joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400102f0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
movsxd rsi, r8d
mov rbp, rdx
mov edi, ecx
mov byte [r11 - 0x38], 0
mov qword [r11 - 0x37], rax
mov dword [r11 - 0x2f], eax
mov word [r11 - 0x2b], ax
mov byte [r11 - 0x29], al
test r8d, r8d
jg 0x14001033e
mov eax, 8
jmp 0x1400103e0
mov ecx, 0x200
mov qword [rsp + 0xd8], rbx
call fcn.14001cc38
mov rbx, rax
test rax, rax
jne 0x14001035d
lea eax, [rbx + 4]
jmp 0x1400103d8
xor r8d, r8d
xor edx, edx
mov ecx, edi
call fcn.140020c5c
mov r8d, 0x200
mov rdx, rbx
mov ecx, edi
call fcn.140020928
test eax, eax
jne 0x14001038c
mov rcx, rbx
call fcn.14001ccf0
mov eax, 1
jmp 0x1400103d8
lea rcx, [rsp + 0x20]
call fcn.140012e50
lea rcx, [rsp + 0x20]
mov r8d, 0x200
mov rdx, rbx
call fcn.1400137b0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call fcn.140013880
lea rdx, [rsp + 0x80]
mov r8, rsi
mov rcx, rbp
call fcn.14001cd80
mov rcx, rbx
call fcn.14001ccf0
xor eax, eax
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001d550
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret

Function at 0x140010400
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x148
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov r12, r9
mov esi, r8d
mov rbx, rdx
mov ebp, ecx
call fcn.1400200fc
test eax, eax
jle 0x1400105b4
test rbx, rbx
je 0x1400105b4
cmp esi, 0x10
jg 0x1400105b4
mov ecx, 0x200
mov qword [rsp + 0x140], rdi
call fcn.14001cc38
mov rdi, rax
test rax, rax
jne 0x140010468
lea eax, [rdi + 4]
jmp 0x1400104c0
xor r8d, r8d
xor edx, edx
mov ecx, ebp
call fcn.140020c5c
mov r8d, 0x40
mov rdx, rdi
mov ecx, ebp
call fcn.140020928
cmp eax, 0x40
jne 0x140010533
movzx eax, word [rdi]
mov ecx, 0x4d5a
cmp ax, cx
je 0x1400104e5
mov ecx, 0x5a4d
cmp ax, cx
je 0x1400104e5
mov r9, r12
mov r8d, esi
mov rdx, rbx
mov ecx, ebp
call fcn.1400102f0
mov rcx, rdi
mov ebx, eax
call fcn.14001ccf0
mov eax, ebx
mov rdi, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14001d550
add rsp, 0x148
pop r12
pop rsi
pop rbp
pop rbx
ret
cmp word [rdi + 8], 4
jb 0x14001059a
movzx eax, word [rdi + 0x18]
cmp ax, 0x40
jae 0x14001050d
movzx ecx, word [rdi + 6]
movzx eax, ax
lea ecx, [rax + rcx*4]
cmp ecx, 0x3c
jg 0x14001059a
mov edx, dword [rdi + 0x3c]
xor r8d, r8d
mov ecx, ebp
call fcn.140020c5c
lea rdx, [rsp + 0x30]
mov r8d, 0xf8
mov ecx, ebp
call fcn.140020928
cmp eax, 0xf8
je 0x140010545
mov rcx, rdi
call fcn.14001ccf0
mov eax, 1
jmp 0x1400104c0
cmp dword [rsp + 0x30], 0x4550
jne 0x14001059a
movzx eax, word [rsp + 0x34]
mov ecx, 0x14c
cmp ax, cx
je 0x140010572
mov ecx, 0x14d
cmp ax, cx
je 0x140010572
mov ecx, 0x14e
cmp ax, cx
jne 0x14001059a
mov eax, 0x10b
cmp word [rsp + 0x48], ax
jne 0x14001059a
lea rdx, [rsp + 0x30]
mov r9d, esi
mov r8, rbx
mov ecx, ebp
mov qword [rsp + 0x20], r12
call fcn.1400100d0
jmp 0x1400104b4
mov r9d, esi
mov r8, rbx
mov rdx, rdi
mov ecx, ebp
mov qword [rsp + 0x20], r12
call fcn.14000ffa0
jmp 0x1400104b4
mov eax, 8
jmp 0x1400104c8
Function at 0x1400105c0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0xa0
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
movsxd rbp, r9d
mov rsi, r8
mov edi, edx
mov r12d, ecx
mov byte [r11 - 0x48], 0
mov qword [r11 - 0x47], rax
mov dword [r11 - 0x3f], eax
mov word [r11 - 0x3b], ax
mov byte [r11 - 0x39], al
call fcn.1400200fc
mov ebx, eax
test eax, eax
jle 0x1400106b1
cmp eax, edi
jle 0x1400106b1
test rsi, rsi
je 0x1400106b1
cmp ebp, 0x10
jg 0x1400106b1
sub ebx, edi
movsxd rcx, ebx
call fcn.14001cc38
mov rdi, rax
test rax, rax
jne 0x140010645
lea eax, [rdi + 4]
jmp 0x1400106b6
mov r8d, ebx
mov rdx, rax
mov ecx, r12d
call fcn.140020928
cmp eax, ebx
je 0x140010666
mov rcx, rdi
call fcn.14001ccf0
mov eax, 1
jmp 0x1400106b6
lea rcx, [rsp + 0x20]
call fcn.140012e50
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rdi
call fcn.1400137b0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x80]
call fcn.140013880
lea rdx, [rsp + 0x80]
mov r8, rbp
mov rcx, rsi
call fcn.14001cd80
mov rcx, rdi
call fcn.14001ccf0
xor eax, eax
jmp 0x1400106b6
mov eax, 8
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001d550
add rsp, 0xa0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400129c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov rax, r9
mov edi, r8d
mov r15d, edx
mov rbp, rcx
mov r12d, r13d
mov r14d, r13d
mov esi, r13d
test rcx, rcx
je 0x140012b71
test rax, rax
je 0x140012b71
cmp edx, 0xffffffff
je 0x140012b71
xor r8d, r8d
xor edx, edx
mov ecx, r15d
call fcn.140020c5c
cmp eax, 0xffffffff
jne 0x140012a45
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x140012a31
mov dword [rax], 4
movzx eax, r13w
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x68], rbx
mov rbx, qword [rsp + 0x80]
test rbx, rbx
jne 0x140012aa0
mov r8d, edi
mov rdx, rbp
mov ecx, r15d
call fcn.140020928
mov esi, eax
cmp eax, 0xffffffff
je 0x140012a74
cmp eax, edi
je 0x140012b46
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x140012a87
mov dword [rax], 0xd
movzx eax, r13w
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, dword [rbx]
cmp r8d, edi
jae 0x140012aff
test r8d, r8d
je 0x140012ade
mov edx, r14d
sub r8d, r12d
mov ecx, r15d
add rdx, rbp
call fcn.140020928
cmp eax, 0xffffffff
je 0x140012b57
mov edx, dword [rbx]
mov ecx, edx
sub ecx, r12d
cmp eax, ecx
jne 0x140012b57
sub edx, r12d
add r14d, edx
add esi, eax
mov ecx, dword [rbx + 8]
lea eax, [rdi - 1]
cmp ecx, eax
jae 0x140012b46
lea r12d, [rcx + 1]
xor r8d, r8d
mov ecx, r15d
mov edx, r12d
call fcn.140020c5c
cmp eax, 0xffffffff
je 0x140012b57
cmp qword [rbx + 0x10], 0
je 0x140012b0a
cmp dword [rbx], edi
jb 0x140012b33
mov r13d, edi
mov edx, r14d
mov ecx, r15d
add rdx, qword [rsp + 0x60]
sub r13d, r12d
mov r8d, r13d
call fcn.140020928
cmp eax, 0xffffffff
je 0x140012b57
cmp eax, r13d
jne 0x140012b57
add esi, eax
cmp dword [rbx], edi
jae 0x140012b46
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140012b46
mov rbp, qword [rsp + 0x60]
jmp 0x140012aa0
mov rax, qword [rsp + 0x78]
mov dword [rax], esi
mov eax, 1
jmp 0x140012a8b
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x140012b6a
mov dword [rax], 0xd
xor eax, eax
jmp 0x140012a8b
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140012b84
mov dword [rcx], 4
movzx eax, r13w
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140013a00
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, cx
test r8d, r8d
je 0x140013a39
lea r10, [0x14005b4d0]
movzx ecx, r9w
movzx eax, r9w
inc rdx
shl cx, 8
shr rax, 8
movzx r9d, word [r10 + rax*2]
xor r9w, cx
movzx ecx, byte [rdx - 1]
xor r9w, cx
dec r8d
jne 0x140013a10
movzx eax, r9w
ret
Function at 0x1400164c0
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push r12
lea rbp, [r11 - 0x5f]
sub rsp, 0x98
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [r11 - 0x30], r13
mov eax, edx
xor r13d, r13d
shr eax, 6
mov qword [r11 - 0x38], r14
mov rsi, r8
mov r12d, edx
mov dword [rbp - 0x39], 0x67452301
mov dword [rbp - 0x35], 0xefcdab89
mov r14, rcx
mov dword [rbp - 0x31], 0x98badcfe
mov dword [rbp - 0x2d], 0x10325476
test eax, eax
je 0x14001654d
mov qword [r11 - 0x28], rdi
mov rbx, rcx
mov r13d, eax
mov edi, eax
nop word [rax + rax]
lea rcx, [rbp - 0x39]
mov rdx, rbx
call fcn.140015b80
add rbx, 0x40
dec rdi
jne 0x140016530
mov rdi, qword [rsp + 0x90]
mov ebx, r12d
shl r13d, 6
lea rcx, [rbp - 0x29]
and ebx, 0x3f
mov edx, r13d
add rdx, r14
mov r8d, ebx
call fcn.14001cd80
mov r14, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r11d, r12d
lea rbx, [rbp + rbx - 0x29]
xor edx, edx
and r11d, 0x3f
mov rcx, rbx
cmp r11d, 0x38
jae 0x1400165a3
mov r8d, 0x38
sub r8d, r11d
call fcn.14001d3c0
mov byte [rbx], 0x80
jmp 0x1400165e0
mov r8d, 0x40
sub r8d, r11d
call fcn.14001d3c0
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x39]
mov byte [rbx], 0x80
call fcn.140015b80
xor r11d, r11d
mov qword [rbp - 0x29], r11
mov qword [rbp - 0x21], r11
mov qword [rbp - 0x19], r11
mov qword [rbp - 0x11], r11
mov qword [rbp - 9], r11
mov qword [rbp - 1], r11
mov qword [rbp + 7], r11
lea eax, [r12*8]
shr r12d, 0x1d
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x39]
mov dword [rbp + 0xf], eax
mov dword [rbp + 0x13], r12d
call fcn.140015b80
mov eax, dword [rbp - 0x39]
mov dword [rsi], eax
mov eax, dword [rbp - 0x35]
mov dword [rsi + 4], eax
mov eax, dword [rbp - 0x31]
mov dword [rsi + 8], eax
mov eax, dword [rbp - 0x2d]
mov dword [rsi + 0xc], eax
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14001d550
add rsp, 0x98
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x140017c90
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xe0
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rax, qword [0x14005b6f0]
mov rbx, r8
mov r8d, edx
mov qword [r11 - 0x40], rax
mov rax, qword [0x14005b6f8]
mov rdx, rcx
mov qword [r11 - 0x38], rax
mov rax, qword [0x14005b700]
lea rcx, [rsp + 0x20]
mov qword [r11 - 0x30], rax
mov rax, qword [0x14005b708]
mov qword [r11 - 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
call fcn.140016c20
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140016ce0
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14001d550
add rsp, 0xe0
pop rbx
ret
Function at 0x140017f30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r12
push r14
sub rsp, 0x38
xor r14d, r14d
mov r12, r8
mov rbp, rdx
mov esi, ecx
mov dword [rsp + 0x60], r14d
cmp ecx, 0xffffffff
je 0x14001815c
test rdx, rdx
je 0x14001815c
test r8, r8
je 0x14001815c
lea ecx, [r14 + 0x40]
mov qword [rsp + 0x68], rbx
call fcn.14001cc38
mov rbx, rax
test rax, rax
je 0x140017fa8
xor r8d, r8d
xor edx, edx
mov ecx, esi
call fcn.140020c5c
cmp eax, 0xffffffff
je 0x140017fa0
lea r8d, [r14 + 0x40]
mov rdx, rbx
mov ecx, esi
call fcn.140020928
cmp eax, 0x40
je 0x140017fbc
mov rcx, rbx
call fcn.14001ccf0
movzx eax, r14w
mov rbx, qword [rsp + 0x68]
add rsp, 0x38
pop r14
pop r12
pop rsi
pop rbp
ret
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14001813f
mov eax, dword [rbx + 0x3c]
xor r8d, r8d
mov ecx, esi
lea edx, [rax + 0x18]
mov qword [rsp + 0x30], r13
lea r13d, [rax + 0x58]
call fcn.140020c5c
cmp eax, 0xffffffff
je 0x140017fff
lea rdx, [rsp + 0x60]
mov r8d, 4
mov ecx, esi
call fcn.140020928
cmp eax, 4
je 0x140018010
mov rcx, rbx
call fcn.14001ccf0
movzx eax, r14w
jmp 0x1400180d9
mov eax, 0x10b
mov qword [rsp + 0x70], rdi
mov edi, dword [rbx + 0x3c]
cmp word [rsp + 0x60], ax
jne 0x14001802c
add edi, 0x98
jmp 0x140018032
add edi, 0xa8
mov rcx, rbx
call fcn.14001ccf0
xor r8d, r8d
mov edx, edi
mov ecx, esi
call fcn.140020c5c
cmp eax, 0xffffffff
je 0x140018100
lea rdx, [rsp + 0x20]
mov r8d, 8
mov ecx, esi
call fcn.140020928
cmp eax, 8
jne 0x140018100
lea ecx, [rax + 0x10]
call fcn.14001cc38
mov r11, rax
test rax, rax
je 0x140018100
mov dword [rax], r13d
mov dword [rax + 4], r14d
lea eax, [r13 + 3]
mov dword [r11 + 0xc], r14d
mov qword [r11 + 0x10], r14
mov dword [r11 + 8], eax
mov ecx, 0x18
mov qword [rbp], r11
call fcn.14001cc38
mov r11, rax
test rax, rax
je 0x140018100
mov dword [rax], edi
mov dword [rax + 4], r14d
mov dword [r11 + 0xc], r14d
mov qword [r11 + 0x10], r14
lea eax, [rdi + 7]
mov dword [r11 + 8], eax
mov rax, qword [rbp]
mov qword [rax + 0x10], r11
mov rbx, qword [rsp + 0x20]
test ebx, ebx
jne 0x1400180ee
lea eax, [rbx + 1]
mov rdi, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
add rsp, 0x38
pop r14
pop r12
pop rsi
pop rbp
ret
mov ecx, 0x18
call fcn.14001cc38
mov r11, rax
test rax, rax
jne 0x140018106
movzx eax, r14w
jmp 0x1400180d4
mov dword [rax], ebx
mov dword [rax + 4], r14d
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
mov dword [r11 + 0xc], r14d
mov qword [r11 + 0x10], r14
lea ecx, [rax + rcx - 1]
mov dword [r11 + 8], ecx
mov rax, qword [rbp]
mov rcx, qword [rax + 0x10]
mov qword [rcx + 0x10], r11
mov eax, dword [rsp + 0x20]
mov dword [r12], eax
mov eax, 2
jmp 0x1400180d4
mov rcx, rbx
call fcn.14001ccf0
mov rbx, qword [rsp + 0x68]
mov eax, 1
add rsp, 0x38
pop r14
pop r12
pop rsi
pop rbp
ret
movzx eax, r14w
add rsp, 0x38
pop r14
pop r12
pop rsi
pop rbp
ret

Function at 0x140018b60
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x140018b86
sub rdx, r8
sub rcx, r8
nop dword [rax + rax]
mov eax, dword [rdx + r8]
add r8, 4
xor eax, dword [r8 - 4]
dec r9
mov dword [rcx + r8 - 4], eax
jne 0x140018b70
repz ret
Function at 0x140021708
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x140021732
call fcn.14001e790
and dword [rax], 0
call fcn.14001e770
mov ebx, 0x16
mov dword [rax], ebx
call fcn.140023c10
mov eax, ebx
jmp 0x140021782
test edx, 0xfffffff9
jne 0x140021715
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14002175b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14001e7b0
call fcn.14001e770
mov eax, dword [rax]
jmp 0x140021782
test al, 0x10
jne 0x140021780
test al, 1
je 0x140021780
test bl, 2
je 0x140021780
call fcn.14001e790
mov dword [rax], 5
call fcn.14001e770
mov dword [rax], 0xd
jmp 0x140021752
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140022624
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140022494

Function at 0x140024347
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14005bed0]
jne 0x14001d56a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001d566
repz ret
ror rcx, 0x10
jmp 0x1400242a0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14005ded0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14005dfc8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140024325
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14005ded0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140024347
mov rax, qword [rsp + 0x88]
mov qword [0x14005dfc8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14005df68], rax
mov rax, qword [0x14005dfc8]
mov qword [0x14005de40], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14005df50], rax
mov dword [0x14005de30], 0xc0000409
mov dword [0x14005de34], 1
mov rax, qword [0x14005bed0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14005bed8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14005dec8], eax
mov ecx, 1
call fcn.140034860
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400504e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14005dec8], 0
jne 0x1400243ce
mov ecx, 1
call fcn.140034860
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400343a8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14005bed0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140025240
xor ebx, ebx
cmp qword [0x14005e760], rbx
mov rdi, rax
jne 0x1400344bb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140034592
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140034592
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14005e760], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14005e768], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14005e770], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14005e780], rax
test rax, rax
je 0x1400344b2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14005e778], rax
jmp 0x1400344c2
mov rax, qword [0x14005e778]
jmp 0x1400344c9
mov rax, qword [0x14005e778]
mov r11, qword [0x14005e780]
cmp rax, rdi
je 0x140034530
cmp r11, rdi
je 0x140034530
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14005e780]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140034530
test rax, rax
je 0x140034530
call rsi
test rax, rax
je 0x14003452a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003452a
test byte [rsp + 0x40], 1
jne 0x140034530
bts ebp, 0x15
jmp 0x140034570
mov rcx, qword [0x14005e768]
cmp rcx, rdi
je 0x140034570
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140034570
call rax
mov rbx, rax
test rax, rax
je 0x140034570
mov rcx, qword [0x14005e770]
cmp rcx, rdi
je 0x140034570
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140034570
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14005e760]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140034592
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140034594
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001d550
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001000
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x28], 0x238
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400010b4
mov rbx, rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
lea r14, [rsp + 0x54]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14000109c
lea r15, [rsp + 0x28]
mov r12, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1400010ab
mov rcx, rdi
mov rdx, r14
call r12
test eax, eax
jne 0x140001080
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x30]
jmp 0x1400010b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140009260
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400010e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
lea rcx, [0x14000b300]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400012d8
mov rsi, rax
lea r8, [rsp + 0x70]
mov rcx, rdi
mov rdx, rax
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
mov r14, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, str.c:windows_system32_ntdll.dll
mov ebx, 1
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x1400012eb
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x40], rax
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x60], rax
movsxd rbx, dword [r14 + 0x3c]
movzx r12d, word [rbx + r14 + 6]
test r12w, r12w
je 0x1400012ad
lea r15, [r14 + rbx]
add r15, 0x18
xor esi, esi
lea r13, [0x14000b369]
lea rbp, [rsp + 0x6c]
jmp 0x140001240
inc rsi
movzx eax, r12w
add r15, 0x28
cmp rsi, rax
jae 0x1400012ad
movzx edi, word [r14 + rbx + 0x14]
add rdi, r15
mov rcx, rdi
mov rdx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140001230
mov dword [rsp + 0x6c], 0
mov edx, dword [rdi + 8]
mov ecx, dword [rdi + 0xc]
add rcx, r14
mov r8d, 0x40
mov r9, rbp
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call r12
mov r8d, dword [rdi + 8]
mov edx, dword [rdi + 0xc]
lea rcx, [rdx + r14]
add rdx, qword [rsp + 0x60]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x6c]
mov edx, dword [rdi + 8]
mov ecx, dword [rdi + 0xc]
add rcx, r14
mov r9, rbp
call r12
movzx r12d, word [r14 + rbx + 6]
jmp 0x140001230
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x48]
call rsi
mov rcx, qword [rsp + 0x40]
call rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
jmp 0x1400012f7
lea rcx, str.____Invalid_Ntdll_module_handle
call fcn.140001320
mov ebx, 1
jmp 0x1400012f7
lea rcx, str.____Invalid_Ntdll_mapping_handle
call fcn.140001320
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140009260
mov eax, ebx
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret