joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140192000
add rsp, 0x28
jmp 0x14000c43c
Function at 0x14000eeac
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r15, r8
mov rbp, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rbx, [rsp + 0x38]
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
xor esi, esi
mov rcx, rdx
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.14015e284
cmp eax, 1
sbb esi, esi
not esi
or esi, dword [rbx]
js 0x14000ef31
lea rdx, [rsp + 0x70]
mov ecx, esi
call fcn.14000ebe4
mov r12d, 0xffffffff
xor r14d, r14d
test eax, eax
je 0x14000ef3b
mov edi, eax
mov ebx, 0xffffffff
jmp 0x14000f05a
mov edi, 6
jmp 0x14000f081
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 0
mov rcx, rbp
mov edx, 0x8000
mov r8d, 0x40
xor r9d, r9d
call fcn.14015e284
mov ebx, dword [rsp + 0x38]
cmp eax, 1
mov ebp, 0
sbb ebp, ebp
not ebp
or ebp, ebx
js 0x14000f042
lea rdx, [rsp + 0x38]
mov ecx, ebp
call fcn.140158344
mov r12d, 0xffffffff
mov edi, 6
test eax, eax
jne 0x14000f057
mov r13d, dword [rsp + 0x4c]
cmp r13d, dword [rsp + 0x78]
jne 0x14000f04b
mov rcx, r13
call fcn.14005da90
test rax, rax
je 0x14000f052
mov r14, rax
mov ecx, ebp
mov rdx, rax
mov r8d, r13d
call fcn.140159fec
cmp eax, dword [rsp + 0x78]
jne 0x14000f05a
mov ebp, eax
call fcn.14007bbfb
movsxd rdx, ebp
mov rcx, r14
call fcn.14007bbd8
not eax
cmp dword [rsp + 0x7c], eax
jne 0x14000f0a7
lea r12, [rsp + 0x6c]
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], 0
xor ebp, ebp
mov rcx, r15
mov edx, 0x8301
mov r8d, 0x40
xor r9d, r9d
call fcn.14015e284
mov r12d, dword [r12]
cmp eax, 1
sbb ebp, ebp
not ebp
or ebp, r12d
js 0x14000f0ae
lea rcx, [rsp + 0x70]
mov edx, esi
mov r8, r14
mov r9d, ebp
call fcn.14000ecbf
mov edi, eax
jmp 0x14000f05a
mov edi, 6
mov ebx, ebp
jmp 0x14000f05a
mov edi, 8
jmp 0x14000f057
mov edi, 1
xor r14d, r14d
mov rcx, r14
call fcn.14005daf0
mov ecx, esi
call fcn.1401558e8
test ebx, ebx
js 0x14000f074
mov ecx, ebx
call fcn.1401558e8
test r12d, r12d
js 0x14000f081
mov ecx, r12d
call fcn.1401558e8
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 4
jmp 0x14000f05a
mov r12d, ebp
jmp 0x14000f05a

Function at 0x140013ae0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401606f0
cmp rax, rbx
jne 0x140013b67
cmp edi, 1
je 0x140013b14
cmp edi, 2
je 0x140013b67
mov rcx, qword [rsi + 0x40]
call fcn.14015f938
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140147fd0
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140013df0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x140013e4c
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x140013e5c
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.1401606f0
mov di, 0xffff
cmp rax, 1
jne 0x140013f0b
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x140013f0b
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x140013f07
mov ebp, eax
cmp eax, 3
je 0x140013ee6
cmp ebp, 1
ja 0x140013f07
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.1401606f0
cmp rax, rbx
jne 0x140013f07
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x140013e79
jmp 0x140013e4c
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.1401606f0
cmp rax, 1
je 0x140013e4c
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140147fd0
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140057260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.PathExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1ba
call fcn.140047ce0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14008c5b0
cmp byte [rsi + 0x17], 0
jns 0x1400572b6
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, rdi
call fcn.14008c6e0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140147fd0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400572f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rdx, str.DirectoryExists
lea r8, str..._.._base_files_file_util_win.cc
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov r9d, 0x1cc
call fcn.140047ce0
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
call fcn.14008c5b0
cmp byte [rsi + 0x17], 0
jns 0x140057346
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
setne al
and esi, 0x10
shr esi, 4
and sil, al
mov rcx, rdi
call fcn.14008c6e0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x140057380
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x280
mov rsi, rcx
mov rax, qword [0x1401b6b28]
xor rax, rsp
mov qword [rsp + 0x278], rax
lea rdi, [rsp + 0x60]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x102
jbe 0x1400573c0
xor esi, esi
jmp 0x140057425
mov qword [rsp + 0x20], rdi
cmp word [rsp + 0x60], 0
je 0x1400573de
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x62], 0
lea rax, [rax + 1]
jne 0x1400573d0
jmp 0x1400573e0
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140043d50
lea rbx, [rsp + 0x48]
mov rcx, rdi
mov rdx, rbx
call fcn.140045d70
mov rcx, rsi
mov rdx, rbx
call fcn.140043dd0
mov rcx, rbx
call fcn.140043da0
mov rcx, rdi
call fcn.140043da0
mov sil, 1
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140147fd0
mov eax, esi
add rsp, 0x280
pop rbx
pop rdi
pop rsi
ret
Function at 0x140143934
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov dword [rcx + 0x48], 0x1003f
mov eax, dword [rdx + 0x234]
mov dword [rcx + 0x4c], eax
mov eax, dword [rdx + 0x238]
mov dword [rcx + 0x50], eax
mov eax, dword [rdx + 0x23c]
mov dword [rcx + 0x54], eax
mov eax, dword [rdx + 0x240]
mov dword [rcx + 0x58], eax
mov eax, dword [rdx + 0x24c]
mov dword [rcx + 0x5c], eax
mov eax, dword [rdx + 0x250]
mov dword [rcx + 0x60], eax
lea rdx, [rcx + 0x64]
lea rbx, [rdi + 0x34]
mov rcx, rbx
call fcn.140116c98
movzx eax, word [rdi + 0x30]
mov dword [rsi + 0xd4], eax
movzx eax, word [rdi + 0x2e]
mov dword [rsi + 0xd8], eax
movzx eax, word [rdi + 0x2c]
mov dword [rsi + 0xdc], eax
movzx eax, word [rdi + 0x2a]
mov dword [rsi + 0xe0], eax
mov eax, dword [rdi + 0x10]
mov dword [rsi + 0xe4], eax
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0xe8], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 0xec], eax
mov eax, dword [rdi + 0xc]
mov dword [rsi + 0xf0], eax
mov eax, dword [rdi + 8]
mov dword [rsi + 0xf4], eax
mov eax, dword [rdi]
mov dword [rsi + 0xf8], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0xfc], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x100], eax
movzx eax, word [rdi + 0x28]
mov dword [rsi + 0x104], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x108], eax
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x10c], eax
movzx eax, word [rdi + 0x32]
mov dword [rsi + 0x110], eax
add rsi, 0x114
mov r8d, 0x200
mov rcx, rsi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14014a9e0
Function at 0x180002390
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1800023c3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180002406
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x180002401
cmp rbx, r11
jae 0x180002406
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1800023f0
cmp rbx, r11
jb 0x18000240a
xor eax, eax
jmp 0x180002416
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000da10
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x18002b318]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [rbp - 0x59]
xor edx, edx
mov r8d, 0xa0
call fcn.180011790
mov eax, 0x12
lea rcx, str.00000409
lea edx, [rax + 0x6e]
mov dword [rbp - 0x59], 1
mov word [rbp - 0x51], ax
mov dword [rbp - 0x31], 1
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
mov rdi, rax
test rax, rax
je 0x18000daf9
mov ecx, 0x64
mov rdx, rax
mov qword [rsp + 0xe0], rbx
call qword [sym.imp.USER32.dll_VkKeyScanExW]
mov r8d, 0x28
lea rdx, [rbp - 0x59]
movups xmm1, xmmword [rbp - 0x21]
mov word [rbp - 0x29], ax
lea ecx, [r8 - 0x24]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [rbp - 0x49]
movups xmm0, xmmword [rbp - 0x31]
movups xmmword [rbp + 0x2f], xmm1
movaps xmmword [rbp - 9], xmm0
mov dword [rbp + 3], 2
movsd xmm0, qword [rbp - 0x11]
movsd qword [rbp + 0x17], xmm0
movaps xmm0, xmmword [rbp - 0x59]
movups xmmword [rbp + 0x1f], xmm0
movsd xmm0, qword [rbp - 0x39]
mov dword [rbp + 0x2b], 2
movsd qword [rbp + 0x3f], xmm0
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_UnloadKeyboardLayout]
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800105d0
mov rdi, qword [rsp + 0xe8]
add rsp, 0xd0
pop rbp
ret

Function at 0x18000f840
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x18002cbc0]
test rcx, rcx
jne 0x18000f797
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x18000f790
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x18000f7c2
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x18000f78c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x18002cbc0], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x18000f835
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18000f7e5
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x18002cbc0]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x18000f812
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x18000f835
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x18002cbc0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x18000f819
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x18000f71c
Function at 0x18001400f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18002b318]
jne 0x1800105ea
rol rcx, 0x10
test cx, 0xffff
jne 0x1800105e6
repz ret
ror rcx, 0x10
jmp 0x180013f68
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18002cea0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18002cf98]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180013fed
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18002cea0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18001400f
mov rax, qword [rsp + 0x88]
mov qword [0x18002cf98], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18002cf38], rax
mov rax, qword [0x18002cf98]
mov qword [0x18002ce10], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18002cf20], rax
mov dword [0x18002ce00], 0xc0000409
mov dword [0x18002ce04], 1
mov rax, qword [0x18002b318]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18002b320]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18002ce98], eax
mov ecx, 1
call fcn.18001c7ec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180022190]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18002ce98], 0
jne 0x180014096
mov ecx, 1
call fcn.18001c7ec
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18001c984
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18002b318]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180014c4c
xor ebx, ebx
cmp qword [0x18002de40], rbx
mov rdi, rax
jne 0x18001ca97
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18001cb6e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001cb6e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18002de40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18002de48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18002de50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18002de60], rax
test rax, rax
je 0x18001ca8e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18002de58], rax
jmp 0x18001ca9e
mov rax, qword [0x18002de58]
jmp 0x18001caa5
mov rax, qword [0x18002de58]
mov r11, qword [0x18002de60]
cmp rax, rdi
je 0x18001cb0c
cmp r11, rdi
je 0x18001cb0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18002de60]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18001cb0c
test rax, rax
je 0x18001cb0c
call rsi
test rax, rax
je 0x18001cb06
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18001cb06
test byte [rsp + 0x40], 1
jne 0x18001cb0c
bts ebp, 0x15
jmp 0x18001cb4c
mov rcx, qword [0x18002de48]
cmp rcx, rdi
je 0x18001cb4c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001cb4c
call rax
mov rbx, rax
test rax, rax
je 0x18001cb4c
mov rcx, qword [0x18002de50]
cmp rcx, rdi
je 0x18001cb4c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001cb4c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18002de40]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18001cb6e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18001cb70
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800105d0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003ca00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003ca0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003ca1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003ca05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003ca35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003ca22
sub eax, 3
jb 0x14003ca4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003ca86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003ca76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003ca74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003ca63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003c9c2
jmp 0x14003ca0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003cad2
cmp rsi, rcx
jae 0x14003cada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003cab9
cmp al, 0x8f
ja 0x14003cab9
cmp byte [rsi - 2], 0xf
je 0x14003cabf
sub al, 0xe8
cmp al, 1
ja 0x14003caa3
cmp rsi, rcx
jae 0x14003cada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003caa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003cada
lodsb al, byte [rsi]
jmp 0x14003cab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x39000]
mov eax, dword [rdi]
or eax, eax
je 0x14003cb43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x40ff8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003cae7
jns 0x14003cb1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003cb26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003cb3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003cb07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003cb9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac