joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008ba00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x18], r8b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
movzx esi, r8b
movzx r15d, dl
mov rdi, rcx
cmp qword [rcx + 8], 0
jne 0x18008ba3e
xor al, al
jmp 0x18008bc0c
mov ecx, 0x3b3
call fcn.1800bee60
mov qword [rsp + 0x80], rax
xor r13d, r13d
test rax, rax
je 0x18008ba73
mov byte [rsp + 0x20], 1
mov r9b, 1
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call fcn.180080dd0
mov r14, rax
jmp 0x18008ba76
mov r14, r13
test r14, r14
jne 0x18008ba82
xor al, al
jmp 0x18008bc0c
mov rcx, r14
call fcn.1800810d0
test al, al
jne 0x18008baa2
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
xor al, al
jmp 0x18008bc0c
movzx ecx, word [rdi + 0x1e]
mov ebp, 1
mov eax, 3
cmp ecx, 0x18
cmove ebp, eax
mov eax, dword [rdi + 0x14]
dec eax
imul ebp, eax
movsxd r11, ebp
mov rax, qword [rdi + 0x3c]
lea rbx, [r11 + rax]
mov r10, qword [r14 + 0x3c]
cmp ecx, 8
je 0x18008bb9b
cmp ecx, 0x18
je 0x18008bb2d
mov ebx, r13d
cmp dword [rdi + 0x18], ebx
jle 0x18008bbd4
mov esi, r13d
test ebp, ebp
js 0x18008bb19
mov r12d, ebp
mov r8d, ebx
mov edx, r12d
mov rcx, rdi
call fcn.180083060
movzx r9d, al
mov r8d, ebx
mov edx, esi
mov rcx, r14
call fcn.1800834e0
inc esi
dec r12d
cmp esi, ebp
jle 0x18008baf1
inc ebx
cmp ebx, dword [rdi + 0x18]
jl 0x18008bae7
mov sil, byte [rsp + 0x90]
jmp 0x18008bbd4
cmp dword [rdi + 0x18], 0
jle 0x18008bbd4
movabs rbp, 0xaaaaaaaaaaaaaaab
test r11, r11
js 0x18008bb87
lea r8, [r10 + 1]
lea r9, [rbx + 2]
lea rcx, [r11 + 3]
mov rax, rbp
mul rcx
shr rdx, 1
nop dword [rax + rax]
movzx eax, byte [r9 - 2]
mov byte [r8 - 1], al
movzx eax, byte [r9 - 1]
mov byte [r8], al
movzx eax, byte [r9]
mov byte [r8 + 1], al
add r8, 3
sub r9, 3
sub rdx, 1
jne 0x18008bb60
mov eax, dword [rdi + 0x38]
add rbx, rax
add r10, rax
inc r13d
cmp r13d, dword [rdi + 0x18]
jl 0x18008bb41
jmp 0x18008bbd4
mov r8d, r13d
cmp dword [rdi + 0x18], r13d
jle 0x18008bbd4
mov rcx, r13
test ebp, ebp
js 0x18008bbc2
mov rdx, rbx
nop
movzx eax, byte [rdx]
mov byte [rcx + r10], al
inc rcx
dec rdx
cmp rcx, r11
jle 0x18008bbb0
mov eax, dword [rdi + 0x38]
add rbx, rax
add r10, rax
inc r8d
cmp r8d, dword [rdi + 0x18]
jl 0x18008bba4
test r15b, r15b
je 0x18008bbe1
mov rcx, r14
call fcn.180086850
test sil, sil
je 0x18008bbee
mov rcx, r14
call fcn.1800863e0
mov r8b, 1
mov rdx, r14
mov rcx, rdi
call fcn.180080420
mov r11, qword [r14]
mov edx, 1
mov rcx, r14
call qword [r11]
mov al, 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a1cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x39]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x85]
mov esi, dword [rdi + 0x4d]
mov eax, dword [rdi + 0x39]
sub esi, dword [rdi + 0x8d]
lea ecx, [rbx + rax - 0x106]
sub esi, edx
cmp edx, ecx
jb 0x1800a1dac
mov rcx, qword [rdi + 0x45]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1800c0da0
mov r8d, dword [rdi + 0x65]
mov rax, qword [rdi + 0x59]
sub dword [rdi + 0x89], ebx
sub dword [rdi + 0x85], ebx
sub dword [rdi + 0x75], ebx
lea rdx, [rax + r8*2]
nop word [rax + rax]
movzx eax, word [rdx - 2]
sub rdx, 2
cmp eax, ebx
jb 0x1800a1d70
sub eax, ebx
jmp 0x1800a1d72
xor eax, eax
add r8d, 0xffffffff
mov word [rdx], ax
jne 0x1800a1d60
mov rax, qword [rdi + 0x51]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
sub rcx, 2
cmp eax, ebx
jb 0x1800a1da0
sub eax, ebx
jmp 0x1800a1da2
xor eax, eax
add edx, 0xffffffff
mov word [rcx], ax
jne 0x1800a1d90
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x1800a1e99
mov edx, dword [rdi + 0x8d]
mov eax, dword [rdi + 0x85]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x45]
call fcn.1800a1aa0
add dword [rdi + 0x8d], eax
mov r9d, dword [rdi + 0x8d]
cmp r9d, 3
jb 0x1800a1e11
mov eax, dword [rdi + 0x85]
mov rdx, qword [rdi + 0x45]
mov ecx, dword [rdi + 0x71]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x61], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x6d]
mov dword [rdi + 0x61], r8d
cmp r9d, 0x106
jae 0x1800a1e27
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x1800a1d10
mov ecx, dword [rdi + 0x16f4]
mov esi, dword [rdi + 0x4d]
cmp ecx, esi
jae 0x1800a1e99
mov eax, dword [rdi + 0x85]
lea ebx, [r9 + rax]
cmp ecx, ebx
jae 0x1800a1e6b
sub esi, ebx
mov eax, 0x102
mov ecx, ebx
cmp esi, eax
cmova esi, eax
add rcx, qword [rdi + 0x45]
xor edx, edx
mov r8d, esi
call fcn.1800c1250
lea r11d, [rsi + rbx]
mov dword [rdi + 0x16f4], r11d
jmp 0x1800a1e99
lea eax, [rbx + 0x102]
cmp ecx, eax
jae 0x1800a1e99
sub ebx, ecx
sub esi, ecx
mov eax, 0x102
add ebx, eax
cmp ebx, esi
cmova ebx, esi
add rcx, qword [rdi + 0x45]
xor edx, edx
mov r8d, ebx
call fcn.1800c1250
add dword [rdi + 0x16f4], ebx
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800a73e0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x21], 0xcc
mov rdi, rcx
je 0x1800a740e
mov rax, qword [rcx + 0x1f0]
call qword [rax]
mov dword [rdi + 0x86], ebp
mov dword [rdi + 0x21], 0xcc
mov rax, qword [rdi + 0x1f0]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
cmp byte [rax + 0x10], bpl
je 0x1800a74be
nop dword [rax]
mov ecx, dword [rdi + 0x86]
cmp ecx, dword [rdi + 0x6a]
jae 0x1800a748d
nop dword [rax + rax]
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x1800a745f
mov dword [rax + 8], ecx
mov rcx, qword [rdi + 0x10]
mov eax, dword [rdi + 0x6a]
mov dword [rcx + 0xc], eax
mov rax, qword [rdi + 0x10]
mov rcx, rdi
call qword [rax]
mov rax, qword [rdi + 0x1f8]
mov ebx, dword [rdi + 0x86]
lea r8, [rdi + 0x86]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rdi + 0x86]
cmp ecx, ebx
je 0x1800a74e6
cmp ecx, dword [rdi + 0x6a]
jb 0x1800a7440
mov rax, qword [rdi + 0x1f0]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r11, qword [rdi + 0x1f0]
mov rcx, rdi
call qword [r11]
mov dword [rdi + 0x86], ebp
mov rax, qword [rdi + 0x1f0]
cmp byte [rax + 0x10], bpl
jne 0x1800a7430
cmp byte [rdi + 0x52], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rdi + 0x21], ebp
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor al, al
jmp 0x1800a74d1
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x21], 0xca
mov rbx, rcx
jne 0x1800a75f3
call fcn.1800a7dc0
cmp byte [rbx + 0x51], 0
je 0x1800a75ec
mov dword [rbx + 0x21], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x21], 0xcb
mov eax, dword [rbx + 0x21]
cmp eax, 0xcb
jne 0x1800a7681
mov rax, qword [rbx + 0x210]
cmp byte [rax + 0x20], 0
je 0x1800a7668
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1800a761e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x210]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1800a7660
cmp eax, 2
je 0x1800a7668
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1800a7610
cmp eax, 3
je 0x1800a7646
cmp eax, 1
jne 0x1800a7610
inc dword [rcx + 8]
mov rcx, qword [rbx + 0x10]
mov eax, dword [rcx + 0xc]
cmp dword [rcx + 8], eax
jl 0x1800a7610
mov eax, dword [rbx + 0x168]
add dword [rcx + 0xc], eax
jmp 0x1800a7610
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x8a]
mov rcx, rbx
mov dword [rbx + 0x92], eax
add rsp, 0x20
pop rbx
jmp 0x1800a73e0
cmp eax, 0xcc
je 0x1800a76a3
mov rax, qword [rbx]
mov dword [rax + 0x28], reloc.OLEAUT32.dll_SafeArrayUnlock
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x21]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800a73e0
Function at 0x1800a75c0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x21], 0xcc
mov rdi, rcx
je 0x1800a740e
mov rax, qword [rcx + 0x1f0]
call qword [rax]
mov dword [rdi + 0x86], ebp
mov dword [rdi + 0x21], 0xcc
mov rax, qword [rdi + 0x1f0]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
cmp byte [rax + 0x10], bpl
je 0x1800a74be
nop dword [rax]
mov ecx, dword [rdi + 0x86]
cmp ecx, dword [rdi + 0x6a]
jae 0x1800a748d
nop dword [rax + rax]
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x1800a745f
mov dword [rax + 8], ecx
mov rcx, qword [rdi + 0x10]
mov eax, dword [rdi + 0x6a]
mov dword [rcx + 0xc], eax
mov rax, qword [rdi + 0x10]
mov rcx, rdi
call qword [rax]
mov rax, qword [rdi + 0x1f8]
mov ebx, dword [rdi + 0x86]
lea r8, [rdi + 0x86]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, dword [rdi + 0x86]
cmp ecx, ebx
je 0x1800a74e6
cmp ecx, dword [rdi + 0x6a]
jb 0x1800a7440
mov rax, qword [rdi + 0x1f0]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r11, qword [rdi + 0x1f0]
mov rcx, rdi
call qword [r11]
mov dword [rdi + 0x86], ebp
mov rax, qword [rdi + 0x1f0]
cmp byte [rax + 0x10], bpl
jne 0x1800a7430
cmp byte [rdi + 0x52], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rdi + 0x21], ebp
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor al, al
jmp 0x1800a74d1
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x21], 0xca
mov rbx, rcx
jne 0x1800a75f3
call fcn.1800a7dc0
cmp byte [rbx + 0x51], 0
je 0x1800a75ec
mov dword [rbx + 0x21], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x21], 0xcb
mov eax, dword [rbx + 0x21]
cmp eax, 0xcb
jne 0x1800a7681
mov rax, qword [rbx + 0x210]
cmp byte [rax + 0x20], 0
je 0x1800a7668
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1800a761e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x210]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1800a7660
cmp eax, 2
je 0x1800a7668
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1800a7610
cmp eax, 3
je 0x1800a7646
cmp eax, 1
jne 0x1800a7610
inc dword [rcx + 8]
mov rcx, qword [rbx + 0x10]
mov eax, dword [rcx + 0xc]
cmp dword [rcx + 8], eax
jl 0x1800a7610
mov eax, dword [rbx + 0x168]
add dword [rcx + 0xc], eax
jmp 0x1800a7610
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x8a]
mov rcx, rbx
mov dword [rbx + 0x92], eax
add rsp, 0x20
pop rbx
jmp 0x1800a73e0
cmp eax, 0xcc
je 0x1800a76a3
mov rax, qword [rbx]
mov dword [rax + 0x28], reloc.OLEAUT32.dll_SafeArrayUnlock
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x21]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800a73e0
Function at 0x1800a9e60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 8], rsi
call fcn.18007fe80
mov edx, 0x98
mov rcx, rbx
mov dword [rsp + 0x38], eax
call fcn.1800b3770
mov rdi, rax
test rax, rax
jne 0x1800a9eb7
mov rcx, rbx
call fcn.1800b0840
mov r11, qword [rbx]
mov dword [r11 + 0x28], 0x38
mov rcx, qword [rbx]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov dword [rdi + 0x5c], 0x3b9aca00
lea rax, [fcn.1800a90e0]
lea rcx, str.JPEGMEM
mov qword [rdi], rax
lea rax, [fcn.1800a9260]
mov qword [rdi + 8], rax
lea rax, [fcn.1800a9340]
mov qword [rdi + 0x10], rax
lea rax, [fcn.1800a9430]
mov qword [rdi + 0x18], rax
lea rax, [0x1800a9540]
mov qword [rdi + 0x20], rax
lea rax, [0x1800a95f0]
mov qword [rdi + 0x28], rax
lea rax, [0x1800a96a0]
mov qword [rdi + 0x30], rax
lea rax, [0x1800a9a00]
mov qword [rdi + 0x38], rax
lea rax, [0x1800a9b60]
mov qword [rdi + 0x40], rax
lea rax, [fcn.1800a9cc0]
mov qword [rdi + 0x48], rax
lea rax, [0x1800a9e10]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x58], eax
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
mov dword [rdi + 0x90], LoadRegTypeLib
mov qword [rbx + 8], rdi
call fcn.1800c4db0
test rax, rax
je 0x1800a9fc2
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call fcn.1800c4cd4
test eax, eax
jle 0x1800a9fc2
movzx eax, byte [rsp + 0x30]
cmp al, 0x6d
je 0x1800a9faf
cmp al, 0x4d
je 0x1800a9faf
mov eax, dword [rsp + 0x38]
jmp 0x1800a9fb9
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [rdi + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800b2b30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
cmp dword [rcx + 0x5a], 1
mov rbp, qword [rcx + 0x240]
mov rsi, rcx
mov qword [rsp + 0x68], rbp
jne 0x1800b2b5b
mov ebx, 0x1fe
mov byte [rbp + 0x34], 1
jmp 0x1800b2b60
xor ebx, ebx
mov byte [rbp + 0x34], bl
mov rax, qword [rcx + 8]
mov r9d, dword [rcx + 0x6e]
lea r8d, [rbx + 0x100]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov r14d, dword [rbp + 0x28]
xor edi, edi
movsxd r8, ebx
mov qword [rbp + 0x2c], rax
cmp dword [rsi + 0x6e], edi
mov qword [rsp + 0x60], r8
jle 0x1800b2c9a
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
lea r15, [rbp + 0x35]
xor r13d, r13d
nop dword [rax + rax]
mov ecx, dword [r15]
mov eax, r14d
cdq
idiv ecx
mov r14d, eax
test r8, r8
je 0x1800b2bcd
mov rax, qword [rbp + 0x2c]
add qword [rax + r13], 0xff
mov rax, qword [rbp + 0x2c]
lea ebp, [rcx - 1]
xor r8d, r8d
mov rbx, qword [r13 + rax]
mov edx, edi
mov rcx, rsi
mov r9d, ebp
xor r10d, r10d
call fcn.1800b2940
xor r11d, r11d
xor r12d, r12d
mov r9d, eax
cmp r11d, r9d
jle 0x1800b2c1b
nop word [rax + rax]
inc r10d
mov r9d, ebp
mov edx, edi
mov r8d, r10d
mov rcx, rsi
call fcn.1800b2940
cmp r11d, eax
mov r9d, eax
jg 0x1800b2c00
movzx eax, r10b
inc r12
inc r11d
imul r14b
cmp r12, 0xff
mov byte [r12 + rbx - 1], al
jle 0x1800b2bf5
mov r8, qword [rsp + 0x60]
test r8, r8
je 0x1800b2c73
mov ecx, 1
lea rdx, [rbx - 1]
nop dword [rax]
movzx eax, byte [rbx]
inc rcx
dec rdx
cmp rcx, 0xff
mov byte [rdx + 1], al
movzx eax, byte [rbx + 0xff]
mov byte [rbx + rcx + 0xfe], al
jle 0x1800b2c50
mov rbp, qword [rsp + 0x68]
inc edi
add r15, 4
add r13, 8
cmp edi, dword [rsi + 0x6e]
jl 0x1800b2bb0
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800bd274
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x180141d00]
test rcx, rcx
jne 0x1800bd1cb
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x1800bd1c4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1800bd1f6
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x1800bd1c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x180141d00], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x1800bd269
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800bd219
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], SafeArrayAllocDescriptorEx
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x180141d00]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x1800bd246
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x1800bd269
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x180141d00]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x1800bd24d
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x1800bd150
Function at 0x1800c4ba0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1800c86d8
nop
cmp dword [0x180141eb0], 1
je 0x1800c4b4c
mov dword [0x180141eac], 1
mov byte [0x180141ea8], r12b
test ebx, ebx
jne 0x1800c4b38
mov rcx, qword [0x1801433b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800c4b25
mov rcx, qword [0x1801433a8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1800c4ac4
call fcn.1800c99a8
cmp qword [rdi], rax
jne 0x1800c4ac4
jmp 0x1800c4aaa
cmp rdi, rsi
jb 0x1800c4b25
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1800c99a8
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1801433b0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1801433a8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1800c4b03
cmp r13, rax
je 0x1800c4b23
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1800c4aaa
lea rdx, [0x1800f1d80]
lea rcx, [0x1800f1d68]
call fcn.1800c48f4
lea rdx, [0x1800f1d90]
lea rcx, [0x1800f1d88]
call fcn.1800c48f4
nop
test r12d, r12d
je 0x1800c4b5b
mov ecx, 8
call fcn.1800c85d8
test r12d, r12d
jne 0x1800c4b86
mov dword [0x180141eb0], 1
lea ecx, [r12 + 8]
call fcn.1800c85d8
mov ecx, r15d
call fcn.1800c4888
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1800c4a14

Function at 0x1800c4bac
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1800c4a14

Function at 0x1800c4e50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
test rcx, rcx
jne 0x1800c4e8a
call fcn.1800c66ec
and dword [rax], 0
call fcn.1800c66cc
and qword [rsp + 0x20], 0
mov ebx, reloc.OLEAUT32.dll_SafeArrayAccessData
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
call fcn.1800bf0b0
mov eax, ebx
jmp 0x1800c4eda
test edx, 0xfffffff9
jne 0x1800c4e5d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800c4eb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800c670c
call fcn.1800c66cc
mov eax, dword [rax]
jmp 0x1800c4eda
test al, 0x10
jne 0x1800c4ed8
test al, 1
je 0x1800c4ed8
test bl, 2
je 0x1800c4ed8
call fcn.1800c66ec
mov dword [rax], 5
call fcn.1800c66cc
mov dword [rax], SafeArrayGetDim
jmp 0x1800c4eaa
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1800c5fdf
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18013a210]
jne 0x1800bd99a
rol rcx, 0x10
test cx, 0xffff
jne 0x1800bd996
repz ret
ror rcx, 0x10
jmp 0x1800c5f38
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180141f60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180142058]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800c5fbd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180141f60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800c5fdf
mov rax, qword [rsp + 0x88]
mov qword [0x180142058], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180141ff8], rax
mov rax, qword [0x180142058]
mov qword [0x180141ed0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180141fe0], rax
mov dword [0x180141ec0], 0xc0000409
mov dword [0x180141ec4], 1
mov rax, qword [0x18013a210]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18013a218]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180141f58], eax
mov ecx, 1
call fcn.1800c9998
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800fd5e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180141f58], 0
jne 0x1800c6066
mov ecx, 1
call fcn.1800c9998
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1800d74c0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1800c99a8
xor ebx, ebx
mov rdi, rax
cmp qword [0x180142bf0], rbx
jne 0x1800d75c6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800d769b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800d769b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800ff918]
mov rcx, rsi
mov qword [0x180142bf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180142bf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180142c00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180142c10], rax
test rax, rax
je 0x1800d75bd
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180142c08], rax
jmp 0x1800d75cd
mov rax, qword [0x180142c08]
jmp 0x1800d75d4
mov rax, qword [0x180142c08]
mov r11, qword [0x180142c10]
cmp rax, rdi
je 0x1800d763c
cmp r11, rdi
je 0x1800d763c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180142c10]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800d763c
test rax, rax
je 0x1800d763c
call rsi
test rax, rax
je 0x1800d7636
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800d7636
test byte [rsp + 0x38], 1
jne 0x1800d763c
bts ebp, 0x15
jmp 0x1800d767a
mov rcx, qword [0x180142bf8]
cmp rcx, rdi
je 0x1800d767a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800d767a
call rax
mov rbx, rax
test rax, rax
je 0x1800d767a
mov rcx, qword [0x180142c00]
cmp rcx, rdi
je 0x1800d767a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800d767a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180142bf0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800d769b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800d769d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret