joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400114e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov dword [0x14015f0e0], eax
mov eax, dword [rsp + 0x24]
mov dword [0x14015f0e4], eax
mov eax, dword [rsp + 0x48]
mov dword [0x14015f0e8], eax
mov dword [rsp + 0x60], ebx
mov byte [0x14015f0ed], bl
call fcn.1400126d0
test al, al
je 0x14001154e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
test eax, eax
je 0x14001154e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14001154e
inc eax
mov byte [0x14015f0ed], 1
mov dword [0x14015f170], eax
mov byte [0x14015f0ee], bl
mov word [rsp + 0x60], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
mov edi, 1
test eax, eax
jne 0x14001158b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001158b
movzx eax, word [rsp + 0x60]
jmp 0x140011592
mov eax, edi
mov word [rsp + 0x60], ax
cmp ax, di
seta cl
call fcn.1400125c0
test al, al
je 0x1400115bb
call fcn.1400112c0
test al, al
je 0x1400115bb
cmp dword [0x14015f174], edi
seta al
mov byte [0x14015f0ee], al
jmp 0x1400115c2
movzx eax, byte [0x14015f0ee]
test al, al
je 0x140011610
mov r9d, dword [0x14015f178]
test r9, r9
je 0x140011693
lea r8, [0x14015f0f0]
nop dword [rax]
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
inc rbx
mov rax, qword [rdx]
bts rax, rcx
mov qword [rdx], rax
cmp rbx, r9
jb 0x1400115e0
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x140011693
mov r9, qword [rsp + 0x60]
lea r8, [0x14015f0f0]
nop dword [rax]
test r9, rdi
je 0x140011661
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rcx
mov qword [rdx], rax
rol rdi, 1
test r9, rdi
je 0x140011686
lea rdx, [rbx + 1]
mov rax, rdx
and edx, 0x3f
shr rax, 6
lea rcx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rdx
mov qword [rcx], rax
rol rdi, 1
add rbx, 2
cmp rbx, 0x40
jb 0x140011640
mov rbx, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x14005b980
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.140059620
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.140059d50
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.14005a480
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.14005a480

Function at 0x14005baa0
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.140059d50
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.140059620
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.14005a680
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.14005a680
Function at 0x14005d180
Capabilities:
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r13
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r14
call fcn.14005b980
mov r15, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r15
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call fcn.140059d50
vmovdqu32 zmm3, zmmword [rbx]
mov rax, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
vpmaxsd zmm1, zmm3, zmmword [rax]
mov rcx, qword [rsp + 0x80]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [rax]
vmovdqu32 zmmword [rax], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r13]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r13]
vmovdqu32 zmmword [r13], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r12]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r12]
vmovdqu32 zmmword [r12], zmm0
vmovdqu32 zmm4, zmmword [r15]
vpmaxsd zmm0, zmm4, zmmword [r14]
vmovdqu32 zmmword [r15], zmm0
vpminsd zmm1, zmm4, zmmword [r14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
vmovdqu32 zmmword [r14], zmm1
mov qword [rsp + 0x20], r14
vzeroupper
call fcn.14005bbc0
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.14005a480
Function at 0x14005f080
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x50], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x58], rax
call fcn.14005b980
mov rax, qword [rsp + 0xf8]
mov r13, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r14
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov r15, qword [rsp + 0xe0]
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.14005baa0
vmovdqu32 zmm3, zmmword [rbx]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xa0]
vpmaxsd zmm1, zmm3, zmmword [r9]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r9]
vmovdqu32 zmmword [r9], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r8]
mov r10, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r11, qword [rsp + 0x90]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r8]
vmovdqu32 zmmword [r8], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rdx], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
vmovdqu32 zmm3, zmmword [r15]
vpmaxsd zmm1, zmm3, zmmword [r10]
vmovdqu32 zmmword [r15], zmm1
vpminsd zmm0, zmm3, zmmword [r10]
vmovdqu32 zmmword [r10], zmm0
vmovdqu32 zmm4, zmmword [r12]
vpmaxsd zmm0, zmm4, zmmword [r11]
vmovdqu32 zmmword [r12], zmm0
vpminsd zmm1, zmm4, zmmword [r11]
vmovdqu32 zmmword [r11], zmm1
vmovdqu32 zmm3, zmmword [r13]
vpmaxsd zmm1, zmm3, zmmword [rcx]
vmovdqu32 zmmword [r13], zmm1
vpminsd zmm0, zmm3, zmmword [rcx]
vmovdqu32 zmmword [rcx], zmm0
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x38], r9
mov r9, r10
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
vmovdqu32 zmm4, zmmword [rcx]
vpmaxsd zmm0, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rcx], zmm0
vpminsd zmm1, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rbx], zmm1
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x88]
mov r8, r11
vzeroupper
call fcn.14005bbc0
mov rax, qword [rsp + 0xf8]
mov r9, r14
mov rcx, qword [rsp + 0xc0]
mov r8, rsi
mov qword [rsp + 0xb8], rax
mov rdx, rdi
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r15
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.14005bbc0
Function at 0x14005fe34
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005fe7e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005fe7e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005fe7e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005fe7e
cmp dword [rcx + 0x84], 0xe
jbe 0x14005fe7e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005fe80
xor al, al
add rsp, 0x28
ret

Function at 0x14009d200
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140002510
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.140002560
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001873
mov dword [rax + 0x60], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14009ff70
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.140002510
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.140002560
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.140001873
mov dword [rax + 0x60], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400012f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0xb0
xor r15d, r15d
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov r14d, r15d
xor eax, eax
lock cmpxchg qword [0x1400035e0], rbx
je 0x140001359
cmp rax, rbx
jne 0x14000134c
mov edi, 1
mov r14d, edi
jmp 0x14000135e
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001330
mov edi, 1
mov eax, dword [0x1400035e8]
cmp eax, edi
jne 0x140001376
mov esi, 0x1f
mov ecx, esi
call sub.msvcrt.dll__amsg_exit
jmp 0x1400013e7
mov eax, dword [0x1400035e8]
test eax, eax
jne 0x1400013dc
mov dword [0x1400035e8], edi
lea r12, [0x1400021b0]
lea rbx, [0x140002198]
mov qword [rsp + 0x30], rbx
mov eax, r15d
mov dword [rsp + 0x24], eax
cmp rbx, r12
jae 0x1400013ce
test eax, eax
jne 0x1400013d2
mov rsi, qword [rbx]
test rsi, rsi
je 0x1400013c3
mov rcx, rsi
mov rax, qword [0x140002170]
call rax
call rsi
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x1400013a0
test eax, eax
je 0x1400013e2
mov eax, 0xff
jmp 0x140001543
mov dword [0x140003024], edi
mov esi, 0x1f
mov eax, dword [0x1400035e8]
cmp eax, edi
jne 0x14000140e
lea rdx, [0x140002190]
lea rcx, [0x140002180]
call sub.msvcrt.dll__initterm
mov dword [0x1400035e8], 2
test r14d, r14d
jne 0x14000141d
mov rax, r15
xchg qword [0x1400035e0], rax
cmp qword [0x1400035f0], r15
je 0x140001454
lea rcx, [0x1400035f0]
call fcn.140001750
test eax, eax
je 0x140001454
mov rbx, qword [0x1400035f0]
mov rcx, rbx
mov rax, qword [0x140002170]
call rax
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call rbx
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rdx, qword [rax]
test rdx, rdx
jne 0x14000146d
mov eax, 0xff
jmp 0x140001543
mov qword [rsp + 0x28], rdx
mov ecx, dword [rsp + 0x20]
cmp word [rdx], 0x20
ja 0x1400014f4
cmp word [rdx], r15w
je 0x140001486
test ecx, ecx
jne 0x1400014f4
movzx eax, word [rdx]
sub ax, di
cmp ax, si
ja 0x14000149c
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140001486
mov ecx, dword [rsp + 0x7c]
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
and cl, dil
cmovne r9d, eax
mov r8, rdx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001010
mov dword [0x140003020], eax
cmp dword [0x140003040], r15d
jne 0x1400014dd
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140003024], r15d
jne 0x1400014f2
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140003020]
jmp 0x140001543
cmp word [rdx], 0x22
jne 0x140001508
mov eax, r15d
test ecx, ecx
sete al
mov ecx, eax
mov dword [rsp + 0x20], eax
add rdx, 2
mov qword [rsp + 0x28], rdx
jmp 0x140001476
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
sub rsp, 0x28
call fcn.140173000
add rsp, 0x28
jmp 0x1400012f0
Function at 0x180003b10
Capabilities:
Create thread
Execute command

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rcx, str.color_9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n______________________________________________________________________________________________________________________n___________________________________________________________________________________n___________________________________________________________________n______________________________________________________________________________________n_________________________________________________________________________n___________________________________________________________________________________n______________________________________________________________________________n_______________________________________________________________________
call fcn.180003650
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov r14, qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov dl, 0xa
call r14
mov r15, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
mov edx, eax
call r15
mov rbx, qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov rcx, rsi
call rbx
lea rsi, [0x180015000]
lea rdx, str.Initializing.
mov rcx, rsi
call fcn.180003650
lea rdi, [0x180014ff8]
mov rax, qword [0x180015000]
movsxd rax, dword [rax + 4]
lea rcx, [rax + rdi]
add rcx, 8
mov dl, 0xa
call r14
mov rcx, rsi
mov edx, eax
call r15
mov rcx, rsi
call rbx
mov rcx, rdi
call fcn.180002630
movzx ebx, byte [0x180015210]
test bl, bl
jne 0x180003bfa
mov byte [0x180015210], 1
lea rax, [0x180015214]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1800056b0]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180015218], rax
mov eax, ebx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800043e0
Capabilities:
Get graphical window text

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rsi, rdx
mov rdx, r8
call fcn.180004b20
test rax, rax
je 0x18000449d
lea rdx, [rsp + 0x40]
mov rcx, rax
mov r8d, 0x100
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x18000449d
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x30], xmm0
lea rdi, [0x180015110]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 0x100
lea r8, [rsp + 0x40]
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rsi], ymm0
mov rcx, rdi
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x180004533
mov rdi, rax
cmp rax, 0xf
ja 0x1800044b7
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
lea rdx, [0x180015110]
mov rcx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
jmp 0x180004520
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
jmp 0x180004523
mov qword [rsi + 0x18], 0xf
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp r14, 0xfff
jb 0x1800044f4
lea rcx, [r14 + 0x28]
call fcn.18000b8bc
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180004500
lea rcx, [r14 + 1]
call fcn.18000b8bc
mov rbx, rax
mov qword [rsi], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r14
lea rdx, [0x180015110]
mov rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov byte [rdi], 0
mov rax, rsi
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
call fcn.180002ee0
int3

Function at 0x180004b20
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rdx
mov r14, rcx
mov rax, qword [0x180014d88]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rcx + 8], 0
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x180004bbf
mov rbx, rax
mov dword [rsp + 0x28], 0x238
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180004bb6
lea r15, [rsp + 0x54]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea rsi, [rsp + 0x28]
nop
mov rcx, r15
mov rdx, rdi
call r12
test eax, eax
je 0x180004bae
mov rcx, rbx
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180004b90
jmp 0x180004bb6
mov eax, dword [rsp + 0x30]
mov dword [r14 + 8], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [r14 + 8], 0
je 0x180004bdb
lea rcx, [0x180004c10]
mov rdx, r14
call qword [sym.imp.USER32.dll_EnumWindows]
mov rsi, qword [r14]
jmp 0x180004bdd
xor esi, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000b9e0
mov rax, rsi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180005e00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
sub rsp, 0x198
lea rbp, [rsp + 0x80]
vmovaps xmmword [rbp + 0x100], xmm8
vmovaps xmmword [rbp + 0xf0], xmm7
vmovaps xmmword [rbp + 0xe0], xmm6
mov qword [rbp + 0xd8], 0xfffffffffffffffe
mov rsi, rcx
mov byte [rcx], 0
call fcn.180009f00
lea rcx, [rsi + 8]
mov rax, qword [0x180015228]
mov r8, qword [rax + 0x10]
vmovaps ymm0, ymmword [str.http_req]
vmovups ymmword [rbp - 0x60], ymm0
lea r9, [0x180006320]
lea rdx, [rbp - 0x60]
mov qword [rbp + 0xa0], rcx
vzeroupper
call fcn.180001220
lea rcx, [rsi + 0x40]
mov rax, qword [0x180015228]
mov r8, qword [rax + 0x18]
vxorps xmm6, xmm6, xmm6
vmovaps xmmword [rbp + 0x40], xmm6
vmovaps xmm8, xmmword [0x18000ee20]
vmovaps xmmword [rbp + 0x50], xmm8
mov word [rbp + 0x40], 0x616e
mov byte [rbp + 0x42], 0x74
lea r9, [0x180006570]
lea rdx, [rbp + 0x40]
mov qword [rbp + 0xa8], rcx
call fcn.180001220
lea rcx, [rsi + 0x78]
mov rax, qword [0x180015228]
mov r8, qword [rax + 0x20]
vmovaps xmmword [rbp - 0x40], xmm6
vmovaps xmm6, xmmword [0x18000ee30]
vmovaps xmmword [rbp - 0x30], xmm6
mov dword [rbp - 0x40], 0x7874626c
lea r9, [0x180006590]
lea rdx, [rbp - 0x40]
mov qword [rbp + 0xb0], rcx
call fcn.180001220
lea rcx, [rsi + 0xb0]
mov rax, qword [0x180015228]
mov r8, qword [rax + 0x28]
vxorps xmm7, xmm7, xmm7
vmovaps xmmword [rbp - 0x20], xmm7
vmovaps xmmword [rbp - 0x10], xmm6
mov dword [rbp - 0x20], 0x6d78746c
lea r9, [0x180006690]
lea rdx, [rbp - 0x20]
mov qword [rbp + 0xb8], rcx
call fcn.180001220
lea rcx, [rsi + 0xe8]
mov rax, qword [0x180015228]
mov r8, qword [rax + 0x40]
vmovaps xmmword [rbp + 0x60], xmm7
vmovaps xmmword [rbp + 0x70], xmm8
mov word [rbp + 0x60], 0x6d73
mov byte [rbp + 0x62], 0x61
lea r9, [0x1800066b0]
lea rdx, [rbp + 0x60]
mov qword [rbp + 0xc0], rcx
call fcn.180001220
lea rcx, [rsi + 0x120]
mov rax, qword [0x180015228]
mov r8, qword [rax + 0x48]
vxorps xmm7, xmm7, xmm7
vmovaps xmmword [rbp], xmm7
vmovaps xmm0, xmmword [0x18000ee40]
vmovaps xmmword [rbp + 0x10], xmm0
mov word [rbp], 0x7073
lea r9, [0x180006760]
mov rdx, rbp
mov qword [rbp + 0xc8], rcx
call fcn.180001220
lea rcx, [rsi + 0x158]
mov rax, qword [0x180015228]
mov r8, qword [rax + 0x50]
vmovaps xmmword [rbp + 0x20], xmm7
vmovaps xmmword [rbp + 0x30], xmm6
mov dword [rbp + 0x20], 0x70676264
lea r9, [0x180006780]
lea rdx, [rbp + 0x20]
mov qword [rbp + 0xd0], rcx
call fcn.180001220
mov rax, qword [0x180015228]
mov r8, qword [rax + 0x58]
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rbp + 0x80], xmm0
vmovaps xmm0, xmmword [0x18000ee50]
vmovaps xmmword [rbp + 0x90], xmm0
mov dword [rbp + 0x80], 0x6c676b70
mov byte [rbp + 0x84], 0x63
lea rcx, [rsi + 0x190]
lea r9, [0x1800067a0]
lea rdx, [rbp + 0x80]
call fcn.180001220
mov qword [0x180015220], rsi
mov rax, rsi
vmovaps xmm6, xmmword [rbp + 0xe0]
vmovaps xmm7, xmmword [rbp + 0xf0]
vmovaps xmm8, xmmword [rbp + 0x100]
add rsp, 0x198
pop rsi
pop rbp
ret