword [rbx + 0x6afe8], eax
jbe 0x180011748
mov dword [rbx + 0x6afe8], eax
mov edx, esi
mov rcx, rbx
call fcn.180011340
mov ecx, dword [rbx + 0x6afd8]
cmp eax, ecx
mov edi, eax
cmova edi, ecx
mov rcx, rbx
cmp edi, 3
jb 0x18001183a
mov edx, dword [rbx + 0x6afcc]
lea r8d, [rdi - 3]
sub edx, dword [rbx + 0x6afd0]
call fcn.1800109b0
sub dword [rbx + 0x6afd8], edi
mov r11d, eax
cmp edi, dword [rbx + 0x6afe0]
ja 0x180011801
cmp dword [rbx + 0x6afd8], 3
jb 0x180011801
dec edi
nop dword [rax]
inc dword [rbx + 0x6afcc]
mov r8d, dword [rbx + 0x6afcc]
lea eax, [r8 + 2]
and r8d, 0x7fff
movzx edx, byte [rax + rbx + 0x1afb8]
mov eax, dword [rbx + 0x6afc4]
shl eax, 5
xor edx, eax
and edx, 0x7fff
dec edi
mov eax, edx
mov dword [rbx + 0x6afc4], eax
mov esi, dword [rbx + rdx*4 + 0x4afb8]
mov dword [rbx + r8*4 + 0x2afb8], esi
mov ecx, dword [rbx + 0x6afc4]
mov eax, dword [rbx + 0x6afcc]
mov dword [rbx + rcx*4 + 0x4afb8], eax
jne 0x1800117a0
jmp 0x180011859
add dword [rbx + 0x6afcc], edi
mov ecx, dword [rbx + 0x6afcc]
mov edi, ebp
movzx edx, byte [rcx + rbx + 0x1afb8]
lea eax, [rcx + 1]
mov dword [rbx + 0x6afc4], edx
movzx eax, byte [rax + rbx + 0x1afb8]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [rbx + 0x6afc4], eax
jmp 0x18001185f
mov eax, dword [rbx + 0x6afcc]
xor edx, edx
movzx r8d, byte [rax + rbx + 0x1afb8]
call fcn.1800109b0
dec dword [rbx + 0x6afd8]
mov r11d, eax
inc dword [rbx + 0x6afcc]
test r11d, r11d
je 0x18001189c
mov ecx, dword [rbx + 0x6afbc]
lea rdx, [rcx + rbx + 0x1afb8]
test ecx, ecx
jns 0x180011879
mov rdx, rbp
mov r8d, dword [rbx + 0x6afcc]
xor r9d, r9d
sub r8d, ecx
mov rcx, rbx
call fcn.180010760
mov r11d, dword [rbx + 0x6afcc]
mov dword [rbx + 0x6afbc], r11d
cmp dword [rbx + 0x6afd8], 0x106
jae 0x1800118b0
mov rcx, rbx
call fcn.180011520
cmp dword [rbx + 0x6afd8], ebp
jne 0x1800116c3
mov ecx, dword [rbx + 0x6afbc]
test ecx, ecx
js 0x1800118ce
lea rbp, [rcx + rbx + 0x1afb8]
mov r8d, dword [rbx + 0x6afcc]
mov r9d, 1
mov rdx, rbp
sub r8d, ecx
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.180010760
Function at 0x180012970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11, r8
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x180012989
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x1800394e0]
cmp r8, 8
jb 0x180012a8d
mov qword [rsp + 0x10], rbx
mov rbx, r8
shr rbx, 3
mov rax, rbx
imul rax, rax, 0xfffffffffffffff8
add r11, rax
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
dec rbx
jne 0x1800129c0
mov rbx, qword [rsp + 0x10]
test r11, r11
je 0x180012abf
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11
jne 0x180012aa0
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x180012f70
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x180013074
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
test rcx, rcx
je 0x180012fb2
cmp dword [rbx + 0x58], edi
jae 0x180012fb2
call fcn.18001c9dc
mov qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x180012fc8
lea ecx, [rdi + rdi]
call fcn.18001ab88
mov dword [rbx + 0x58], edi
mov qword [rbx + 0x50], rax
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov rbp, rdi
call fcn.18001bea0
test edi, edi
je 0x18001306b
xor r11d, r11d
lea rsi, [0x1800394e0]
nop dword [rax]
mov rax, qword [rbx + 0x50]
mov edx, dword [rbx + 0x44]
mov r8d, dword [rbx + 0x4c]
movsx r10, byte [r11 + rax]
mov ecx, edx
shr edx, 8
xor rcx, r10
mov r9d, r8d
inc r11
movzx eax, cl
and r9d, 0xfffd
mov ecx, dword [rsi + rax*4]
or r9d, 2
xor ecx, edx
mov dword [rbx + 0x44], ecx
movzx eax, cl
movzx ecx, r8b
add eax, dword [rbx + 0x48]
shr r8d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
movzx eax, byte [rbx + 0x4b]
xor rcx, rax
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
mov dword [rbx + 0x4c], eax
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
dec rbp
mov byte [r11 + rax - 1], cl
jne 0x180012ff0
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1800130c4
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x1800130a1
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call fcn.18001bea0
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800130fb
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x180013640
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0xb8]
mov rsi, rdx
test rcx, rcx
je 0x1800136cc
mov eax, dword [rdi + 0xc4]
mov qword [rsp + 0x48], rbp
mov ebp, dword [rdi + 0xc0]
cmp eax, ebp
jb 0x18001368d
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
sub ebp, eax
lea rdx, [rcx + rax]
mov rcx, rsi
cmp ebp, r8d
cmova ebp, r8d
mov r8d, ebp
call fcn.18001bea0
mov ecx, dword [rdi + 0xa0]
add dword [rdi + 0xc4], ebp
add dword [rdi + 0x9c], ebp
mov r8d, ebp
mov rdx, rsi
call fcn.180012970
mov dword [rdi + 0xa0], eax
mov eax, ebp
jmp 0x180013678
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x180013723
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001372a
mov ebx, dword [rsp + 0x40]
mov ecx, dword [rdi + 0xa0]
mov rdx, rsi
add dword [rdi + 0x9c], ebx
mov r8d, ebx
call fcn.180012970
mov dword [rdi + 0xa0], eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rdi + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1800149a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x1800149ec
cmp dword [0x180044fd4], edx
je 0x1800149ec
cmp qword [0x180046e58], 0
jne 0x1800149ec
xor eax, eax
lea r8, [0x1800148b0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
mov qword [0x180046e58], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180014a00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov r8, rcx
mov ebx, edx
lea rcx, str.127.0.0.1
mov edx, 0xff
mov esi, r9d
call fcn.18001c6dc
xor eax, eax
lea r8, [0x1800148b0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x180044fcc], ebx
mov dword [0x180044fd0], edi
mov dword [rsp + 0x20], eax
mov dword [0x180044fd4], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
or edx, 0xffffffff
mov qword [0x180046e58], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret

Function at 0x180014a90
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x1800148b0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
add rsp, 0x38
ret
Function at 0x1800156a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r13
sub rsp, 0x20
mov rax, rdx
mov rdi, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
mov r13, r8
mov dword [rsp + 0x40], 0
call fcn.1800150c0
movsxd r8, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, rax
mov rsi, rax
call fcn.18002aee0
test eax, eax
jne 0x180015712
lea rcx, [0x18003a0a0]
call fcn.180019dd0
mov rcx, rax
call fcn.180015050
mov r8d, dword [rsp + 0x40]
mov rdx, rsi
mov rcx, r13
call fcn.180015460
mov rcx, rsi
add rsp, 0x20
pop r13
pop rdi
pop rsi
jmp fcn.18001c9dc
mov qword [rsp + 0x50], rbp
movsxd rbp, dword [rsp + 0x40]
mov qword [rsp + 0x58], r12
test ebp, ebp
jle 0x18001573e
mov rcx, rsi
mov rdx, rbp
nop dword [rax + rax]
movzx eax, byte [rdi]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x180015730
mov eax, dword [rdi + 0x10]
test eax, eax
jle 0x18001579c
add eax, ebp
mov qword [rsp + 0x48], rbx
movsxd rcx, eax
call fcn.18001ab88
movsxd r8, dword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, rax
mov rbx, rax
call fcn.18001bea0
movsxd rcx, dword [rdi + 0x10]
mov r8, rbp
add rcx, rbx
mov rdx, rsi
call fcn.18001bea0
mov r11d, dword [rdi + 0x10]
mov rdx, rbx
lea r8d, [rbp + r11]
mov rcx, r13
call fcn.180015460
mov rcx, rbx
call fcn.18001c9dc
mov rbx, qword [rsp + 0x48]
jmp 0x1800157aa
mov r8d, ebp
mov rdx, rsi
mov rcx, r13
call fcn.180015460
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rcx, rsi
add rsp, 0x20
pop r13
pop rdi
pop rsi
jmp fcn.18001c9dc

Function at 0x18001cf14
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x18001cf2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001cf2c
xor eax, eax
test eax, eax
je 0x18001cf3c
mov ecx, eax
call fcn.18001c7d0
or eax, 0xffffffff
jmp 0x18001cf3e
xor eax, eax
add rsp, 0x28
ret
Function at 0x180022813
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1800438e8]
jne 0x18001be8a
rol rcx, 0x10
test cx, 0xffff
jne 0x18001be86
repz ret
ror rcx, 0x10
jmp 0x18002276c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180045e20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180045f18]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800227f1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180045e20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180022813
mov rax, qword [rsp + 0x88]
mov qword [0x180045f18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180045eb8], rax
mov rax, qword [0x180045f18]
mov qword [0x180045d90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180045ea0], rax
mov dword [0x180045d80], 0xc0000409
mov dword [0x180045d84], 1
mov rax, qword [0x1800438e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1800438f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180045e18], eax
mov ecx, 1
call fcn.18002ba24
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180036950]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180045e18], 0
jne 0x18002289a
mov ecx, 1
call fcn.18002ba24
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18002bb34
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180024df4
xor ebx, ebx
cmp qword [0x180046db8], rbx
mov rdi, rax
jne 0x18002bc47
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18002bd1e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18002bd1e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180046db8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180046dc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180046dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180046dd8], rax
test rax, rax
je 0x18002bc3e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180046dd0], rax
jmp 0x18002bc4e
mov rax, qword [0x180046dd0]
jmp 0x18002bc55
mov rax, qword [0x180046dd0]
mov r11, qword [0x180046dd8]
cmp rax, rdi
je 0x18002bcbc
cmp r11, rdi
je 0x18002bcbc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180046dd8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18002bcbc
test rax, rax
je 0x18002bcbc
call rsi
test rax, rax
je 0x18002bcb6
lea rcx, [rsp + 0x30]
mov r9d, recv
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18002bcb6
test byte [rsp + 0x40], 1
jne 0x18002bcbc
bts ebp, 0x15
jmp 0x18002bcfc
mov rcx, qword [0x180046dc0]
cmp rcx, rdi
je 0x18002bcfc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18002bcfc
call rax
mov rbx, rax
test rax, rax
je 0x18002bcfc
mov rcx, qword [0x180046dc8]
cmp rcx, rdi
je 0x18002bcfc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18002bcfc
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180046db8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18002bd1e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18002bd20
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18001be70
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x415180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41532b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004301c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x4151ee
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415201
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415225
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415239
cmp rbx, 0x1000
jae 0x4151f8
nop
jmp 0x4152a9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x41524d
xor edx, edx
jmp 0x4152a0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.004301c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x41522f
jmp 0x415215
call fcn.0045d9a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00434520
lea rax, [0x004ab967]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00434e20
mov rax, qword [rsp + 0x38]
call fcn.00434b20
lea rax, [0x004aba0f]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434e20
mov rax, qword [rsp + 0x30]
call fcn.00434b20
call fcn.00434780
call fcn.004345a0
lea rax, [0x004adae6]
mov ebx, 0x21
call fcn.00432d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00459e40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415180
Function at 0x415360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41558a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00430240
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4153db
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x4153ee
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415410
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415424
cmp rbx, 0x1000
jae 0x4153e5
jmp 0x4154ae
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415436
xor esi, esi
jmp 0x4154a0
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00430240
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41541a
jmp 0x415402
call fcn.0045d9a0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415529
call fcn.00434520
lea rax, [0x004abdc5]
mov ebx, 0x19
call fcn.00434e20
mov rax, qword [rsp + 0x68]
call fcn.00434b20
lea rax, [0x004aba0f]
mov ebx, 0x19
nop
call fcn.00434e20
mov eax, dword [rsp + 0x34]
call fcn.00434b20
call fcn.00434780
call fcn.004345a0
lea rax, [0x004a8a6e]
mov ebx, 0xd
call fcn.00432d80
cmp eax, 0x5af
je 0x4154d3
call fcn.00434520
lea rax, [0x004abdc5]
mov ebx, 0x19
call fcn.00434e20
mov rax, qword [rsp + 0x38]
call fcn.00434b20
lea rax, [0x004aba0f]
mov ebx, 0x19
nop dword [rax]
call fcn.00434e20
mov eax, dword [rsp + 0x34]
call fcn.00434b20
call fcn.00434780
call fcn.004345a0
lea rax, [0x004ad438]
mov ebx, 0x1f
call fcn.00432d80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00459e40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415360