joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003a2c
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
lea rcx, str.IEEtwProxyStub.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x140003a94
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
lea rdx, str.Failed_to_load_IEEtwProxyStub.dll_with_HResult
or r8d, 0x80070000
lea rcx, str.ERROR:__s:_0x_08x_n
test eax, eax
cmovle r8d, eax
call fcn.1400082e4
jmp 0x140003b09
lea rdx, str.DllUnregisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x140003acc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
lea rdx, str.Failed_to_load_IEEtwProxyStub.dll_with_HResult
or r8d, 0x80070000
test eax, eax
cmovle r8d, eax
jmp 0x140003af4
mov rcx, rax
call qword [fcn.140001900]
call rdi
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x140003b00
cmp eax, 0x80070490
je 0x140003b00
mov r8d, eax
lea rdx, str.Failed_to_Unregister_IEEtwProxyStub.dll_with_HResult
lea rcx, str.ERROR:__s:_0x_08x_n
call fcn.1400082e4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r8d, 0x27
lea rdx, [rsp + 0x20]
lea rcx, [0x140016168]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
test eax, eax
jne 0x140003b3d
lea rdx, str.Failed_during_a_call_to_StringFromGUID
lea rcx, str.ERROR:__s
call fcn.1400082e4
jmp 0x140003c3b
mov edi, 0x104
lea r8, str.CLSID_
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.140001f74
mov ebx, eax
test eax, eax
js 0x140003c25
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140003c25
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, 0xfffffffd
je 0x140003bb3
movzx ebx, ax
lea rdx, [rsp + 0x70]
or ebx, 0x80070000
lea rcx, str.ERROR:_Failed_to_delete_registry_key__s__error:_0x_08x_n
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.1400082e4
test ebx, ebx
js 0x140003c25
lea r8, str.AppID_
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.140001f74
mov ebx, eax
test eax, eax
js 0x140003c25
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x140003c25
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, 0xfffffffd
je 0x140003c21
movzx ebx, ax
lea rdx, [rsp + 0x70]
or ebx, 0x80070000
lea rcx, str.ERROR:_Failed_to_delete_registry_key__s__error:_0x_08x_n
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.1400082e4
test ebx, ebx
jns 0x140003c3b
mov r8d, ebx
lea rdx, str.Failed_while_cleaning_up_registry_with_HResult
lea rcx, str.ERROR:__s:_0x_08x_n
call fcn.1400082e4
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140007df0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x290
pop rdi
ret
Function at 0x140003c64
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 9], 0
xor eax, eax
and dword [rbp + 0x37], 0
mov rbx, rdx
and qword [rbp + 0x3f], 0
lea rdx, str.Internet_Explorer_ETW_Collector_Service
mov qword [rbp + 0x27], rdx
lea rdx, str.ETW_Collector_Service_for_Internet_Explorer._When_running__this_service_collects_real_time_ETW_events_and_processes_them.
mov qword [rbp + 0x2f], rdx
lea rdx, [rbp - 9]
mov qword [rbp - 1], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rax
mov dword [rbp + 0x17], eax
lea rax, str.IEEtwCollectorService
mov qword [0x14001d3b0], rdx
mov qword [rbp + 0x1f], rax
cmp ecx, 1
jle 0x140003dc8
mov rcx, qword [rbx + 8]
lea rdx, str.install
call fcn.140008144
test eax, eax
jne 0x140003d02
lea rcx, [rbp - 9]
call fcn.14000324c
jmp 0x140003deb
mov rcx, qword [rbx + 8]
lea rdx, str.uninstall
call fcn.140008144
test eax, eax
jne 0x140003d24
lea rcx, [rbp - 9]
call fcn.14000348c
jmp 0x140003deb
mov rcx, qword [rbx + 8]
lea rdx, str.stop
call fcn.140008144
test eax, eax
jne 0x140003d46
lea rcx, [rbp - 9]
call fcn.140003534
jmp 0x140003deb
mov rcx, qword [rbx + 8]
lea rdx, str.start
call fcn.140008144
test eax, eax
jne 0x140003dc4
xor edx, edx
lea r8d, [rax + 1]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x140003deb
mov rdx, qword [rbp + 0x1f]
mov r8d, 0x14
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
je 0x140003db9
lea rdx, [rbp - 0x29]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140003db0
cmp dword [rbp - 0x25], 1
jne 0x140003db0
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x140003deb
mov rax, qword [rbp + 0x1f]
and qword [rbp - 0x19], 0
lea rcx, [rbp - 0x29]
and qword [rbp - 0x11], 0
mov qword [rbp - 0x29], rax
lea rax, [0x140002ff0]
mov qword [rbp - 0x21], rax
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140007df0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14000573c
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, qword [rbp + 0x1f0]
mov rdi, r9
xor r15d, r15d
mov r14, r8
mov r9, rdx
mov ebx, 0x80070057
test rdi, rdi
je 0x140005789
mov word [rdi], r15w
test rdx, rdx
je 0x14000587e
mov edx, 0x7ffffffe
mov rcx, r9
mov eax, edx
cmp word [rcx], r15w
je 0x1400057ac
add rcx, 2
sub rax, 1
jne 0x14000579c
test rax, rax
je 0x14000587e
mov ebx, r15d
sub rdx, rax
je 0x14000587e
mov r8d, 0x104
lea rdx, [rbp - 0x80]
mov rcx, r9
mov ebx, 0x8000ffff
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14000587e
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000586a
test al, 0x10
je 0x14000586a
mov r8d, 0x27
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
lea r8, [0x140016f74]
lea rcx, [rbp - 0x80]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x14000587e
lea r8, [rsp + 0x32]
mov word [rsp + 0x7a], r15w
lea rcx, [rbp - 0x80]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x14000587e
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000586a
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000586a
mov rdx, qword [rsi]
lea r8, [rbp - 0x80]
mov rcx, rdi
call fcn.140001f74
mov ebx, eax
jmp 0x14000587e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140007df0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006fdc
Capabilities:
Create thread
Delete file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r15d, r8d
mov r12d, edx
mov rdi, qword [rcx]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400071a9
mov r13d, edx
and r13d, 1
and r12d, 2
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov r8, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x10]
test r8, r8
je 0x140007059
jmp 0x140007045
lea ecx, [rax + 1]
lock cmpxchg dword [r8 + 8], ecx
je 0x14000704f
mov eax, dword [r8 + 8]
test eax, eax
jne 0x14000703a
jmp 0x140007059
lea rcx, [rbp - 0x18]
call fcn.14000185c
nop
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov r8, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
test r8, r8
je 0x14000708e
jmp 0x14000707b
lea ecx, [rax + 1]
lock cmpxchg dword [r8 + 8], ecx
je 0x140007085
mov eax, dword [r8 + 8]
test eax, eax
jne 0x140007070
jmp 0x14000708e
lea rcx, [rbp - 0x28]
call fcn.14000185c
mov r14, qword [rbp - 0x18]
test r13d, r13d
je 0x1400070b4
test r15d, r15d
jne 0x1400070a6
mov rcx, r14
call fcn.1400076b0
jmp 0x1400070b4
cmp r15d, 1
jne 0x1400070b4
mov rcx, r14
call fcn.140007838
test r12d, r12d
je 0x14000713e
test r15d, r15d
jne 0x1400070ef
mov rsi, qword [rbp - 0x28]
mov qword [rsi + 0x18], r14
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], r15d
mov r9, rsi
lea r8, [0x140001930]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x30], rax
jmp 0x14000713e
cmp r15d, 1
jne 0x14000712a
mov rsi, qword [rbp - 0x28]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14000713e
call fcn.140007838
or edx, 0xffffffff
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsi + 0x30], 0
and qword [rsi + 0x18], 0
jmp 0x14000713e
cmp r15d, 2
jne 0x14000713e
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x140007194
or eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140007194
mov r14, qword [rbp - 0x20]
mov rax, qword [r14]
mov rsi, qword [rax]
mov rcx, rsi
call qword [fcn.140001900]
mov rcx, r14
call rsi
or eax, 0xffffffff
lock xadd dword [r14 + 0xc], eax
cmp eax, 1
jne 0x140007194
mov r14, qword [rbp - 0x20]
mov rax, qword [r14]
mov rsi, qword [rax + 8]
mov rcx, rsi
call qword [fcn.140001900]
mov rcx, r14
call rsi
nop
lea rcx, [rbp - 0x18]
call fcn.1400015fc
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140007023
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400071d0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
lea edx, [rdi + 2]
mov r8d, edx
call fcn.140006fdc
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x140007211
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140007211
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140007ba0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140007be0
mov eax, 0xff
jmp 0x140007d8f
mov r8d, dword [rsp + 0x3c]
and r8d, 0x7fff
mov r9d, dword [rsp + 0x40]
cmp r9d, 2
je 0x140007bfc
bts r8d, 0xf
mov edx, dword [rsp + 0x34]
mov ecx, edx
shl ecx, 8
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [0x14001ca88], r9d
mov dword [0x14001ca90], ecx
mov dword [0x14001ca94], edx
mov dword [0x14001ca98], eax
mov dword [0x14001ca8c], r8d
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140007c73
movsxd rax, dword [0x14000003c]
lea rcx, [0x140000000]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x140007c73
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x140007c73
xor ebx, ebx
cmp dword [rax + 0x84], 0xe
jbe 0x140007c75
cmp dword [rax + 0xf8], ebx
setne bl
jmp 0x140007c75
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov edi, 1
mov ecx, edi
call fcn.140009944
test eax, eax
jne 0x140007cab
cmp dword [0x14001c4e8], 2
je 0x140007c97
call fcn.140009728
mov ecx, 0x1c
call fcn.140009774
mov ecx, 0xff
call fcn.140009310
call fcn.1400091d0
test eax, eax
jne 0x140007cd7
cmp dword [0x14001c4e8], 2
je 0x140007cc2
call fcn.140009728
mov ecx, 0x10
call fcn.140009774
mov ecx, 0xff
call fcn.140009310
nop
call fcn.1400099b8
test eax, eax
jns 0x140007cea
mov ecx, 0x1b
call fcn.14000932c
call sub.KERNEL32.dll_GetCommandLineW
mov qword [0x14001e690], rax
call fcn.14000a14c
mov qword [0x14001c4e0], rax
call fcn.140009c48
test eax, eax
jns 0x140007d15
mov ecx, 8
call fcn.14000932c
call fcn.140009f28
test eax, eax
jns 0x140007d28
mov ecx, 9
call fcn.14000932c
mov ecx, edi
call fcn.14000939c
test eax, eax
je 0x140007d3a
mov ecx, eax
call fcn.14000932c
mov r8, qword [0x14001ca78]
mov qword [0x14001caa8], r8
mov rdx, qword [0x14001ca70]
mov ecx, dword [0x14001ca6c]
call fcn.140003c64
mov edi, eax
mov dword [rsp + 0x24], eax
test ebx, ebx
jne 0x140007d6b
mov ecx, eax
call fcn.140009718
call fcn.140009388
jmp 0x140007d8d
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140007df0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
sub rsp, 0x28
call fcn.1400af000
add rsp, 0x28
jmp 0x140007ba0
Function at 0x140009774
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
lea r14, reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov r8, r14
xor edx, edx
cmp ecx, dword [r8]
je 0x1400097ab
inc edx
add r8, 0x10
movsxd rax, edx
cmp rax, 0x17
jb 0x140009797
movsxd rbx, edx
cmp rbx, 0x17
jae 0x140009925
mov ebp, 3
mov ecx, ebp
call fcn.14000cf30
cmp eax, 1
je 0x1400098e6
mov ecx, ebp
call fcn.14000cf30
test eax, eax
jne 0x1400097e5
cmp dword [section..data], 1
je 0x1400098e6
cmp edi, 0xfc
je 0x140009925
mov ebp, 0x314
lea rdi, [0x14001cab0]
mov edx, ebp
lea r8, str.Runtime_Error__n_nProgram:
mov rcx, rdi
call fcn.14000a280
test eax, eax
je 0x140009827
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000b144
mov r8d, 0x104
mov byte [0x14001cbcd], 0
lea rdx, [0x14001cac9]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x140009878
lea r8, str._program_name_unknown_
mov edx, 0x2fb
lea rcx, [0x14001cac9]
call fcn.14000a280
test eax, eax
je 0x140009878
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000b144
lea r8, [0x140014f10]
mov rdx, rbp
mov rcx, rdi
call fcn.14000ce9c
test eax, eax
je 0x1400098a3
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000b144
add rbx, rbx
mov rdx, rbp
mov rcx, rdi
mov r8, qword [r14 + rbx*8 + 8]
call fcn.14000ce9c
test eax, eax
je 0x1400098cf
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14000b144
mov r8d, 0x12010
lea rdx, str.Microsoft_Visual_C_Runtime_Library
mov rcx, rdi
call fcn.14000cf88
jmp 0x140009925
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140009925
add rbx, rbx
or r8, 0xffffffffffffffff
mov rdx, qword [r14 + rbx*8 + 8]
inc r8
cmp byte [rdx + r8], 0
jne 0x140009907
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14000b144
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x540
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14000b1c1
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x14000b1e1
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.140007df0
add rsp, 0x540
pop rbx
ret
Function at 0x14000cf88
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14d, r8d
mov r12, rdx
mov r15, rcx
call fcn.140008ed4
xor esi, esi
mov rbx, rax
cmp qword [0x14001d288], rsi
jne 0x14000d09b
xor r8d, r8d
lea rcx, str.USER32.DLL
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14000d1a6
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d1a6
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov qword [0x14001d288], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov qword [0x14001d290], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov qword [0x14001d298], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14001d2a8], rax
mov rcx, rax
test rax, rax
je 0x14000d092
lea rdx, str.GetProcessWindowStation
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14001d2a0], rax
jmp 0x14000d0a2
mov rax, qword [0x14001d2a0]
jmp 0x14000d0a9
mov rax, qword [0x14001d2a0]
mov rcx, qword [0x14001d2a8]
cmp rax, rbx
je 0x14000d123
cmp rcx, rbx
je 0x14000d123
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14001d2a8]
mov rdi, rax
call sub.KERNEL32.dll_DecodePointer
mov rbp, rax
test rdi, rdi
je 0x14000d123
test rax, rax
je 0x14000d123
mov rcx, rdi
call qword [fcn.140001900]
call rdi
mov rdi, rax
test rax, rax
je 0x14000d11c
mov rcx, rbp
call qword [fcn.140001900]
mov r9d, 0xc
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, rdi
lea edx, [r9 - 0xb]
call rbp
test eax, eax
je 0x14000d11c
test byte [rsp + 0x40], 1
jne 0x14000d123
bts r14d, 0x15
jmp 0x14000d179
mov rcx, qword [0x14001d290]
cmp rcx, rbx
je 0x14000d179
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
test rax, rax
je 0x14000d179
mov rcx, rax
call qword [fcn.140001900]
call rdi
mov rsi, rax
test rax, rax
je 0x14000d179
mov rcx, qword [0x14001d298]
cmp rcx, rbx
je 0x14000d179
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
test rax, rax
je 0x14000d179
mov rcx, rax
call qword [fcn.140001900]
mov rcx, rsi
call rbx
mov rsi, rax
mov rcx, qword [0x14001d288]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
test rax, rax
je 0x14000d1a6
mov rcx, rax
call qword [fcn.140001900]
mov r9d, r14d
mov r8, r12
mov rdx, r15
mov rcx, rsi
call rbx
jmp 0x14000d1a8
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140007df0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000ebd8
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov qword [rbp + 0xa0], rdi
mov rax, qword [0x14001b060]
xor rax, rbp
mov qword [rbp + 0x68], rax
and dword [rbp], 0
mov eax, dword [rsp]
sub rsp, 0x10
lea r14, [rsp + 0x20]
mov eax, dword [r14]
mov r8d, 0x30
lea rdx, [rbp + 8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000ecdb
mov r15, qword [rbp + 0x10]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [rbp + 0x3c]
lea rcx, [rbp]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
cmp eax, 1
jne 0x14000ec66
mov eax, dword [rbp]
test eax, eax
cmovne ebx, eax
lea edx, [rdi - 1]
lea ecx, [rdx + rbx]
cmp ecx, ebx
jb 0x14000ecdb
mov eax, edx
not eax
and ecx, eax
je 0x14000ec81
lea eax, [rcx + rdi]
cmp eax, ecx
jb 0x14000ecdb
mov ecx, eax
lea eax, [rdi + rdi*2]
mov ebx, edx
cmp ecx, eax
not rbx
cmovb ecx, eax
and rbx, r14
mov esi, ecx
lea rax, [r15 + rdi]
sub rbx, rsi
cmp rbx, rax
jb 0x14000ecdb
mov r9d, 4
mov r8d, 0x1000
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000ecdb
lea r9, [rbp + 4]
mov r8d, 0x104
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14000ecdb
mov eax, 1
jmp 0x14000ecdd
xor eax, eax
mov rcx, qword [rbp + 0x68]
xor rcx, rbp
call fcn.140007df0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xa0]
lea rsp, [rbp + 0x70]
pop r15
pop r14
pop rbp
ret
Function at 0x140001290
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable.MD5_CTX.0
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov qword [rcx + 0x60], rax
mov qword [rcx + 0x68], rax
mov qword [rcx + 0x70], rax
mov qword [rcx + 0x78], rax
mov qword [rcx + 0x80], rax
mov qword [rcx + 0x88], rax
mov qword [rcx + 0x90], rax
mov qword [rcx + 0x98], rax
mov rax, rcx
mov byte [rcx + 0x60], 0x80
ret

Function at 0x140001330
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140068620]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r14d, r14d
lea r8, [rsp + 0x22]
mov ebx, 2
mov r9d, r14d
mov r10d, ebx
mov rbp, rdx
mov rsi, rcx
nop word [rax + rax]
mov eax, r9d
lea r8, [r8 + 4]
inc r9d
lea rcx, [rsi + rax*4]
movzx eax, byte [rsi + rax*4 + 0x18]
mov byte [r8 - 6], al
movzx eax, byte [rcx + 0x19]
mov byte [r8 - 5], al
movzx eax, byte [rcx + 0x1a]
mov byte [r8 - 4], al
movzx eax, byte [rcx + 0x1b]
mov byte [r8 - 3], al
sub r10, 1
jne 0x140001370
mov eax, dword [rsi + 0x18]
lea r8d, [r10 + 0x38]
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
jb 0x1400013bd
mov r8d, 0x78
sub r8d, eax
lea rdx, [rsi + 0x60]
mov rcx, rsi
call fcn.140001db0
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140001db0
mov r8d, r14d
lea rdx, [rbp + 2]
mov r9d, 4
nop dword [rax]
mov eax, r8d
lea rdx, [rdx + 4]
inc r8d
lea rcx, [rsi + rax*4]
movzx eax, byte [rsi + rax*4 + 8]
mov byte [rdx - 6], al
movzx eax, byte [rcx + 9]
mov byte [rdx - 5], al
movzx eax, byte [rcx + 0xa]
mov byte [rdx - 4], al
movzx eax, byte [rcx + 0xb]
mov byte [rdx - 3], al
sub r9, 1
jne 0x1400013f0
mov rax, rsi
nop dword [rax]
nop dword [rax + rax]
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
lea rax, [rax + 0x40]
mov qword [rax - 0x28], r14
mov qword [rax - 0x20], r14
mov qword [rax - 0x18], r14
mov qword [rax - 0x10], r14
mov qword [rax - 8], r14
sub rbx, 1
jne 0x140001430
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
mov qword [rsi + 0x18], r14
mov dword [rsi + 8], 0x67452301
mov dword [rsi + 0xc], 0xefcdab89
mov dword [rsi + 0x10], 0x98badcfe
mov dword [rsi + 0x14], 0x10325476
mov qword [rsi + 0x60], r14
mov qword [rsi + 0x68], r14
mov qword [rsi + 0x70], r14
mov qword [rsi + 0x78], r14
mov qword [rsi + 0x80], r14
mov qword [rsi + 0x88], r14
mov qword [rsi + 0x90], r14
mov qword [rsi + 0x98], r14
mov byte [rsi + 0x60], 0x80
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140025540
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret