joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000337c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.180003b64
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x180006634
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x180006656
mov rcx, qword [rsp + 0x40]
call fcn.180006710
jmp 0x18000666d
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x18000666d
mov rcx, qword [rsp + 0x40]
call fcn.1800067bc
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x180006710
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x180006731
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x1800067b5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x180006780
mov dword [rsp + 4], 0x9908b0df
jmp 0x180006788
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x180006724
add rsp, 0x18
ret
Function at 0x1800067bc
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x1800067ec
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x18000686e
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x18000683a
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x180006842
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x1800067e1
mov qword [rsp + 8], 0xe3
jmp 0x180006886
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x18000690d
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x1800068d7
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x1800068df
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x180006879
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x180006961
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x180006969
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140010560
Capabilities:
Encode data using xor

Disassembly:
invalid
mov dh, 0x3f
jle 0x140010581
jmp 0x14001051f
mov ecx, 0x4db71372
in eax, dx
xchg bl, cl
lodsb al, byte [rsi]
jp 0x1400105ee
sbb cl, byte [rdx - 0x16ace73b]
mov al, ch
sbb byte [rbx - 0x17], dl
xor dl, byte [rax - 0x4a09e956]
js 0x140010597
mov ch, 0x78
std
jp 0x14001058d
invalid
cmpsb byte [rsi], byte [rdi]
invalid

Function at 0x140bdb3c8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140bdb54f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140bdb3f9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bdb3df
add dl, dl
jne 0x140bdb406
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bdb466
xor eax, eax
add dl, dl
jne 0x140bdb415
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bdb51d
add dl, dl
jne 0x140bdb426
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bdb433
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bdb440
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bdb44d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140bdb45a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140bdb3ee
mov eax, 1
add dl, dl
jne 0x140bdb476
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bdb483
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bdb46b
sub eax, ebx
mov ebx, 1
jne 0x140bdb4bc
mov ecx, 1
add dl, dl
jne 0x140bdb49e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bdb4ab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bdb493
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bdb3ee
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140bdb4d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bdb4e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bdb4cd
cmp eax, 0x7d00
jae 0x140bdb50b
cmp eax, 0x500
jb 0x140bdb506
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bdb3ee
cmp eax, 0x7f
ja 0x140bdb50e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bdb3ee
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140bdb542
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140bdb3ee
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011109
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001dd00
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400380f8]
call fcn.14001195b
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001dd57
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001de63
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001ddfc
cmp qword [rbp + 0x28], 0
jle 0x14001ddfc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001dd9c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400118c5
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001de52
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001de52
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14001153c
Capabilities:
Terminate process

Disassembly:
jmp 0x140021440
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011681
Capabilities:
Parse pe header

Disassembly:
jmp 0x140021f70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140021f90
xor al, al
jmp 0x140022011
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140021fa3
xor al, al
jmp 0x140022011
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140021fcd
xor al, al
jmp 0x140022011
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140021fe1
xor al, al
jmp 0x140022011
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140021ff3
xor al, al
jmp 0x140022011
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002200f
xor al, al
jmp 0x140022011
mov al, 1
add rsp, 0x38
ret
Function at 0x1400116ef
Capabilities:
Connect socket
Resolve dns

Disassembly:
jmp 0x140018d00
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, socket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x158]
mov rax, qword [0x140031018]
xor rax, rbp
mov qword [rbp + 0x108], rax
lea rcx, [0x1400380fa]
call fcn.14001195b
mov rax, qword [rbp + 0x130]
mov rcx, rax
call fcn.1400110fa
mov rcx, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140018d70
xor al, al
jmp 0x140018dd1
mov eax, 2
mov word [rbp + 0x28], ax
mov cx, 0x50
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbp + 0x2a], ax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 0x18]
mov r8d, 4
mov rdx, qword [rcx + rax]
lea rcx, [rbp + 0x2c]
call fcn.140011483
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x28]
mov rax, qword [rbp + 0x130]
mov rcx, qword [rax + 0x58]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140018dcf
xor al, al
jmp 0x140018dd1
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002a230]
call fcn.1400117ad
mov rax, rdi
mov rcx, qword [rbp + 0x108]
xor rcx, rbp
call fcn.14001147e
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x1400118ed
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x140019240
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, WSAStartup
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [0x140031018]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1400380fa]
call fcn.14001195b
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14001929f
xor al, al
jmp 0x1400192e9
movzx eax, word [rbp + 0x10]
and rax, 0xff
movzx eax, al
cmp eax, 2
jne 0x1400192c7
movzx eax, word [rbp + 0x10]
shr rax, 8
and rax, 0xff
movzx eax, al
cmp eax, 2
je 0x1400192cb
xor al, al
jmp 0x1400192e9
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rbp + 0x2a0]
mov qword [rcx + 0x58], rax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14002a130]
call fcn.1400117ad
mov rax, rdi
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.14001147e
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret
Function at 0x140011942
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400198d0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140031018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1400380f8]
call fcn.14001195b
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140019936
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001993d
mov al, 1
jmp 0x140019a97
call fcn.14001129e
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.14001129e
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1400117cb
movzx eax, al
test eax, eax
je 0x140019998
xor al, al
jmp 0x140019a97
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x1400199fd
cmp dword [rbp + 0x194], 1
je 0x140019a08
cmp dword [rbp + 0x194], 3
je 0x140019a86
jmp 0x140019a95
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140019a58
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140019a58
xor al, al
jmp 0x140019a97
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140019a73
mov dword [rbp + 0x194], 1
jmp 0x140019a7d
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140019a97
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140019a97
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002ab30]
call fcn.1400117ad
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.14001147e
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x140001c93
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000b008]
jne 0x140001a3a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001a36
repz ret
ror rcx, 0x10
jmp 0x140001bec
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000c0e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14000c1d8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001c71
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000c0e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001c93
mov rax, qword [rsp + 0x88]
mov qword [0x14000c1d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000c178], rax
mov rax, qword [0x14000c1d8]
mov qword [0x14000c050], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000c160], rax
mov dword [0x14000c040], 0xc0000409
mov dword [0x14000c044], 1
mov rax, qword [0x14000b008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000b010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000c0d8], eax
mov ecx, 1
call fcn.1400034c8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140008280]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000c0d8], 0
jne 0x140001d1a
mov ecx, 1
call fcn.1400034c8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400020dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140003720
nop
cmp dword [0x14000c600], 1
je 0x140002088
mov dword [0x14000c5fc], 1
mov byte [0x14000c5f8], r12b
test ebx, ebx
jne 0x140002074
mov rcx, qword [0x14000d058]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140002061
mov rcx, qword [0x14000d050]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140002000
call fcn.140003074
cmp qword [rdi], rax
jne 0x140002000
jmp 0x140001fe6
cmp rdi, rsi
jb 0x140002061
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140003074
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14000d058]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14000d050]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000203f
cmp r13, rax
je 0x14000205f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140001fe6
lea rdx, [0x140008248]
lea rcx, [0x140008240]
call fcn.140001e30
lea rdx, [0x140008258]
lea rcx, [0x140008250]
call fcn.140001e30
nop
test r12d, r12d
je 0x140002097
mov ecx, 8
call fcn.140003620
test r12d, r12d
jne 0x1400020c2
mov dword [0x14000c600], 1
lea ecx, [r12 + 8]
call fcn.140003620
mov ecx, r15d
call fcn.140001dc4
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140001f50

Function at 0x1400020e8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140001f50
Function at 0x140003f10
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140003074
xor ebx, ebx
mov rdi, rax
cmp qword [0x14000ccd8], rbx
jne 0x140004016
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400040eb
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400040eb
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000ccd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000cce0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14000cce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14000ccf8], rax
test rax, rax
je 0x14000400d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14000ccf0], rax
jmp 0x14000401d
mov rax, qword [0x14000ccf0]
jmp 0x140004024
mov rax, qword [0x14000ccf0]
mov r11, qword [0x14000ccf8]
cmp rax, rdi
je 0x14000408c
cmp r11, rdi
je 0x14000408c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14000ccf8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14000408c
test rax, rax
je 0x14000408c
call rsi
test rax, rax
je 0x140004086
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140004086
test byte [rsp + 0x38], 1
jne 0x14000408c
bts ebp, 0x15
jmp 0x1400040ca
mov rcx, qword [0x14000cce0]
cmp rcx, rdi
je 0x1400040ca
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400040ca
call rax
mov rbx, rax
test rax, rax
je 0x1400040ca
mov rcx, qword [0x14000cce8]
cmp rcx, rdi
je 0x1400040ca
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400040ca
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000ccd8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400040eb
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400040ed
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x110
mov edi, ecx
test ecx, ecx
je 0x14000110c
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov r10, qword [rdx + 0x20]
test r10, r10
je 0x14000110c
mov esi, 0x104
nop dword [rax + rax]
movzx eax, word [r10 + 0x48]
test ax, ax
je 0x14000110c
cmp ax, si
jae 0x14000110c
mov rbx, qword [r10 + 0x50]
xor r9d, r9d
movzx ecx, word [rbx]
test cx, cx
je 0x14000109d
xor r11d, r11d
nop dword [rax]
movzx r8d, cl
lea eax, [r8 - 0x20]
movzx ecx, al
lea edx, [r8 - 0x61]
cmp dl, 0x19
cmova ecx, r8d
inc r9d
mov byte [rsp + r11], cl
mov r11d, r9d
movzx eax, word [rbx + r9*2]
movzx ecx, al
test ax, ax
jne 0x140001070
xor edx, edx
mov byte [rsp + r9], 0
lea rax, [rsp]
cmp byte [rsp], dl
je 0x1400010b7
nop dword [rax]
inc rax
cmp byte [rax], dl
jne 0x1400010b0
lea rcx, [rsp]
mov r8, rdx
sub rax, rcx
je 0x140001100
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rsp + r8]
inc r8
add ecx, edx
imul edx, ecx, 0x81
mov ecx, edx
shr ecx, 6
xor edx, ecx
cmp r8, rax
jne 0x1400010d0
lea eax, [rdx + rdx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, edi
je 0x140001123
mov r10, qword [r10]
test r10, r10
jne 0x140001040
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, qword [r10 + 0x20]
jmp 0x14000110e