joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014374
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [0x14004f795], 0
mov rbx, rcx
je 0x1400143cb
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400143cb
mov rcx, rbx
call fcn.140016740
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x1400143e1
mov rcx, rbx
call fcn.14001b0f8
call fcn.140018150
lea rcx, [rax + 0x30]
call fcn.140017f88
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140014440
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x1400409c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1400144cb
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x94
call fcn.140018af0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jne 0x1400144a3
cmp dword [rsp + 0x28], 0
je 0x1400144cb
lea rdx, str.SetDefaultDllDirectories
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400144cb
mov ecx, 0xc00
call rax
lea rcx, str.restrict_DLL_directories
call fcn.140011a6c
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140016e60
add rsp, 0xd0
pop rbx
ret

Function at 0x1400144e4
Capabilities:
Create directory

Disassembly:
push rbx
mov eax, 0x17a0
call fcn.140031150
sub rsp, rax
mov rax, qword [0x1400409c0]
xor rax, rsp
mov qword [rsp + 0x1790], rax
xor ebx, ebx
lea rcx, [rsp + 0x20]
call fcn.140006e84
xor ecx, ecx
call fcn.140018644
lea r8, [rsp + 0x20]
lea rdx, str._s_dir_d
lea rcx, [0x14004e000]
mov r9, rax
call fcn.140017b68
lea rdx, [0x14004e000]
lea rcx, str.Temp_dir3:__S
call fcn.140011a6c
lea rcx, [0x14004e000]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14001458c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140038440]
mov edx, eax
call fcn.140011a6c
inc ebx
cmp ebx, 0xa
jl 0x140014507
lea rdx, [0x14003843c]
mov ecx, 0x3f1
mov byte [0x14004e000], 0
call fcn.140004f98
mov rcx, qword [rsp + 0x1790]
xor rcx, rsp
call fcn.140016e60
add rsp, 0x17a0
pop rbx
ret
Function at 0x1400145a8
Capabilities:
Shutdown system

Disassembly:
sub rsp, 0x48
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001462e
lea r8, [rsp + 0x34]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001462e
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
add rsp, 0x48
ret

Function at 0x140014790
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, 0xbb80
mov rcx, rbx
call fcn.140016610
mov ecx, 0x2ee0
mov rdi, rax
call fcn.140016610
mov r8d, 0x1770
mov rdx, rax
mov ecx, 0x2714
mov rsi, rax
call fcn.140004548
lea rcx, str.native_lib_dir_is__S
mov rdx, rsi
call fcn.140011a6c
mov rcx, rsi
call fcn.140009194
lea r8, [0x140014768]
mov rdx, rsi
mov rcx, rdi
call fcn.140007354
mov rcx, rdi
call fcn.140016740
test rax, rax
je 0x140014823
mov rcx, rdi
call fcn.140016740
cmp byte [rax + rdi - 1], 0x3b
je 0x140014823
lea rdx, [0x14003424c]
mov rcx, rdi
call fcn.140016c70
mov rcx, rdi
call fcn.140016740
mov rcx, rdi
sub ebx, eax
call fcn.140016740
lea rcx, [0x1400365b8]
lea rdx, [rdi + rax]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rcx, [0x1400365b8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x14001486e
lea rcx, str.Setting_PATH__native_libs___S
mov rdx, rdi
call fcn.140011a6c
jmp 0x140014886
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.Setting_PATH__native_libs___S_failed_with_error__d
mov rdx, rdi
mov r8d, eax
call fcn.140011a6c
mov rcx, rdi
call fcn.140016740
lea rcx, [rax + 6]
call fcn.140016610
lea rdx, str.PATH_s
mov r8, rdi
mov rcx, rax
mov rbx, rax
call fcn.140017b68
mov rcx, rbx
call fcn.14001a770
mov rcx, rbx
call fcn.140016ad0
mov rcx, rdi
call fcn.140016ad0
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140016ad0
Function at 0x1400148dc
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str._JAVA_OPTIONS
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rcx, str.JDK_JAVA_OPTIONS
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rcx, str.JAVA_TOOL_OPTIONS
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea rdi, [0x140035a2f]
lea rcx, str._JAVA_OPTIONS
mov rdx, rdi
call fcn.14001a7a4
lea rcx, str.JDK_JAVA_OPTIONS
mov rdx, rdi
call fcn.14001a7a4
lea rcx, str.JAVA_TOOL_OPTIONS
mov rdx, rdi
call fcn.14001a7a4
lea rcx, str.ucrtbase.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400149ab
lea rdx, str._putenv_s
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400149ab
lea r8, [fcn.14001a7a4]
lea rcx, str.using__putenv_s_in_ucrtbase.dll__p__p
mov rdx, rax
call fcn.140011a6c
lea rcx, str._JAVA_OPTIONS
mov rdx, rdi
call rbx
lea rcx, str.JDK_JAVA_OPTIONS
mov rdx, rdi
call rbx
lea rcx, str.JAVA_TOOL_OPTIONS
mov rdx, rdi
call rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001520c
Capabilities:
Get common file path
Query environment variable
Set environment variable

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400409c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov ecx, 0x271a
call fcn.14000469c
xor ebp, ebp
cmp eax, ebp
je 0x140015401
xor r8d, r8d
xor edx, edx
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rbx, eax
cmp ebx, ebp
jle 0x140015401
lea eax, [rbp + 2]
mul rbx
lea rcx, [rbp - 1]
cmovo rax, rcx
mov rcx, rax
call fcn.140016610
mov rdi, rax
mov r8d, ebx
mov rdx, rax
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, ebp
jbe 0x1400153f9
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebp
jbe 0x1400153f9
lea rcx, [rsp + 0x50]
call fcn.1400171b8
cmp rax, rbp
jbe 0x1400153f9
lea rcx, [rsp + 0x50]
call fcn.1400171b8
mov rsi, rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbp
mov word [rsp + 0x30], bp
mov r9, rdi
mov r8d, ebx
mov edx, eax
lea rcx, str.reducing_PATH__d__d__s
call fcn.140011a6c
lea rdx, [0x140034b08]
mov rcx, rdi
call fcn.140018cf0
mov rbx, rax
cmp rax, rbp
je 0x14001538f
mov rcx, rbx
call fcn.1400171b8
cmp rax, rbp
je 0x14001538f
movsxd r8, esi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14001b2f8
cmp eax, ebp
jne 0x140015379
cmp qword [rsp + 0x40], rbp
jbe 0x140015361
lea rcx, [0x140034b08]
call fcn.1400171b8
mov r8, rax
lea rdx, [0x140034b08]
lea rcx, [rsp + 0x28]
call fcn.140014d3c
mov rcx, rbx
call fcn.1400171b8
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140014d3c
lea rdx, [0x140034b08]
xor ecx, ecx
call fcn.140018cf0
mov rbx, rax
cmp rax, rbp
jne 0x140015319
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
lea rcx, str.reduced_PATH__d_to__s
call fcn.140011a6c
cmp qword [rsp + 0x40], rbp
jbe 0x1400153e7
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp eax, ebp
jne 0x1400153e7
lea rcx, str.ERROR_setting_path
call fcn.140011a6c
nop
cmp qword [rsp + 0x48], 8
jb 0x1400153f9
mov rcx, qword [rsp + 0x30]
call fcn.140016ad0
mov rcx, rdi
call fcn.140016ad0
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140016e60
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140016124
Capabilities:
Check if file exists
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x4740
call fcn.140031150
sub rsp, rax
mov rax, qword [0x1400409c0]
xor rax, rsp
mov qword [rsp + 0x4730], rax
mov rsi, rcx
lea rcx, [rsp + 0xe0]
mov rdi, rdx
call fcn.140016d10
lea rcx, str..pack
call fcn.140016740
lea rbx, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
sub rbx, rax
call fcn.140016740
xor ebp, ebp
mov rcx, rdi
mov byte [rax + rbx], bpl
call fcn.140005bc0
cmp al, bpl
jne 0x1400161a6
lea rcx, str.pack_path_doesnt_exists
call fcn.140011a6c
jmp 0x1400162f2
lea rdx, str._s_binunpack200.exe
lea rcx, [rsp + 0x2fc0]
mov r8, rsi
call fcn.140017b68
lea r9, [rsp + 0xe0]
lea rdx, str._r___s____s_
lea rcx, [rsp + 0x1850]
mov r8, rdi
call fcn.140017b68
lea rdx, [rsp + 0x2fc0]
lea rcx, [0x1400340b8]
call fcn.140011a6c
lea rdx, [rsp + 0x1850]
lea rcx, [0x1400340b8]
call fcn.140011a6c
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call fcn.140018af0
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8, rbx
xor edx, edx
call fcn.140018af0
lea ecx, [rbx - 0x67]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x1850]
lea rcx, [rsp + 0x2fc0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x70], ebx
mov word [rsp + 0xb0], bp
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebp
jne 0x1400162a0
lea rcx, str.could_not_create_unpack_process
call fcn.140011a6c
xor edx, edx
mov ecx, 0x3fd
call fcn.140004f98
lea rcx, str.waiting_for_unpack200_to_finish
call fcn.140011a6c
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.unpack_done
call fcn.140011a6c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, ebp
jne 0x1400162f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400162f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.could_not_delete_packed_file__error__d_
mov edx, eax
call fcn.140011a6c
mov rcx, qword [rsp + 0x4730]
xor rcx, rsp
call fcn.140016e60
mov rbx, qword [rsp + 0x4770]
add rsp, 0x4740
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016318
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov eax, 0x3060
call fcn.140031150
sub rsp, rax
mov rax, qword [0x1400409c0]
xor rax, rsp
mov qword [rsp + 0x3050], rax
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov r8, rcx
mov r9, rdx
lea rcx, [rsp + 0x170]
lea rdx, str._s_s.jar.pack
call fcn.140017b68
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001647a
lea rcx, [rsp + 0x5c]
call fcn.140016740
lea rcx, [rsp + 0x5c]
lea rdx, str._s_s_.s
mov qword [rsp + 0x28], rcx
sub rax, 5
lea rcx, [rsp + 0x170]
mov r9, rbp
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.140017b68
lea rdx, [rsp + 0x170]
lea rcx, str.checking__S
call fcn.140011a6c
lea rcx, [rsp + 0x170]
call fcn.140005bc0
test al, al
jne 0x14001645b
cmp byte [rdi], al
jne 0x1400163fd
lea rcx, str.Unpacking_JRE
call fcn.140011a6c
lea rcx, str.Preparing_JRE_..._n
call fcn.140014374
mov byte [rdi], 1
lea rcx, [rsp + 0x5c]
call fcn.140016740
lea rcx, [rsp + 0x5c]
lea rdx, str._s_.s
mov qword [rsp + 0x20], rcx
lea r9, [rax - 5]
lea rcx, [rsp + 0x170]
mov r8, rbp
call fcn.140017b68
lea r9, [rsp + 0x170]
lea rdx, str._s_s.pack
lea rcx, [rsp + 0x18e0]
mov r8, rsi
call fcn.140017b68
lea rdx, [rsp + 0x18e0]
mov rcx, rsi
call fcn.140016124
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140016382
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x3050]
xor rcx, rsp
call fcn.140016e60
mov rbx, qword [rsp + 0x3098]
add rsp, 0x3060
pop rdi
pop rsi
pop rbp
ret

Function at 0x140018bdc
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140018bf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140018bf6
xor eax, eax
test eax, eax
je 0x140018c06
mov ecx, eax
call fcn.14001af24
or eax, 0xffffffff
jmp 0x140018c08
xor eax, eax
add rsp, 0x28
ret

Function at 0x140018c10
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140018c26
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140018c28
xor eax, eax
test eax, eax
je 0x140018c38
mov ecx, eax
call fcn.14001af24
or eax, 0xffffffff
jmp 0x140018c3a
xor eax, eax
add rsp, 0x28
ret

Function at 0x140018c84
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140018c9c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140018c9e
xor eax, eax
test eax, eax
je 0x140018cae
mov ecx, eax
call fcn.14001af24
or eax, 0xffffffff
jmp 0x140018cb0
xor eax, eax
add rsp, 0x28
ret

Function at 0x140018cb8
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140018cce
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140018cd0
xor eax, eax
test eax, eax
je 0x140018ce0
mov ecx, eax
call fcn.14001af24
or eax, 0xffffffff
jmp 0x140018ce2
xor eax, eax
add rsp, 0x28
ret
Function at 0x14001a358
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14001a36e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14001a370
xor eax, eax
test eax, eax
je 0x14001a380
mov ecx, eax
call fcn.14001af24
or eax, 0xffffffff
jmp 0x14001a382
xor eax, eax
add rsp, 0x28
ret

Function at 0x14001b767
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400409c0]
jne 0x140016e7a
rol rcx, 0x10
test cx, 0xffff
jne 0x140016e76
repz ret
ror rcx, 0x10
jmp 0x14001b6c0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14004f8a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14004f998]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001b745
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14004f8a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001b767
mov rax, qword [rsp + 0x88]
mov qword [0x14004f998], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14004f938], rax
mov rax, qword [0x14004f998]
mov qword [0x14004f810], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14004f920], rax
mov dword [0x14004f800], 0xc0000409
mov dword [0x14004f804], 1
mov rax, qword [0x1400409c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400409c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14004f898], eax
mov ecx, 1
call fcn.14001b80c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400396d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14004f898], 0
jne 0x14001b7ee
mov ecx, 1
call fcn.14001b80c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x14001f6c0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001f534
Function at 0x14001f6cc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140020350
nop
cmp dword [0x14004fdd8], 1
je 0x14001f66c
mov dword [0x14004fdd4], 1
mov byte [0x14004fdd0], r12b
test ebx, ebx
jne 0x14001f658
mov rcx, qword [0x1400508d0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001f645
mov rcx, qword [0x1400508c8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001f5e4
call fcn.14001b81c
cmp qword [rdi], rax
jne 0x14001f5e4
jmp 0x14001f5ca
cmp rdi, rsi
jb 0x14001f645
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14001b81c
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1400508d0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1400508c8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14001f623
cmp r13, rax
je 0x14001f643
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14001f5ca
lea rdx, [0x1400335a0]
lea rcx, [0x140033588]
call fcn.14001f414
lea rdx, [0x1400335b0]
lea rcx, [0x1400335a8]
call fcn.14001f414
nop
test r12d, r12d
je 0x14001f67b
mov ecx, 8
call fcn.140020250
test r12d, r12d
jne 0x14001f6a6
mov dword [0x14004fdd8], 1
lea ecx, [r12 + 8]
call fcn.140020250
mov ecx, r15d
call fcn.14001f3a8
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001f534
Function at 0x140023900
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001b81c
xor ebx, ebx
mov rdi, rax
cmp qword [0x1400503c0], rbx
jne 0x140023a06
lea rcx, [0x140039ee0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140023adb
lea rdx, [0x140039ed0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140023adb
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400503c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140039ea8]
mov rcx, rsi
mov qword [0x1400503c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400503d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1400503e0], rax
test rax, rax
je 0x1400239fd
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1400503d8], rax
jmp 0x140023a0d
mov rax, qword [0x1400503d8]
jmp 0x140023a14
mov rax, qword [0x1400503d8]
mov r11, qword [0x1400503e0]
cmp rax, rdi
je 0x140023a7c
cmp r11, rdi
je 0x140023a7c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1400503e0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140023a7c
test rax, rax
je 0x140023a7c
call rsi
test rax, rax
je 0x140023a76
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140023a76
test byte [rsp + 0x38], 1
jne 0x140023a7c
bts ebp, 0x15
jmp 0x140023aba
mov rcx, qword [0x1400503c8]
cmp rcx, rdi
je 0x140023aba
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140023aba
call rax
mov rbx, rax
test rax, rax
je 0x140023aba
mov rcx, qword [0x1400503d0]
cmp rcx, rdi
je 0x140023aba
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140023aba
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400503c0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140023adb
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140023add
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14002a764
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001b81c
xor ebx, ebx
mov rdi, rax
cmp qword [0x140050680], rbx
jne 0x14002a86a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14002a93f
lea rdx, [0x14003b328]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14002a93f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140050680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140039ea8]
mov rcx, rsi
mov qword [0x140050688], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140050690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1400506a0], rax
test rax, rax
je 0x14002a861
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140050698], rax
jmp 0x14002a871
mov rax, qword [0x140050698]
jmp 0x14002a878
mov rax, qword [0x140050698]
mov r11, qword [0x1400506a0]
cmp rax, rdi
je 0x14002a8e0
cmp r11, rdi
je 0x14002a8e0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1400506a0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14002a8e0
test rax, rax
je 0x14002a8e0
call rsi
test rax, rax
je 0x14002a8da
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14002a8da
test byte [rsp + 0x38], 1
jne 0x14002a8e0
bts ebp, 0x15
jmp 0x14002a91e
mov rcx, qword [0x140050688]
cmp rcx, rdi
je 0x14002a91e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002a91e
call rax
mov rbx, rax
test rax, rax
je 0x14002a91e
mov rcx, qword [0x140050690]
cmp rcx, rdi
je 0x14002a91e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002a91e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140050680]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14002a93f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14002a941
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1409012ab
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x20]
je 0x14090132f
mov eax, 0x790f8d92
lea rsi, [rax + rax*4 + 0x5bbbd92c]
sal esi, 0x5a
lea rsi, [0x14091e4f8]
mov eax, 0xf6a5d613
lea rax, [rax + rax*2 - 0x5e486962]
and eax, eax
movzx eax, byte [rdi + riz]
push 0xffffffffad0d2489
xor eax, ecx
rol qword [rsp], 0x95
dec qword [rsp]
and eax, 0xff
mov eax, dword [rsi + rax*4]
shl byte [rsp + 5], 0x81
shr ecx, 8
sal qword [rsp], 0x81
shr dword [rsp + 2], 0x64
xor ecx, eax
inc rdi
xor ecx, 0x88b77635
inc dword [rsp + 2]
push 0xffffffffe5b65daf
dec r8
lea rsp, [rsp + 0x10]
jne 0x1409012cd
not ecx
push 0x283daeb6
call fcn.14091a9de
jmp 0x1408f49ea