joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b600
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
xor ecx, ecx
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea r11, [rsp + 0x68]
lea r9, [0x140020c48]
lea rcx, [0x140020c58]
lea r8d, [rdx + 1]
mov qword [rsp + 0x20], r11
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000b6f5
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x30]
lea rdx, [0x140020c38]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14000b6ea
mov rcx, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x14000b6ea
mov rcx, qword [rsp + 0x68]
xor eax, eax
xor r9d, r9d
mov word [rdi], ax
mov word [rsi], ax
mov rax, qword [rcx]
mov r8d, 0x400
mov rdx, rdi
mov dword [rsp + 0x20], 2
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x68]
test eax, eax
jne 0x14000b6ef
mov r9, qword [rcx]
mov r8d, 0x400
mov rdx, rsi
call qword [r9 + 0x50]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rcx]
movsxd rbx, eax
call qword [rdx + 0x10]
test rbx, rbx
jne 0x14000b6f5
cmp word [rdi], bx
je 0x14000b6f5
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x14000bba0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x38], rsp
mov rsi, r9
mov edi, r8d
mov r14, rdx
mov r15, rcx
xor ecx, ecx
mov qword [r11 - 0x30], rcx
mov qword [r11 - 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov r12, qword [rsp + 0xa8]
mov dword [r12], ecx
lea rax, [r11 - 0x48]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rcx
lea r9, [r11 - 0x44]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000bc23
lea rdx, [0x14000bc1c]
mov rcx, rsp
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000bdc8
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x14000bc50
cmp eax, 2
je 0x14000bc50
cmp eax, 7
je 0x14000bc50
lea rdx, [0x14000bc49]
mov rcx, qword [rsp + 0x38]
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000bdc8
mov eax, edi
neg eax
sbb rcx, rcx
and ecx, 0x1c
mov eax, dword [rsp + 0x30]
lea r13, [rcx + rax + 2]
shr r13, 1
lea rcx, [r13 + 1]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000f89c
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x14000bcac
lea rdx, [0x14000bca5]
mov rcx, qword [rsp + 0x38]
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000bdc8
xor eax, eax
mov word [rbx], ax
test edi, edi
je 0x14000bcc7
lea r8, str.Applications_
mov rdx, r13
mov rcx, rbx
call fcn.14000f924
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea rax, [rbx + rcx*2 - 2]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, r14
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000bd1c
lea rdx, [0x14000bd15]
mov rcx, qword [rsp + 0x38]
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000bdc8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000bd5a
lea rdx, [0x14000bd56]
mov rcx, qword [rsp + 0x38]
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000bdc8
mov qword [rsp + 0x28], r12
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.command
mov rcx, qword [rsp + 0x40]
call fcn.14000baa0
test eax, eax
je 0x14000bda1
lea rdx, [0x14000bd9d]
mov rcx, qword [rsp + 0x38]
call fcn.14000f8c0
nop
nop
xor eax, eax
jmp 0x14000bdc8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000bdbb
test rsi, rsi
je 0x14000bdb5
mov qword [rsi], rcx
jmp 0x14000bdbb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.14000f894
mov eax, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000bdf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
test rdx, rdx
je 0x14000be37
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000bef8
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000bee8
mov eax, dword [rsp + 0x48]
cmp eax, 1
je 0x14000be71
cmp eax, 2
je 0x14000be71
cmp eax, 7
jne 0x14000bee8
mov ecx, dword [rsp + 0x40]
call fcn.14000f89c
mov rcx, qword [rsp + 0x50]
mov rdi, rax
test rax, rax
je 0x14000beed
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14000becf
cmp rcx, rbx
je 0x14000beba
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.14000f894
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
cmp rcx, rbx
je 0x14000beda
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x50]
cmp rcx, rbx
je 0x14000bef8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14000c3a0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
lea rax, [r11 + 0x18]
xor ebx, ebx
mov rdi, rdx
mov qword [r11 - 0x18], rax
lea rax, [r11 + 0x20]
mov rdx, rcx
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x40000000
mov dword [rsp + 0x20], ebx
mov qword [r11 + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000c3fc
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
cmp dword [rsp + 0x70], 2
mov rcx, qword [rsp + 0x78]
jne 0x14000c420
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rdi], ebx
mov eax, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
lea rax, str.exefile
lea rdx, [0x140023470]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0xe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
movsxd rbx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
jne 0x14000c3ef
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x60]
mov dword [rdi], 1
add rsp, 0x50
pop rdi
ret

Function at 0x14000c480
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x28
mov rdx, rcx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x14000c6b0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x840
mov rax, qword [0x140029ab0]
xor rax, rsp
mov qword [rsp + 0x830], rax
xor edx, edx
mov rdi, rcx
lea r8, str.360BoxLd_Cmd
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
jne 0x14000c70a
lea r8, str.Global360BoxLd_Cmd
lea ecx, [rax + 4]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rbx, rax
test rax, rax
je 0x14000c8d7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 4]
mov qword [rsp + 0x860], rsi
mov qword [rsp + 0x20], 0x800
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
jne 0x14000c746
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000c8cf
lea rcx, [rsp + 0x30]
mov rdx, rax
mov r8d, 0x800
mov qword [rsp + 0x858], rbp
call fcn.14000f080
xor ebp, ebp
mov rcx, rsi
mov word [rsp + 0x82e], bp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x30], 0x424f584c
jne 0x14000c876
mov eax, dword [rsp + 0x34]
cmp eax, 1
jne 0x14000c7e8
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14000c872
lea edx, [rbp + 0x2e]
lea rcx, [rsp + 0x40]
mov qword [0x14002b6d0], rax
call fcn.14000efd0
mov rcx, rax
call fcn.14000c350
test eax, eax
je 0x14000c7de
lea rdx, [0x14002b6f0]
lea rcx, [rsp + 0x40]
mov r8, rdi
call fcn.14000c640
test eax, eax
jne 0x14000c8c0
lea rdx, [rsp + 0x40]
jmp 0x14000c8ae
cmp eax, 2
jne 0x14000c872
mov eax, dword [rsp + 0x38]
lea rcx, [rsp + 0x40]
mov edx, 0x2e
and eax, 1
mov dword [0x14002b6d8], eax
call fcn.14000efd0
mov rcx, rax
call fcn.14000c350
test eax, eax
je 0x14000c835
lea rdx, [0x14002b6f0]
lea rcx, [rsp + 0x40]
mov r8, rdi
call fcn.14000c640
test eax, eax
jne 0x14000c8c0
lea rcx, [0x14002b6f0]
lea rdx, [rsp + 0x40]
mov r8d, 0x190
call fcn.14000f080
lea rdx, [rsp + 0x1d0]
mov rcx, rdi
mov r8d, 0x618
mov word [0x14002b880], bp
call fcn.14000f080
mov word [rdi + 0x618], bp
jmp 0x14000c8c0
xor eax, eax
jmp 0x14000c8c7
lea rcx, [rsp + 0x30]
mov edx, 0x2e
call fcn.14000efd0
mov rcx, rax
call fcn.14000c350
test eax, eax
je 0x14000c8a9
lea rdx, [0x14002b6f0]
lea rcx, [rsp + 0x30]
mov r8, rdi
call fcn.14000c640
test eax, eax
jne 0x14000c8c0
lea rdx, [rsp + 0x30]
lea rcx, [0x14002b6f0]
mov r8d, 0x800
call fcn.14000f080
lea rax, [0x14002b6f0]
mov rbp, qword [rsp + 0x858]
mov rsi, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.14000f6d0
mov rbx, qword [rsp + 0x868]
add rsp, 0x840
pop rdi
ret
Function at 0x14000e0b0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r13, rdx
lea rdx, [rsp + 0x68]
mov r12, r8
mov rbp, rcx
xor edi, edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
je 0x14000e144
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.14000f89c
mov rbx, rax
test rax, rax
je 0x14000e13f
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14000e135
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x14002094c]
mov rcx, rbx
call sub.VERSION.dll_VerQueryValueW
mov rdx, qword [rsp + 0x28]
mov ecx, dword [rdx + 8]
mov edi, eax
mov dword [r13], ecx
mov ecx, dword [rdx + 0xc]
mov dword [r12], ecx
mov rcx, rbx
call fcn.14000f894
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x14000e180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140029ab0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ebx, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x14000e1b8
xor eax, eax
jmp 0x14000e200
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14000e1b4
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x14000e1b4
mov rcx, rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x270], rdi
cmp word [rax], 0
je 0x14000e219
add rax, 2
sub rcx, 1
jne 0x14000e1e6
xor eax, eax
mov rdi, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000f6d0
add rsp, 0x250
pop rbx
ret
test rcx, rcx
je 0x14000e1f6
mov rdx, rbx
mov edi, 0
sub rdx, rcx
mov r9d, edi
sub rbx, rdx
lea rax, [rsp + rdx*2 + 0x30]
je 0x14000e26e
lea r8, str.360base64.dll
lea rcx, [rbx + rdx + 0x7ffffefb]
sub r8, rax
test rcx, rcx
je 0x14000e269
movzx edx, word [r8 + rax]
test dx, dx
je 0x14000e269
mov word [rax], dx
add rax, 2
dec rcx
sub rbx, 1
jne 0x14000e248
jmp 0x14000e26e
test rbx, rbx
jne 0x14000e278
sub rax, 2
mov r9d, 0x8007007a
mov word [rax], di
test r9d, r9d
js 0x14000e1f6
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000e3f6
test al, 0x10
jne 0x14000e3f6
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x20], edi
call fcn.14000e0b0
test eax, eax
je 0x14000e3f6
mov ecx, dword [rsp + 0x24]
mov eax, ecx
shr eax, 0x10
cmp ax, 1
jb 0x14000e3f6
cmp ax, 1
jne 0x14000e2fe
test cx, cx
jne 0x14000e2fe
mov ecx, dword [rsp + 0x20]
mov eax, ecx
shr eax, 0x10
test ax, ax
jne 0x14000e2fe
mov eax, 0x40a
cmp cx, ax
jb 0x14000e3f6
cmp dword [0x140028878], edi
jne 0x14000e3d5
lea rcx, [0x140028850]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140028878], edi
jne 0x14000e3c8
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x268], rsi
call fcn.14000e9b0
mov ebx, 0x80004005
mov rsi, rax
test rax, rax
je 0x14000e3aa
lea rdx, str.InitLibs
mov rcx, rax
mov qword [rsp + 0x260], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateObject
mov rcx, rsi
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028040], rax
test rbp, rbp
je 0x14000e3e6
lea rcx, [0x140028048]
mov dword [0x140028048], 0x100
call rbp
mov ebx, eax
test eax, eax
je 0x14000e3ed
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x140028038], rdi
mov rbp, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
test ebx, ebx
mov dword [0x140028878], 1
sete dil
mov dword [0x14002887c], edi
lea rcx, [0x140028850]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x14002887c]
mov dword [0x14002bef0], eax
jmp 0x14000e1f8
test rax, rax
je 0x14000e392
mov ebx, edi
mov qword [0x140028038], rsi
jmp 0x14000e3a2
or eax, 0xffffffff
jmp 0x14000e1f8
Function at 0x14000e400
Capabilities:
Get common file path
Get file attributes

Disassembly:
push rbx
sub rsp, 0x6a0
mov rax, qword [0x140029ab0]
xor rax, rsp
mov qword [rsp + 0x690], rax
lea rcx, [rsp + 0x480]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r11, [rsp + 0x480]
mov r9d, 0x104
mov eax, dword [r11]
lea r8, str.360SANDBOX
lea rcx, [rsp + 0x270]
mov dword [rsp + 0x270], eax
movzx eax, word [r11 + 4]
xor ebx, ebx
mov rdx, r9
mov word [rsp + 0x276], bx
mov word [rsp + 0x274], ax
call fcn.140010490
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14000e4b8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x14000e4af
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
sete bl
mov eax, ebx
jmp 0x14000e4ba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.14000f6d0
add rsp, 0x6a0
pop rbx
ret

Function at 0x14000e670
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140029ab0]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0xf0
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x14000e6a9
xor eax, eax
jmp 0x14000e793
mov qword [rsp + 0x250], rdi
xor edi, edi
mov edx, 0x81
mov word [rsp + 0x200], di
mov r9d, edi
mov rcx, rdx
lea rax, [rsp + 0x20]
nop dword [rax + rax]
cmp word [rax], di
je 0x14000e6ea
add rax, 2
sub rcx, 1
jne 0x14000e6d0
mov r9d, 0x80070057
mov r8, rdi
jmp 0x14000e700
test rcx, rcx
jne 0x14000e6fa
mov r9d, 0x80070057
mov r8, rdi
jmp 0x14000e700
mov r8, rdx
sub r8, rcx
test r9d, r9d
js 0x14000e759
sub rdx, r8
lea rax, [rsp + r8*2 + 0x20]
mov r9d, edi
je 0x14000e74c
lea r10, str.System32_
lea rcx, [rdx + r8 + 0x7fffff7e]
sub r10, rax
test rcx, rcx
je 0x14000e747
movzx r8d, word [r10 + rax]
test r8w, r8w
je 0x14000e747
mov word [rax], r8w
add rax, 2
dec rcx
sub rdx, 1
jne 0x14000e724
jmp 0x14000e74c
test rdx, rdx
jne 0x14000e756
sub rax, 2
mov r9d, 0x8007007a
mov word [rax], di
test r9d, r9d
jne 0x14000e774
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x103
call fcn.14000e5a0
test eax, eax
je 0x14000e778
xor eax, eax
jmp 0x14000e78b
lea rcx, [rsp + 0x20]
mov word [rsp + 0x226], di
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14000f6d0
add rsp, 0x240
pop rbx
ret
Function at 0x1400114c4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140018600
nop
cmp dword [0x14002bf60], 1
je 0x140011470
mov dword [0x14002bf5c], 1
mov byte [0x14002bf58], r12b
test ebx, ebx
jne 0x14001145c
mov rcx, qword [0x14002e130]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140011449
mov rcx, qword [0x14002e128]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400113e8
call fcn.1400121bc
cmp qword [rdi], rax
jne 0x1400113e8
jmp 0x1400113ce
cmp rdi, rsi
jb 0x140011449
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400121bc
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14002e130]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14002e128]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140011427
cmp r13, rax
je 0x140011447
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400113ce
lea rdx, [0x140020520]
lea rcx, [0x140020508]
call fcn.140011218
lea rdx, [0x140020530]
lea rcx, [0x140020528]
call fcn.140011218
nop
test r12d, r12d
je 0x14001147f
mov ecx, 8
call fcn.140018500
test r12d, r12d
jne 0x1400114aa
mov dword [0x14002bf60], 1
lea ecx, [r12 + 8]
call fcn.140018500
mov ecx, r15d
call fcn.1400111ac
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140011338

Function at 0x1400114d0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140011338
Function at 0x140013553
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140029ab0]
jne 0x14000f6ea
rol rcx, 0x10
test cx, 0xffff
jne 0x14000f6e6
repz ret
ror rcx, 0x10
jmp 0x1400134ac
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002c5a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14002c698]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140013531
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002c5a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140013553
mov rax, qword [rsp + 0x88]
mov qword [0x14002c698], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002c638], rax
mov rax, qword [0x14002c698]
mov qword [0x14002c510], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002c620], rax
mov dword [0x14002c500], 0xc0000409
mov dword [0x14002c504], 1
mov rax, qword [0x140029ab0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140029ab8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14002c598], eax
mov ecx, 1
call fcn.140019c38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140021498]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14002c598], 0
jne 0x1400135da
mov ecx, 1
call fcn.140019c38
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140018964
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400121bc
xor ebx, ebx
mov rdi, rax
cmp qword [0x14002cd38], rbx
jne 0x140018a6a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140018b3f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018b3f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14002cd38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14002cd40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14002cd48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14002cd58], rax
test rax, rax
je 0x140018a61
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14002cd50], rax
jmp 0x140018a71
mov rax, qword [0x14002cd50]
jmp 0x140018a78
mov rax, qword [0x14002cd50]
mov r11, qword [0x14002cd58]
cmp rax, rdi
je 0x140018ae0
cmp r11, rdi
je 0x140018ae0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14002cd58]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140018ae0
test rax, rax
je 0x140018ae0
call rsi
test rax, rax
je 0x140018ada
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140018ada
test byte [rsp + 0x38], 1
jne 0x140018ae0
bts ebp, 0x15
jmp 0x140018b1e
mov rcx, qword [0x14002cd40]
cmp rcx, rdi
je 0x140018b1e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140018b1e
call rax
mov rbx, rax
test rax, rax
je 0x140018b1e
mov rcx, qword [0x14002cd48]
cmp rcx, rdi
je 0x140018b1e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140018b1e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14002cd38]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140018b3f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140018b41
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret