joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Attazs_tdummy_talliance_tgretchenwilds_tcontactform_tcomposer_ttestnew_toptimize_tbullet_tthenews_tcustom_tssb_tprocurement_thandheld_tblackboard_twsi_ttw_tphotogallery_tbadgdformmail_tlinkscan_tflashtest_taffilinet_tonlinetraining_tstylesheetwidget_tdistricts_tamigos_tmystats_tbin_troundcube_tdecember_tbackup_tcmn_tmapadosite_tdarren_twpresources
mov r10, rax
sub rbx, rax
movabs rdi, 0x67b23a5440cf6475
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xc]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140004eb0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Attazs_tdummy_talliance_tgretchenwilds_tcontactform_tcomposer_ttestnew_toptimize_tbullet_tthenews_tcustom_tssb_tprocurement_thandheld_tblackboard_twsi_ttw_tphotogallery_tbadgdformmail_tlinkscan_tflashtest_taffilinet_tonlinetraining_tstylesheetwidget_tdistricts_tamigos_tmystats_tbin_troundcube_tdecember_tbackup_tcmn_tmapadosite_tdarren_twpresources
mov r10, rax
sub rbx, rax
movabs rdi, 0x67b23a5440cf6475
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13c
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140005020
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000bce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400191c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1c0012
mov dword [rbp - 0x1c], 0xd0011
mov dword [rbp - 0x18], 0x400016
mov dword [rbp - 0x14], 0x4a003b
mov dword [rbp - 0x10], 0x10011
mov dword [rbp - 0xc], 0x790001
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400191c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400191a0], rax
mov dword [rbp - 0x20], 0x1d0016
mov dword [rbp - 0x1c], 0x8001a
mov dword [rbp - 0x18], 0x160014
mov dword [rbp - 0x14], 0x4a007d
mov dword [rbp - 0x10], 0x10011
mov dword [rbp - 0xc], 0x790001
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140017a00]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400191b0], rax
mov word [rbp - 0x10], 0x361f
mov byte [rbp - 0xe], 0x6e
call fcn.140004620
mov rcx, qword [0x1400191a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140019130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xd111c12
mov dword [rbp - 0x1c], 0x1713616
mov dword [rbp - 0x18], 0x1c191816
mov word [rbp - 0x14], 0x615e
call fcn.140001180
mov rcx, qword [0x1400191a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140019130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x4001a08
mov dword [rbp - 0x1c], 0x106c1d08
mov dword [rbp - 0x18], 0x17081d3a
mov word [rbp - 0x14], 0x6148
call fcn.140001180
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017a80]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400190e8], rax
mov byte [rbp - 0x10], 0x69
call fcn.140004330
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400179a0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400190f0], rax
mov dword [rbp - 0x10], 0x630b0d0d
call fcn.140002660
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400179d0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400190e0], rax
mov byte [rbp - 0x10], 0x69
call fcn.140004330
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140017a40]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400190d8], rax
mov dword [rbp - 0x10], 0x22000e00
mov byte [rbp - 0xc], 0x65
call fcn.140003130
mov rcx, qword [0x1400191b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400179b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140019130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2007
mov byte [rbp - 0xe], 0x6e
call fcn.140004620
mov rcx, qword [0x1400191b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x14000c110
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c172
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000b0d0
test al, al
jne 0x14000c184
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000c140
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6d
mov dword [rbp - 0x20], 0x31000a
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2f0026
mov dword [rbp - 0x18], 0x3f003f
mov dword [rbp - 0x14], 0x25004b
mov dword [rbp - 0x10], 0x280026
call fcn.140004fd0
mov rcx, rax
call 0x14000c110
mov qword [0x1400191b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x75
mov dword [rbp - 0x20], 0x31000a
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2f0026
mov dword [rbp - 0x18], 0x3f003f
mov dword [rbp - 0x14], 0x56003a
call fcn.1400022a0
mov rcx, rax
call 0x14000c110
lea rcx, [rbp - 0x20]
mov qword [0x1400191a8], rax
mov dword [rbp - 0x20], 0x2f
mov dword [rbp - 0x1c], 0xd0010
mov dword [rbp - 0x18], 0x730016
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000c110
Function at 0x14000cce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c172
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000b0d0
test al, al
jne 0x14000c184
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000c140
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x6d
mov dword [rbp - 0x20], 0x31000a
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2f0026
mov dword [rbp - 0x18], 0x3f003f
mov dword [rbp - 0x14], 0x25004b
mov dword [rbp - 0x10], 0x280026
call fcn.140004fd0
mov rcx, rax
call 0x14000c110
mov qword [0x1400191b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x75
mov dword [rbp - 0x20], 0x31000a
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2f0026
mov dword [rbp - 0x18], 0x3f003f
mov dword [rbp - 0x14], 0x56003a
call fcn.1400022a0
mov rcx, rax
call 0x14000c110
lea rcx, [rbp - 0x20]
mov qword [0x1400191a8], rax
mov dword [rbp - 0x20], 0x2f
mov dword [rbp - 0x1c], 0xd0010
mov dword [rbp - 0x18], 0x730016
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000c110
Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x140013f30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001128f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015280
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400152a0
xor al, al
jmp 0x140015321
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400152b3
xor al, al
jmp 0x140015321
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400152dd
xor al, al
jmp 0x140015321
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400152f1
xor al, al
jmp 0x140015321
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015303
xor al, al
jmp 0x140015321
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001531f
xor al, al
jmp 0x140015321
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113b1
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x140012140
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x1400250a4]
call fcn.1400113ca
mov rax, qword gs:[0x60]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x140012211
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x50]
call fcn.140011406
mov dword [rbp + 0x64], eax
mov rax, qword [rbp + 0x48]
movzx eax, word [rax + 0x48]
test eax, eax
je 0x1400121ff
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x50]
call fcn.140011406
cmp dword [rbp + 0x160], eax
jne 0x1400121fd
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x48]
mov r9, qword [rcx + rax + 0x20]
mov r8d, dword [rbp + 0x64]
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + 0x50]
lea rcx, str._____s__Hash___0x_0.8X_At_:_0x_p__n
call fcn.14001102d
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx + rax + 0x20]
jmp 0x140012211
jmp 0x140012201
jmp 0x140012211
mov rax, qword [rbp + 0x48]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
jmp 0x140012183
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1400113f7
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
jmp 0x140011890
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x178]
mov rax, qword [0x14001f180]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1400250a4]
call fcn.1400113ca
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 0x18
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140011912
mov eax, 0xffffffff
jmp 0x1400119e8
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14001193e
mov eax, 0xffffffff
jmp 0x1400119e8
xor r9d, r9d
mov r8d, dword [rbp + 0x158]
mov rdx, qword [rbp + 0x150]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x140011967
mov eax, 0xffffffff
jmp 0x1400119e8
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rbp + 0x28]
mov edx, 0x6610
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x140011991
mov eax, 0xffffffff
jmp 0x1400119e8
lea rax, [rbp + 0x148]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x140]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1400119c6
mov eax, 0xffffffff
jmp 0x1400119e8
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bd90]
call fcn.14001132f
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x180005058
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r10, dword [rcx + 0x3c]
mov r11d, edx
add r10, rcx
movzx eax, word [r10 + 0x14]
lea r9, [r10 + 0x18]
movzx ebx, word [r10 + 6]
add r9, rax
xor r8d, r8d
cmp r11d, dword [r9 + 0xc]
jb 0x18000509c
mov ecx, dword [r10 + 0x3c]
lea edx, [rcx - 1]
add edx, dword [r9 + 0x10]
lea eax, [rcx - 1]
not eax
and edx, eax
add edx, dword [r9 + 0xc]
cmp r11d, edx
jb 0x1800050ac
add r9, 0x28
mov eax, 0xffff
add bx, ax
je 0x1800050b7
jmp 0x18000507b
mov r8d, dword [r9 + 0x14]
sub r8d, dword [r9 + 0xc]
add r8d, r11d
mov rbx, qword [rsp + 8]
mov eax, r8d
ret
Function at 0x180038183
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18019e518]
jne 0x1800370ba
rol rcx, 0x10
test cx, 0xffff
jne 0x1800370b6
repz ret
ror rcx, 0x10
jmp 0x1800380dc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1801a25d0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1801a26c8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180038161
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1801a25d0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180038183
mov rax, qword [rsp + 0x88]
mov qword [0x1801a26c8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1801a2668], rax
mov rax, qword [0x1801a26c8]
mov qword [0x1801a2540], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1801a2650], rax
mov dword [0x1801a2530], 0xc0000409
mov dword [0x1801a2534], 1
mov rax, qword [0x18019e518]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18019e520]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1801a25c8], eax
mov ecx, 1
call fcn.18003cd8c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800d4580]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1801a25c8], 0
jne 0x18003820a
mov ecx, 1
call fcn.18003cd8c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18003c020
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18003be88
Function at 0x18004c140
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180038360
xor ebx, ebx
mov rdi, rax
cmp qword [0x1801a32f8], rbx
jne 0x18004c246
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18004c31b
lea rdx, [0x1800d7188]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18004c31b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800d7178]
mov rcx, rsi
mov qword [0x1801a32f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800d7160]
mov rcx, rsi
mov qword [0x1801a3300], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1801a3308], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1801a3318], rax
test rax, rax
je 0x18004c23d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1801a3310], rax
jmp 0x18004c24d
mov rax, qword [0x1801a3310]
jmp 0x18004c254
mov rax, qword [0x1801a3310]
mov r11, qword [0x1801a3318]
cmp rax, rdi
je 0x18004c2bc
cmp r11, rdi
je 0x18004c2bc
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1801a3318]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18004c2bc
test rax, rax
je 0x18004c2bc
call rsi
test rax, rax
je 0x18004c2b6
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18004c2b6
test byte [rsp + 0x38], 1
jne 0x18004c2bc
bts ebp, 0x15
jmp 0x18004c2fa
mov rcx, qword [0x1801a3300]
cmp rcx, rdi
je 0x18004c2fa
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18004c2fa
call rax
mov rbx, rax
test rax, rax
je 0x18004c2fa
mov rcx, qword [0x1801a3308]
cmp rcx, rdi
je 0x18004c2fa
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18004c2fa
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1801a32f8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18004c31b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18004c31d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180051a78
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.18006efb8
mov rsi, rax
test rax, rax
je 0x180051af4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x180051aef
cmp dword [rbx], 0x40
jb 0x180051aef
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x180051aef
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x180051af8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18005a91c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x18005a984
call fcn.18006cbc0
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x18005a984
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x18005a9a6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.18005a334
mov esi, eax
test rdi, rdi
je 0x18005a9a4
test rbx, rbx
je 0x18005a9a4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret