joyce8/EMBER2024-capa huggingface dataset:
Function at 0x789fe0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x78a140
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x88], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x28], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x20]
nop
call fcn.00789380
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x50]
movups xmmword [rcx], xmm15
lea rcx, [rsp + 0x60]
movups xmmword [rcx], xmm15
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x88]
xor eax, eax
jmp 0x78a08d
inc rax
mov rcx, rbx
cmp rax, 5
jge 0x78a0de
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
sar rdx, 3
mov rdi, rdx
shl rdx, 3
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x48]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
mov rdx, qword [rsp + 0x10]
mov qword [rsp + 0x18], rdx
xor ecx, ecx
jmp 0x78a104
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
movzx r8d, byte [rbx + rsi]
or r8d, edx
mov byte [rbx + rsi], r8b
inc rcx
cmp rcx, 8
jge 0x78a087
movzx edx, byte [rsp + rcx + 0x18]
lea rsi, [rdi + rcx]
nop word [rax + rax]
cmp rsi, 0x20
jge 0x78a087
test byte [rbx], al
cmp rsi, 0x20
jb 0x78a0f5
mov rax, rsi
mov ecx, 0x20
call fcn.00464380
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00461c80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00789fe0
Function at 0x795b20
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x795b38
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x795b38
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x795b40
xor eax, eax
ret
cmp rbx, 3
je 0x795b4c
cmp rbx, 4
jne 0x795b79
cmp al, 0x2c
ja 0x795b66
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x795b76
cmp al, 0x24
je 0x795b76
nop dword [rax]
cmp al, 0x26
jae 0x795b76
jmp 0x795b79
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x795b76
cmp al, 0x5b
je 0x795b76
cmp al, 0x5d
jne 0x795b79
xor eax, eax
ret
cmp al, 0x2f
ja 0x795bb2
nop dword [rax]
cmp al, 0x26
ja 0x795b91
cmp al, 0x24
je 0x795bd1
cmp al, 0x26
je 0x795bd1
jmp 0x795c4b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x795bd1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x795c48
cmp al, 0x2f
je 0x795bd1
jmp 0x795c4b
cmp al, 0x3d
ja 0x795bc9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x795bd1
nop
cmp al, 0x3d
je 0x795bd1
jmp 0x795c4b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x795c40
cmp rbx, 2
jg 0x795c07
cmp rbx, 1
je 0x795c01
nop dword [rax]
cmp rbx, 2
jne 0x795c4b
cmp al, 0x2f
je 0x795bf2
cmp al, 0x3b
je 0x795bf2
cmp al, 0x2c
jne 0x795bf9
mov ecx, 1
jmp 0x795bfe
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x795c2a
cmp al, 0x40
je 0x795c19
cmp al, 0x2f
je 0x795c19
cmp al, 0x3f
jne 0x795c22
mov ecx, 1
nop
jmp 0x795c27
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x795c39
cmp rbx, 7
jne 0x795c4b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x795c48
cmp al, 0x7e
jne 0x795c4b
xor eax, eax
ret
cmp rbx, 7
jne 0x795c61
cmp al, 0x21
je 0x795c5d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x795c61
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x14000cb20
Capabilities:
Get hostname

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor r9d, r9d
mov r8d, 2
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14000d4a0
mov r11, qword [rsp + 0x30]
mov eax, dword [rsp + 0x40]
mov dword [r11 + 0xf8], eax
mov rcx, qword [rsp + 0x30]
add rcx, 0x30
mov edx, 0x12c
call qword [sym.imp.WS2_32.dll_gethostname]
add rsp, 0x28
ret
Function at 0x14000ed30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x28], 0
cmp qword [rsp + 0x60], 0
jne 0x14000ed60
mov ecx, 0x7f
call qword [0x1414f2be0]
xor eax, eax
jmp 0x14000ef2c
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
add rax, 0x88
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0
jne 0x14000ed90
mov ecx, 0x7f
call qword [0x1414f2be0]
xor eax, eax
jmp 0x14000ef2c
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x18], 0
je 0x14000edbb
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0x14], 0
jne 0x14000edcd
mov ecx, 0x7f
call qword [0x1414f2be0]
xor eax, eax
jmp 0x14000ef2c
mov rax, qword [rsp + 0x68]
shr rax, 0x10
and rax, 0xffff
movzx eax, ax
test eax, eax
jne 0x14000ee2c
mov rax, qword [rsp + 0x68]
and rax, 0xffff
movzx ecx, ax
mov rax, qword [rsp + 0x20]
cmp ecx, dword [rax + 0x10]
jae 0x14000ee0d
mov ecx, 0x7f
call qword [0x1414f2be0]
xor eax, eax
jmp 0x14000ef2c
mov rax, qword [rsp + 0x68]
and rax, 0xffff
movzx eax, ax
mov rcx, qword [rsp + 0x20]
sub eax, dword [rcx + 0x10]
mov dword [rsp + 0x28], eax
jmp 0x14000eeeb
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
jmp 0x14000ee91
mov eax, dword [rsp + 0x3c]
add eax, 1
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x40]
add rax, 4
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x3c], eax
jae 0x14000eed5
mov rax, qword [rsp + 0x40]
mov edx, dword [rax]
mov rax, qword [rsp + 0x60]
add rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x68]
call fcn.14002aa30
test eax, eax
jne 0x14000eed3
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x38], 1
jmp 0x14000eed5
jmp 0x14000ee6a
cmp dword [rsp + 0x38], 0
jne 0x14000eeeb
mov ecx, 0x7f
call qword [0x1414f2be0]
xor eax, eax
jmp 0x14000ef2c
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x14]
cmp dword [rsp + 0x28], eax
jbe 0x14000ef08
mov ecx, 0x7f
call qword [0x1414f2be0]
xor eax, eax
jmp 0x14000ef2c
mov rax, qword [rsp + 0x20]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
add rcx, rax
mov eax, dword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x60]
add rax, qword [rcx + 8]
add rsp, 0x58
ret
Function at 0x14000f530
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x78]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx]
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
movzx eax, word [rax + 0x14]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x14000f597
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
add rax, 0x28
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x14000f6ea
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x10], 0
jne 0x14000f641
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x38]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jle 0x14000f63c
movsxd rdx, dword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov r9d, 4
mov r8d, 0x1000
call qword [0x1414f2bf0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000f60a
xor eax, eax
jmp 0x14000f6ef
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0xc]
mov rax, qword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
mov dword [rcx + 8], eax
movsxd r8, dword [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.14002a6f0
jmp 0x14000f57e
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x14]
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0x10]
mov rax, rdx
add rax, rcx
cmp qword [rsp + 0x68], rax
jae 0x14000f665
xor eax, eax
jmp 0x14000f6ef
mov rax, qword [rsp + 0x40]
mov edx, dword [rax + 0x10]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov r9d, 4
mov r8d, 0x1000
call qword [0x1414f2bf0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000f6a0
xor eax, eax
jmp 0x14000f6ef
mov rax, qword [rsp + 0x40]
mov ecx, dword [rax + 0xc]
mov rax, qword [rsp + 0x30]
add rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov r8d, dword [rax + 0x10]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x14]
mov rdx, qword [rsp + 0x60]
add rdx, rax
mov rcx, qword [rsp + 0x28]
call fcn.1400282a0
mov r11, qword [rsp + 0x40]
mov eax, dword [rsp + 0x28]
mov dword [r11 + 8], eax
jmp 0x14000f57e
mov eax, 1
add rsp, 0x58
ret

Function at 0x140011210
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
add rsp, 0x28
ret

Function at 0x140011230
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
add rsp, 0x28
ret
Function at 0x1400120cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001210b
cmp dword [rcx + 0xa8], 0
jne 0x14001210b
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.140020f48
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140012070
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140013064
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14002133c
mov rsi, rax
test rax, rax
je 0x1400130e0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x1400130db
cmp dword [rbx], 0x40
jb 0x1400130db
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400130db
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x1400130e4
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140019bf4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140019c5c
call fcn.140020f48
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140019c5c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x140019c7e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140019604
mov esi, eax
test rdi, rdi
je 0x140019c7c
test rbx, rbx
je 0x140019c7c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x14001a878
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140029a00
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400300b0
nop
cmp dword [0x1414f66e8], 1
je 0x1400299ac
mov dword [0x1414f66e4], 1
mov byte [0x1414f66e0], r12b
test ebx, ebx
jne 0x140029998
mov rcx, qword [0x1414f78d0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140029985
mov rcx, qword [0x1414f78c8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140029924
call fcn.14002dce0
cmp qword [rdi], rax
jne 0x140029924
jmp 0x14002990a
cmp rdi, rsi
jb 0x140029985
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14002dce0
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1414f78d0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1414f78c8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140029963
cmp r13, rax
je 0x140029983
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14002990a
lea rdx, [0x140040bc0]
lea rcx, [0x140040ba8]
call fcn.140029754
lea rdx, [0x140040bd0]
lea rcx, [0x140040bc8]
call fcn.140029754
nop
test r12d, r12d
je 0x1400299bb
mov ecx, 8
call fcn.14002ffb0
test r12d, r12d
jne 0x1400299e6
mov dword [0x1414f66e8], 1
lea ecx, [r12 + 8]
call fcn.14002ffb0
mov ecx, r15d
call fcn.1400296e8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140029874

Function at 0x140029a0c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140029874
Function at 0x14002e24f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x141485638]
jne 0x1400281fa
rol rcx, 0x10
test cx, 0xffff
jne 0x1400281f6
repz ret
ror rcx, 0x10
jmp 0x14002e1a8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1414f6cf0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1414f6de8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002e22d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1414f6cf0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002e24f
mov rax, qword [rsp + 0x88]
mov qword [0x1414f6de8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1414f6d88], rax
mov rax, qword [0x1414f6de8]
mov qword [0x1414f6c60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1414f6d70], rax
mov dword [0x1414f6c50], 0xc0000409
mov dword [0x1414f6c54], 1
mov rax, qword [0x141485638]
mov qword [rsp + 0x68], rax
mov rax, qword [0x141485640]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1414f6ce8], eax
mov ecx, 1
call fcn.14003722c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, str.PlOA
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1414f6ce8], 0
jne 0x14002e2d6
mov ecx, 1
call fcn.14003722c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140036e10
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14002dce0
xor ebx, ebx
mov rdi, rax
cmp qword [0x1414f7590], rbx
jne 0x140036f16
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140036feb
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140036feb
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1400477a0]
mov rcx, rsi
mov qword [0x1414f7590], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140047788]
mov rcx, rsi
mov qword [0x1414f7598], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1414f75a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1414f75b0], rax
test rax, rax
je 0x140036f0d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1414f75a8], rax
jmp 0x140036f1d
mov rax, qword [0x1414f75a8]
jmp 0x140036f24
mov rax, qword [0x1414f75a8]
mov r11, qword [0x1414f75b0]
cmp rax, rdi
je 0x140036f8c
cmp r11, rdi
je 0x140036f8c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1414f75b0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140036f8c
test rax, rax
je 0x140036f8c
call rsi
test rax, rax
je 0x140036f86
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140036f86
test byte [rsp + 0x38], 1
jne 0x140036f8c
bts ebp, 0x15
jmp 0x140036fca
mov rcx, qword [0x1414f7598]
cmp rcx, rdi
je 0x140036fca
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140036fca
call rax
mov rbx, rax
test rax, rax
je 0x140036fca
mov rcx, qword [0x1414f75a0]
cmp rcx, rdi
je 0x140036fca
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140036fca
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1414f7590]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140036feb
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140036fed
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18000ab40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x18000ab74
cmp ecx, r10d
jge 0x18000ab62
mov rcx, rbx
call fcn.18000a320
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x18000abae
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x18000ab90
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x18000abdd
mov edx, dword [0x18018d84c]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x18000ac0f
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x18000abf9
xor dl, dl
jmp 0x18000ac02
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x18000abf0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x18000abb2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x18000ac84
mov edx, dword [0x18018d84c]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x18000ac9e
mov rcx, rbx
call fcn.18000a470
test eax, eax
je 0x18000ac77
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1800299c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm8
mov rax, qword [0x1801432e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x18018d84c]
mov rax, qword gs:[0x58]
mov edx, 8
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x18018dcf8], ecx
jle 0x180029a3c
lea rcx, [0x18018dcf8]
call fcn.1800d0e78
cmp dword [0x18018dcf8], 0xffffffff
jne 0x180029a3c
call fcn.18001f120
lea rcx, [0x1800d7190]
call fcn.1800d1600
nop
lea rcx, [0x18018dcf8]
call fcn.1800d0e0c
movups xmm0, xmmword [str.tJRYEZR]
movups xmmword [rsp + 0x30], xmm0
movzx eax, byte [0x1800fbe70]
mov byte [rsp + 0x40], al
xor ecx, ecx
cmp dword [0x1801432f0], 2
jl 0x180029bb0
movdqa xmm5, xmmword [0x1800ff470]
movdqa xmm4, xmmword [0x1800ff5e0]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [0x1800ff4c0]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.1111111111111111]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x34]
mov r8d, dword [rsp + 0x20]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800ff500]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800ff500]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x180029ab0
cmp ecx, 0x11
jge 0x180029bec
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
sub al, dl
add al, 0x31
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x11
jl 0x180029bc0
lea r8, [0x18018d8ab]
lea rdx, [rsp + 0x30]
lea rcx, [0x18018da80]
call fcn.1800211f0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800d0db0
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x50]
add rsp, 0x88
ret