joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001b30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140002802
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x14000289a
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x14000287e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002872
cmp qword [rbp - 0x10], 0
je 0x140002872
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002838
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000289b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400029a0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400029c8
mov eax, 0
jmp 0x140002a16
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400029f1
mov eax, 0
jmp 0x140002a16
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002a11
mov eax, 0
jmp 0x140002a16
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x141b39058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141b391df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141b39089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b3906f
add dl, dl
jne 0x141b39096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b390f6
xor eax, eax
add dl, dl
jne 0x141b390a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141b391ad
add dl, dl
jne 0x141b390b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b390c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b390d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b390dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141b390ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141b3907e
mov eax, 1
add dl, dl
jne 0x141b39106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141b39113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b390fb
sub eax, ebx
mov ebx, 1
jne 0x141b3914c
mov ecx, 1
add dl, dl
jne 0x141b3912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b3913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b39123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b3907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141b39168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141b39175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141b3915d
cmp eax, 0x7d00
jae 0x141b3919b
cmp eax, 0x500
jb 0x141b39196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b3907e
cmp eax, 0x7f
ja 0x141b3919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141b3907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141b391d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141b3907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011163
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140012170
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x128]
lea rcx, [0x1400250a7]
call fcn.14001141a
movzx eax, word [rbp + 0x100]
mov word [rbp + 4], ax
movzx eax, word [rbp + 0x108]
mov word [rbp + 6], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rcx, [rbp - 0x20]
lea rdx, [0x14001bd80]
call fcn.140011398
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140011253
Capabilities:
Terminate process

Disassembly:
jmp 0x140014500
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112f3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015850
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015870
xor al, al
jmp 0x1400158f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015883
xor al, al
jmp 0x1400158f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400158ad
xor al, al
jmp 0x1400158f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400158c1
xor al, al
jmp 0x1400158f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400158d3
xor al, al
jmp 0x1400158f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400158ef
xor al, al
jmp 0x1400158f1
mov al, 1
add rsp, 0x38
ret
Function at 0x140006880
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140011238], rbx
je 0x1400068cc
cmp rax, rbx
jne 0x1400068bf
mov ebx, 1
mov esi, ebx
jmp 0x1400068d1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400068a4
mov ebx, 1
mov eax, dword [0x140011240]
cmp eax, ebx
jne 0x1400068e7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000694c
mov eax, dword [0x140011240]
test eax, eax
jne 0x140006946
mov dword [0x140011240], ebx
lea r15, [0x140008668]
lea rdi, [0x140008650]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140006938
test eax, eax
jne 0x14000693c
cmp qword [rdi], 0
je 0x14000692d
mov rax, qword [rdi]
mov rcx, qword [0x140008610]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000690e
test eax, eax
je 0x14000694c
mov eax, 0xff
jmp 0x140006a28
mov dword [0x14000f894], ebx
mov eax, dword [0x140011240]
cmp eax, ebx
jne 0x140006973
lea rdx, [0x140008648]
lea rcx, [0x140008618]
call sub.msvcrt.dll__initterm
mov dword [0x140011240], 2
test esi, esi
jne 0x140006980
xor eax, eax
xchg qword [0x140011238], rax
cmp qword [0x140011258], 0
je 0x1400069b4
lea rcx, [0x140011258]
call fcn.140007050
test eax, eax
je 0x1400069b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140011258]
mov r9, qword [0x140008610]
call r9
mov r8, qword [0x14000f8a8]
mov rdx, qword [0x14000f8a0]
mov ecx, dword [0x14000f898]
call fcn.14000166c
mov dword [0x14000f890], eax
cmp dword [0x14000f8b0], 0
jne 0x1400069e4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000f894], 0
jne 0x1400069f9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000f890]
jmp 0x140006a28
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14018e000
add rsp, 0x28
jmp 0x140006880

Function at 0x140006f3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140006f88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140006f80
cmp dword [rcx + 0x3c], edx
jl 0x140006f80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140006f80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140006f88
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14001a000
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x14001a035
call rax
jmp 0x14001a03b
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x14001a09d
mov word [rsp + 0x68], bx
mov word [rsp + 0x60], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov rcx, rax
call rdi
mov r11d, 0xaa64
cmp word [rsp + 0x60], r11w
jne 0x14001a09d
lea eax, [rbx + 2]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp word [rsp + 0x20], 9
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14001ca90
Capabilities:
Get file size
Get thread local storage value
Set thread local storage value
Write file on windows

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
mov eax, 0xa0b0
call fcn.14002b220
sub rsp, rax
mov rax, qword [0x140033060]
xor rax, rsp
mov qword [rsp + 0xa090], rax
cmp qword [rcx], 0xffffffffffffffff
mov r14, qword [rsp + 0xa100]
mov r13, r9
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
jne 0x14001cadc
mov eax, 2
jmp 0x14001cc7c
mov ecx, dword [rcx + 0x134]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14001caf7
mov eax, 4
jmp 0x14001cc7c
mov ecx, dword [rsi + 0x134]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rsi + 8]
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14001cb28
mov eax, 3
jmp 0x14001cc7c
lea rcx, [rsp + 0x78]
mov qword [rsp + 0xa0a8], rbx
mov dword [rsp + 0x70], 0
mov qword [rsp + 0xa0a0], rdi
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
test rbp, rbp
jne 0x14001cb54
lea rbp, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movzx ecx, word [rsp + 0x86]
movzx edx, word [rsp + 0x84]
movzx r10d, word [rsp + 0x82]
movzx r11d, word [rsp + 0x80]
movzx edi, word [rsp + 0x7e]
movzx r9d, word [rsp + 0x7a]
movzx r8d, word [rsp + 0x78]
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], rbp
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
lea rdx, str._04d__02d__02d_t_02d:_02d:_02d:_03d_t_s_t_08d_t_4u_t_4u_t
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x20], edi
call fcn.14001cca0
mov edx, 0xa000
mov r9, r14
mov dword [rsp + 0x70], eax
sub edx, eax
mov eax, eax
lea rcx, [rsp + rax + 0x90]
mov r8, r13
call fcn.14002008c
mov edx, dword [rsp + 0x70]
add edx, eax
lea ecx, [rdx + 2]
mov byte [rsp + rdx + 0x90], 0xd
lea eax, [rdx + 1]
mov byte [rsp + rax + 0x90], 0xa
mov byte [rsp + rcx + 0x90], 0
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r8d, dword [rsp + 0x70]
mov rcx, qword [rsi]
mov dword [rsi + 0x20], eax
lea rax, [rsi + 0x10]
lea r9, [rsp + 0x70]
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsi + 8]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [rsi + 0x134]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rdi, qword [rsp + 0xa0a0]
mov rbx, qword [rsp + 0xa0a8]
xor eax, eax
mov rcx, qword [rsp + 0xa090]
xor rcx, rsp
call fcn.14001d3f0
add rsp, 0xa0b0
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x14001cce0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001cd90
lea r8, [rsp + 0x58]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14001cd95
mov rax, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14001cd80
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff31c
add rsp, 0x48
ret
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffff3e4
add rsp, 0x48
ret

Function at 0x14001ced0
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov r13, rcx
lea rax, [r11 + 0x10]
mov qword [r11 - 0x58], rax
xor r15d, r15d
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x60], r15
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
adc eax, 0xf3e3

Function at 0x14001e28c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rcx, 0x7a438576
jmp 0x14000ef1a
dec rcx
jmp 0x14000f593
jmp 0x1400102e3
jne 0x14000ef1a
jmp 0x14000f38b
jmp 0x140010359
jmp 0x140010379
jmp 0x1400103cd
jmp 0x140010422
jmp 0x140010477
jmp 0x1400104c5
jmp 0x140010508
jmp 0x140010576
jmp 0x1400105b1
jmp 0x14001062c
jmp 0x14001065c
jmp 0x1400106b4
jmp 0x1400106e3
jmp 0x140010770
jmp 0x1400107b6
jmp 0x140010803
jmp 0x140010824
jmp 0x140010871
jmp 0x1400108f0
xor rcx, rcx
nop
nop
nop
mov rdx, 0x889c
nop
nop
nop
nop
nop
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
nop
call 0x14001091d
pop rsi
add rsi, 0xe47
nop
nop
nop
nop
nop
mov rdi, rax
mov rcx, 0x889c
rep movsb byte [rdi], byte [rsi]
nop
nop
jmp rax
sub rsp, 0x28
call fcn.140023964
add rsp, 0x28
xor rcx, rcx
jmp 0x140007a6f
invalid
Function at 0x14001e5e8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140023c28
nop
cmp dword [0x1400347b0], 1
je 0x14001e594
mov dword [0x1400347ac], 1
mov byte [0x1400347a8], r12b
test ebx, ebx
jne 0x14001e580
mov rcx, qword [0x140036850]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001e56d
mov rcx, qword [0x140036848]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001e50c
call fcn.140021628
cmp qword [rdi], rax
jne 0x14001e50c
jmp 0x14001e4f2
cmp rdi, rsi
jb 0x14001e56d
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140021628
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140036850]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140036848]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14001e54b
cmp r13, rax
je 0x14001e56b
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14001e4f2
lea rdx, [0x14002c458]
lea rcx, [0x14002c440]
call fcn.14001e33c
lea rdx, [0x14002c468]
lea rcx, [0x14002c460]
call fcn.14001e33c
nop
test r12d, r12d
je 0x14001e5a3
mov ecx, 8
call fcn.140023b28
test r12d, r12d
jne 0x14001e5ce
mov dword [0x1400347b0], 1
lea ecx, [r12 + 8]
call fcn.140023b28
mov ecx, r15d
call fcn.14001e2d0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14001e45c

Function at 0x14001e5f4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001e45c
Function at 0x14002090b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140033060]
jne 0x14001d40a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001d406
repz ret
ror rcx, 0x10
jmp 0x140020864
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140034890]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140034988]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400208e9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140034890]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14002090b
mov rax, qword [rsp + 0x88]
mov qword [0x140034988], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140034928], rax
mov rax, qword [0x140034988]
mov qword [0x140034800], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140034910], rax
mov dword [0x1400347f0], 0xc0000409
mov dword [0x1400347f4], 1
mov rax, qword [0x140033060]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140033068]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140034888], eax
mov ecx, 1
call fcn.1400220f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002c758]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140034888], 0
jne 0x140020992
mov ecx, 1
call fcn.1400220f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140029a54
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140021628
xor ebx, ebx
mov rdi, rax
cmp qword [0x1400354c8], rbx
jne 0x140029b5a
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140029c2f
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140029c2f
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400354c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400354d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1400354d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1400354e8], rax
test rax, rax
je 0x140029b51
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1400354e0], rax
jmp 0x140029b61
mov rax, qword [0x1400354e0]
jmp 0x140029b68
mov rax, qword [0x1400354e0]
mov r11, qword [0x1400354e8]
cmp rax, rdi
je 0x140029bd0
cmp r11, rdi
je 0x140029bd0
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1400354e8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140029bd0
test rax, rax
je 0x140029bd0
call rsi
test rax, rax
je 0x140029bca
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140029bca
test byte [rsp + 0x38], 1
jne 0x140029bd0
bts ebp, 0x15
jmp 0x140029c0e
mov rcx, qword [0x1400354d0]
cmp rcx, rdi
je 0x140029c0e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140029c0e
call rax
mov rbx, rax
test rax, rax
je 0x140029c0e
mov rcx, qword [0x1400354d8]
cmp rcx, rdi
je 0x140029c0e
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140029c0e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400354c8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140029c2f
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140029c31
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180001030
Capabilities:
Create thread
Get common file path

Disassembly:
mov r11, rsp
sub rsp, 0x268
mov rax, qword [0x180005008]
xor rax, rsp
mov qword [rsp + 0x250], rax
cmp edx, 1
jne 0x180001108
mov qword [r11 + 8], rbx
lea rcx, [rsp + 0x30]
mov edx, 0x104
mov qword [r11 - 8], rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x30]
lea rdx, str._s_version.dll
lea rcx, [rsp + 0x140]
call fcn.180001130
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1800056c8], rax
xor ebx, ebx
lea rdi, [0x180000000]
mov rdx, qword [rbx + rdi + 0x3360]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + rdi + 0x5640], rax
add rbx, 8
cmp rbx, 0x88
jge 0x1800010d3
mov rax, qword [0x1800056c8]
jmp 0x1800010a4
mov qword [rsp + 0x28], 0
lea r8, [0x180001010]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x260]
mov rbx, qword [rsp + 0x270]
mov eax, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180001210
add rsp, 0x268
ret