joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f64d4
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140117780
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x166
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x818]
mov rax, qword [0x140378280]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x508], 0
lea rcx, [0x14039f3f9]
call fcn.1400f69d4
nop
mov dword [rbp + 0x10], 0x438
mov rax, qword [rbp + 0x7f0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call fcn.1400f42ba
mov qword [rbp + 0x468], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400f4db4
nop
mov dword [rbp + 0x484], 0
call fcn.1400f5efd
mov dword [rbp + 0x4a4], eax
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4e8], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400f26bd
mov qword [rbp + 0x798], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x140117870
mov qword [rbp + 0x7a0], 0
jmp 0x14011795b
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x3fffffff
jle 0x1401178a1
mov qword [rbp + 0x7a8], 0
jmp 0x14011794d
movsxd rax, dword [rbp + 0x484]
shl rax, 1
mov qword [rbp + 0x7b0], rax
movsxd rcx, dword [rbp + 0x484]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x7b8], rcx
mov rcx, qword [rbp + 0x7b8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x7b8]
ja 0x1401178e5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400f2d2a
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x7c0], rax
lea r8, [rbp + 0x508]
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400f70a5
add qword [rbp + 0x7c0], 0x20
mov r9d, dword [rbp + 0x4a4]
mov rax, qword [rbp + 0x7b0]
mov r8d, eax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400f39a0
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x7a0], rax
mov rdx, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x7a0]
call fcn.1400f70ff
test eax, eax
jne 0x1401179a0
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x768], rax
mov rcx, qword [rbp + 0x7f8]
call fcn.1400f2d6b
mov rax, qword [rbp + 0x768]
jmp 0x1401179e4
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400f2ad7
test eax, eax
jne 0x140117838
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rbp + 0x788], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400f2d6b
mov rax, qword [rbp + 0x788]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402eb5e0]
mov r8, qword [rbp + 0x508]
call fcn.1400f4fd0
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.1400f4364
lea rsp, [rbp + 0x7d8]
pop rdi
pop rbp
ret
Function at 0x1400f68e9
Capabilities:
Write file on windows

Disassembly:
jmp 0x14029bdf0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140378280]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1403a0463]
call fcn.1400f69d4
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14029be57
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14029be5e
mov al, 1
jmp 0x14029bfce
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.1400f33d3
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.1400f33d3
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.1400f5a5c
movzx eax, al
test eax, eax
je 0x14029bec1
xor al, al
jmp 0x14029bfce
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x14029bf34
cmp dword [rbp + 0x160], 1
je 0x14029bf3f
cmp dword [rbp + 0x160], 3
je 0x14029bfbd
jmp 0x14029bfcc
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14029bf8f
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14029bf8f
xor al, al
jmp 0x14029bfce
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14029bfaa
mov dword [rbp + 0x154], 1
jmp 0x14029bfb4
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14029bfce
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14029bfce
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140342f80]
call fcn.1400f5d6d
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.1400f4364
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x14027bbc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x1403a020e]
call fcn.1400f69d4
nop
movzx eax, byte [0x1403839e4]
test eax, eax
jne 0x14027bc24
mov rax, qword [rbp + 0x1a0]
movsxd rax, dword [rax]
lea rcx, [0x140377b40]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rcx + rax*8]
call fcn.1400f3842
movzx eax, al
test eax, eax
je 0x14027bc1f
mov byte [0x1403839e4], 1
jmp 0x14027bcd8
movzx eax, byte [0x1403839e4]
cmp eax, 1
jne 0x14027bcd8
mov rdx, qword [rbp + 0x1a8]
lea rcx, [0x1402f9400]
call fcn.1400f3842
nop
mov dword [rbp + 0x164], 0x46
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1400f5692
mov rcx, rax
call fcn.1400f5cd7
nop
lea rax, [0x14033c480]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x14027bc9d
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x14027bcd8
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14027bcd6
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x1403839e4], 0
jmp 0x14027bc91
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1402d6310
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400f6c95
movzx eax, al
test eax, eax
jne 0x1402d6330
mov ecx, 7
call fcn.1400f5de0
nop
mov byte [rsp + 0x20], 0
call fcn.1400f5f0c
mov byte [rsp + 0x21], al
cmp dword [0x140383fa0], 1
jne 0x1402d6354
mov ecx, 7
call fcn.1400f5de0
nop
jmp 0x1402d63ac
cmp dword [0x140383fa0], 0
jne 0x1402d63a7
mov dword [0x140383fa0], 1
lea rdx, [0x1402e8db0]
lea rcx, [0x1402e8a80]
call fcn.1400f429c
test eax, eax
je 0x1402d6388
mov eax, 0xff
jmp 0x1402d64b1
lea rdx, [0x1402e8970]
lea rcx, [section..rdata]
call fcn.1400f5eda
mov dword [0x140383fa0], 2
jmp 0x1402d63ac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400f5cff
call fcn.1400f555c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1402d6409
mov rcx, qword [rsp + 0x30]
call fcn.1400f3c11
movzx eax, al
test eax, eax
je 0x1402d6409
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1403a2020]
nop
call fcn.1400f587c
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1402d643d
mov rcx, qword [rsp + 0x38]
call fcn.1400f3c11
movzx eax, al
test eax, eax
je 0x1402d643d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400f67a4
nop
call fcn.1402d6520
mov dword [rsp + 0x28], eax
call fcn.1400f5363
movzx eax, al
test eax, eax
jne 0x1402d645c
mov ecx, dword [rsp + 0x28]
call fcn.1400f255a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1402d646b
call fcn.1400f686c
nop
xor edx, edx
mov cl, 1
call fcn.1400f3a6d
mov eax, dword [rsp + 0x28]
jmp 0x1402d64b1
add rsp, 0x68
ret
Function at 0x140001380
Capabilities:
Enumerate threads
Suspend thread
Terminate process

Disassembly:
sub rsp, 0x258
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rcx, str.Enter_the_username_for_the_process_owner:
call fcn.140001020
mov r8d, 0x100
lea rdx, [rsp + 0x40]
lea rcx, str._255s
call fcn.140001080
cmp eax, 1
je 0x1400013ea
lea rcx, str.Failed_to_read_input_for_username._n
call fcn.140001020
mov eax, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400015d0
add rsp, 0x258
ret
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x250], rdi
call fcn.1400010e0
mov edi, eax
test eax, eax
jne 0x14000141d
lea rdx, [rsp + 0x40]
lea rcx, str.No_matching_process_found_for_user:__s_n
call fcn.140001020
mov eax, 1
jmp 0x140001595
mov qword [rsp + 0x260], rbx
xor edx, edx
mov ecx, 4
mov qword [rsp + 0x268], rsi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001451
lea rcx, str.Failed_to_create_thread_snapshot._n
call fcn.140001020
jmp 0x1400014bd
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400014b4
nop dword [rax + rax]
cmp dword [rsp + 0x2c], edi
jne 0x1400014a2
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1400014a2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001470
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, qword [rsp + 0x268]
mov rbx, rax
test rax, rax
jne 0x1400014f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_open_process._Error:__ld_n
call fcn.140001020
jmp 0x14000158b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140001576
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.TerminateProcess_failed._Error:__ld_n
call fcn.140001020
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x140001534
lea rcx, str.Failed_to_load_ntdll.dll_n
jmp 0x14000157d
lea rdx, str.NtTerminateProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001552
lea rcx, str.Failed_to_get_NtTerminateProcess_n
jmp 0x14000157d
xor edx, edx
mov rcx, rbx
call rax
test eax, eax
je 0x14000156d
mov edx, eax
lea rcx, str.NtTerminateProcess_failed_with_status:__x_n
call fcn.140001020
jmp 0x140001582
lea rcx, str.Process_terminated_using_NtTerminateProcess._n
jmp 0x14000157d
lea rcx, str.Process_terminated_using_TerminateProcess._n
call fcn.140001020
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x260]
xor eax, eax
mov rdi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400015d0
add rsp, 0x258
ret
Function at 0x140001e88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ed2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ed2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ed2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ed2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ed2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ed4
xor al, al
add rsp, 0x28
ret
Function at 0x1404bd7f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1404bd7fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1404bd80d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1404bd7f5
lea eax, [rcx + 1]
jmp 0x1404bd81b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1404bd82e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1404bd814
sub eax, 3
jb 0x1404bd84e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1404bd89d
sar eax, 1
movsxd rbp, eax
jb 0x1404bd884
jmp 0x1404bd85c
add ebx, ebx
jne 0x1404bd85a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1404bd884
inc ecx
add ebx, ebx
jne 0x1404bd86a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1404bd884
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1404bd87d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1404bd86c
add ecx, 2
jmp 0x1404bd889
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1404bd7b2
jmp 0x1404bd7fd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xbae00
mov dl, 0xd
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1404bd8e9
cmp rsi, rcx
jae 0x1404bd8f1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1404bd8d0
cmp al, 0x8f
ja 0x1404bd8d0
cmp byte [rsi - 2], 0xf
je 0x1404bd8d6
sub al, 0xe8
cmp al, 1
ja 0x1404bd8ba
cmp rsi, rcx
jae 0x1404bd8f1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1404bd8c0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1404bd8f1
lodsb al, byte [rsi]
jmp 0x1404bd8d0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x4ba000]
mov eax, dword [rdi]
or eax, eax
je 0x1404bd94e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4bd4ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1404bd8fe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1404bd948
mov qword [rbx], rax
add rbx, 8
jmp 0x1404bd91e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1404bd992
cmp al, 0xef
ja 0x1404bd97a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1404bd95a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1404bd969
mov eax, dword [rdi]
add rdi, 4
jmp 0x1404bd969
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1404bda11], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1404bda11
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1404bda01
sub rsp, 0xffffffffffffff80
jmp 0x140001125
Function at 0x18000e920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180057410]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x19], 0x6c642e32
mov word [rbp - 0x15], 0x6c
mov dword [rbp - 0x1f], 0x656e7265
mov word [rbp - 0x1b], 0x336c
mov byte [rbp - 0x20], 0x4b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180010ad0
add rsp, 0x40
pop rbp
ret

Function at 0x18000e97c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180057410]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, edx
mov edi, ecx
or rbx, 0xffffffffffffffff
mov dword [rbp - 0x1c], 0x746f6873
mov dword [rbp - 0x2e], 0x65746165
mov word [rbp - 0x22], 0x3233
mov word [rbp - 0x28], 0x6c6f
mov word [rbp - 0x30], 0x7243
mov word [rbp - 0x25], 0x6c65
mov word [rbp - 0x1f], 0x616e
mov word [rbp - 0x2a], 0x6f54
mov byte [rbp - 0x26], 0x68
mov byte [rbp - 0x1d], 0x70
mov byte [rbp - 0x18], 0
mov byte [rbp - 0x23], 0x70
mov byte [rbp - 0x20], 0x53
call fcn.18000e920
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ea07
mov edx, esi
mov ecx, edi
call rax
mov rbx, rax
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180010ad0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000ea28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180057410]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rbp - 0x1d], 0x33646165
mov word [rbp - 0x17], 0x7269
mov word [rbp - 0x14], 0x74
mov word [rbp - 0x19], 0x4632
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x20], 0x54
mov byte [rbp - 0x15], 0x73
call fcn.18000e920
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000ea95
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180010ad0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000eab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180057410]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov word [rbp - 0x19], 0x4e32
mov word [rbp - 0x1c], 0x6461
mov dword [rbp - 0x17], 0x747865
mov byte [rbp - 0x1a], 0x33
mov word [rbp - 0x1f], 0x7268
mov byte [rbp - 0x1d], 0x65
mov byte [rbp - 0x20], 0x54
call fcn.18000e920
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000eb1b
mov rdx, rsi
mov rcx, rdi
call rax
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180010ad0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000f388
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x180057410]
xor rax, rsp
mov qword [rbp + 0x40], rax
cmp edx, 1
jne 0x18000f46a
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x30]
mov edx, 0x104
call fcn.1800122e0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x26], 0x75732074
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call fcn.180012058
test rax, rax
jne 0x18000f49e
lea rdx, [sym.gphelper.dll_HookSetWindowPos]
lea rcx, [0x180058af8]
call fcn.180010168
test eax, eax
je 0x18000f49e
lea rdx, [sym.gphelper.dll_HookSetForegroundWindow]
lea rcx, [0x180058a60]
call fcn.180010168
test eax, eax
je 0x18000f49e
lea rdx, [sym.gphelper.dll_HookSetActiveWindow]
lea rcx, [0x180058cf0]
call fcn.180010168
test eax, eax
je 0x18000f49e
lea rdx, [sym.gphelper.dll_HookBringWindowToTop]
lea rcx, [0x180058bb0]
call fcn.180010168
jmp 0x18000f49e
test edx, edx
jne 0x18000f49e
lea rcx, [0x180058af8]
call fcn.180010420
lea rcx, [0x180058a60]
call fcn.180010420
lea rcx, [0x180058cf0]
call fcn.180010420
lea rcx, [0x180058bb0]
call fcn.180010420
mov eax, 1
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.180010ad0
add rsp, 0x150
pop rbp
ret
Function at 0x180010420
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rsi, rcx
xor edi, edi
call fcn.18001011c
lea r12, [0x180058d60]
xor r8d, r8d
mov rdx, r12
mov rbx, qword [rdx]
test rbx, rbx
je 0x18001045a
lea rax, [rbx + 0x38]
cmp rax, qword [rsi]
je 0x180010469
inc r8d
add rdx, 8
cmp r8d, 0x40
jb 0x180010449
xor ebx, ebx
test rbx, rbx
je 0x180010528
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
call fcn.180010724
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, dword [rbx + 8]
mov rdx, qword [rbx]
and dword [rsp + 0x58], edi
mov rbp, rax
lea rax, [rsp + 0x58]
mov r9d, 0x40
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180010523
mov r8, qword [rbx]
xor edx, edx
cmp dword [rbx + 8], edx
jbe 0x1800104c7
mov al, byte [rdx + rbx + 0x58]
mov byte [rdx + r8], al
inc edx
cmp edx, dword [rbx + 8]
jb 0x1800104b8
mov r8d, dword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov r8d, dword [rbx + 8]
mov r9d, dword [rsp + 0x58]
mov rdx, qword [rbx]
lea rax, [rsp + 0x58]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rbx]
mov qword [rsi], rax
mov edi, 1
mov rcx, r12
xor eax, eax
cmp qword [rcx], rbx
je 0x180010518
inc eax
add rcx, 8
cmp eax, 0x40
jb 0x180010506
jmp 0x180010523
and qword [r12 + rax*8], 0
dec dword [0x180058d24]
call fcn.18001054c
lea rcx, [0x180058d38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret

Function at 0x18001054c
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor edi, edi
cmp dword [0x180058d30], edi
jbe 0x1800105b6
mov rcx, qword [0x180058d28]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [0x180058d28]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [0x180058d30]
jb case.default.0x1800105eb
mov rcx, qword [0x180058d28]
call fcn.180012f5c
and qword [0x180058d28], 0
and dword [0x180058d30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, esi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetThreadPriority]