joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [r8 + 0x1c]
mov dword [rdx + 0x14], eax
mov eax, dword [r8 + 0xa0]
mov dword [rdx + 0xb0], eax
mov eax, dword [r8 + 0x20]
mov dword [rdx + 0x18], eax
mov eax, dword [r8 + 0x28]
mov dword [rdx + 0x20], eax
mov eax, dword [r8 + 0x24]
mov dword [rdx + 0x1c], eax
mov eax, dword [r8 + 0x34]
mov dword [rdx + 0x30], eax
mov eax, dword [r8 + 0x38]
mov dword [rdx + 0x34], eax
mov eax, dword [r8 + 0x3c]
mov dword [rdx + 0x38], eax
mov eax, dword [r8 + 0x44]
mov dword [rdx + 0x40], eax
mov eax, dword [r8 + 0x2c]
mov dword [rdx + 0x24], eax
mov eax, dword [r8 + 0x30]
mov dword [rdx + 0x2c], eax
mov eax, dword [r8 + 0x50]
add eax, eax
xor eax, dword [rdx + 0x4c]
and eax, 0x20
xor dword [rdx + 0x4c], eax
movzx eax, word [r8 + 0x86]
mov word [rdx + 0x82], ax
movzx eax, byte [r8 + 0x88]
mov byte [rdx + 0x84], al
mov eax, dword [r8 + 0x90]
mov dword [rdx + 0x8c], eax
mov eax, dword [r8 + 0x9c]
mov dword [rdx + 0xac], eax
mov eax, dword [r8 + 0xc0]
mov dword [rdx + 0xd0], eax
mov eax, dword [r8 + 0x134]
mov dword [rdx + 0x774], eax
mov eax, dword [r8 + 0x12c]
mov dword [rdx + 0x76c], eax
mov eax, dword [r8 + 0xfc]
mov dword [rdx + 0x700], eax
mov eax, dword [r8 + 0x110]
mov dword [rdx + 0x714], eax
mov eax, dword [r8 + 0x108]
mov dword [rdx + 0x70c], eax
mov eax, dword [r8 + 0x10c]
mov dword [rdx + 0x710], eax
mov eax, dword [r8 + 0xc4]
mov dword [rdx + 0xd4], eax
mov eax, dword [r8 + 0xb8]
mov dword [rdx + 0xc8], eax
mov eax, dword [r8 + 0x98]
xor eax, dword [rdx + 0xa8]
and eax, 0x8000
xor dword [rdx + 0xa8], eax
ret

Function at 0x18000c890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [r8 + 0x1c]
mov dword [rdx + 0x14], eax
mov eax, dword [r8 + 0xac]
mov dword [rdx + 0xbc], eax
mov eax, dword [r8 + 0x20]
mov dword [rdx + 0x18], eax
mov eax, dword [r8 + 0x28]
mov dword [rdx + 0x20], eax
mov eax, dword [r8 + 0x24]
mov dword [rdx + 0x1c], eax
mov eax, dword [r8 + 0x34]
mov dword [rdx + 0x30], eax
mov eax, dword [r8 + 0x38]
mov dword [rdx + 0x34], eax
mov eax, dword [r8 + 0x3c]
mov dword [rdx + 0x38], eax
mov eax, dword [r8 + 0x44]
mov dword [rdx + 0x40], eax
mov eax, dword [r8 + 0x2c]
mov dword [rdx + 0x24], eax
mov eax, dword [r8 + 0x30]
mov dword [rdx + 0x2c], eax
movzx eax, byte [r8 + 0x88]
mov byte [rdx + 0x84], al
mov eax, dword [r8 + 0x90]
mov dword [rdx + 0x8c], eax
mov eax, dword [r8 + 0x98]
mov dword [rdx + 0xa8], eax
mov eax, dword [r8 + 0x9c]
mov dword [rdx + 0xac], eax
mov eax, dword [r8 + 0xa0]
mov dword [rdx + 0xb0], eax
mov eax, dword [r8 + 0xa4]
mov dword [rdx + 0xb4], eax
mov eax, dword [r8 + 0x110]
mov dword [rdx + 0x15c], eax
mov eax, dword [r8 + 0xa8]
xor eax, dword [rdx + 0xb8]
and eax, 0x600
xor dword [rdx + 0xb8], eax
mov eax, dword [r8 + 0xe4]
mov dword [rdx + 0xf4], eax
mov eax, dword [r8 + 0xf8]
mov dword [rdx + 0x108], eax
mov eax, dword [r8 + 0xf0]
mov dword [rdx + 0x100], eax
mov eax, dword [r8 + 0xf4]
mov dword [rdx + 0x104], eax
ret
Function at 0x18001a7b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
mov esi, edi
test rcx, rcx
je 0x18001a88f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ebp, eax
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], si
jne 0x18001a7e7
lea ecx, [rax + 1]
add rdx, rcx
mov ecx, 0x40
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x18001a892
mov edx, ebp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r8d, eax
lea ecx, [r8 - 1]
cmp word [rsi + rcx*2], 0x5c
je 0x18001a836
mov eax, 0x5c
mov word [rsi + r8*2], ax
inc r8d
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbx + rax*2], di
jne 0x18001a840
test rax, rax
je 0x18001a88f
mov rdx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx + rdx*2]
lea ecx, [rdi + r8]
inc edi
mov word [rsi + rcx*2], ax
mov edx, edi
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x18001a880
cmp rdx, rax
jb 0x18001a860
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180020c20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov ecx, 0x40
add rdx, rdx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180020c82
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180020c77
cmp edi, eax
jb 0x180020c77
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180066200
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x48
mov rbx, rcx
lea rax, [0x1800d2020]
mov qword [rcx], rax
lea rax, [0x1800d2048]
mov qword [rcx], rax
mov qword [rcx + 8], 0x20
xor edi, edi
mov qword [rcx + 0x10], rdi
mov qword [0x1800ef570], rcx
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x68], edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1800ca590]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800662a7
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [0x1800ca5c0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x68]
mov dword [rbx + 0x18], eax
test eax, eax
cmovne rdi, qword [0x1800ef570]
mov qword [0x1800ef568], rdi
mov rax, rbx
add rsp, 0x48
pop rdi
pop rbx
ret
Function at 0x180066340
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov esi, edx
mov rbx, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebp, ebp
lea r14, [rbp - 1]
cmp dword [0x1800ee3b0], 0xffffffff
jne 0x1800663d1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1800ee3b0], eax
cmp eax, 0xffffffff
je 0x1800664d9
mov ecx, dword [rbx + 8]
mov dword [rbx + 0xc], ecx
mov eax, 8
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.18006887c
mov qword [rbx + 0x10], rax
mov edx, ebp
cmp dword [rbx + 0xc], edx
jbe 0x1800663d1
nop word [rax + rax]
mov ecx, edx
mov rax, qword [rbx + 0x10]
mov qword [rax + rcx*8], rbp
inc edx
cmp edx, dword [rbx + 0xc]
jb 0x1800663c0
mov ecx, 0xc
call fcn.180068840
mov rdi, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1800663f6
mov dword [rax], ebp
mov byte [rax + 4], 0
mov dword [rax + 8], esi
jmp 0x1800663f9
mov rdi, rbp
test rdi, rdi
je 0x1800664d9
mov rdx, rdi
mov ecx, dword [0x1800ee3b0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, ebp
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x180066438
mov r9, qword [rbx + 0x10]
mov eax, ecx
lea rdx, [r9 + rax*8]
cmp qword [rdx], 0
je 0x180066435
inc ecx
cmp ecx, r8d
jb 0x180066420
jmp 0x180066438
mov qword [rdx], rdi
mov edx, dword [rbx + 0xc]
cmp ecx, edx
jne 0x1800664cc
mov ecx, dword [rbx + 8]
add ecx, edx
mov eax, 8
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.18006887c
mov rsi, rax
mov r8d, ebp
mov edx, dword [rbx + 0xc]
test edx, edx
je 0x180066492
nop dword [rax]
mov ecx, r8d
lea rdx, [rcx*8]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rdx + rcx]
mov qword [rdx + rsi], rax
inc r8d
mov edx, dword [rbx + 0xc]
cmp r8d, edx
jb 0x180066470
mov ecx, dword [rbx + 8]
add ecx, edx
cmp edx, ecx
jae 0x1800664b2
nop dword [rax + rax]
mov eax, edx
mov qword [rsi + rax*8], rbp
inc edx
mov eax, dword [rbx + 8]
add eax, dword [rbx + 0xc]
cmp edx, eax
jb 0x1800664a0
mov rcx, qword [rbx + 0x10]
call fcn.180068884
mov eax, dword [rbx + 0xc]
mov qword [rsi + rax*8], rdi
mov qword [rbx + 0x10], rsi
mov eax, dword [rbx + 8]
add dword [rbx + 0xc], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1800664dc
mov rdi, rbp
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1800699d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbx, rcx
mov rbp, rdx
mov ecx, dword [rax + rcx + 0x88]
test ecx, ecx
jne 0x180069a00
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov edi, dword [rbx + rcx + 0x18]
lea rax, [rbx + rcx]
xor r9d, r9d
mov qword [rsp + 0x40], r14
test edi, edi
jle 0x180069a61
mov r10d, dword [rax + 0x20]
mov r11d, dword [rax + 0x24]
mov r14d, dword [rax + 0x1c]
add r10, rbx
add r11, rbx
nop dword [rax]
movzx eax, word [r11]
mov rdx, rbp
lea rcx, [r14 + rax*4]
mov esi, dword [rcx + rbx]
mov ecx, dword [r10]
add rcx, rbx
call fcn.180069994
test eax, eax
je 0x180069a7d
inc r9d
add r11, 2
add r10, 4
cmp r9d, edi
jl 0x180069a34
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
lea rax, [rbx + rsi]
jmp 0x180069a63

Function at 0x180069c34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov ebx, edx
Function at 0x1800b4414
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800b4444
xor eax, eax
jmp 0x1800b4507
mov rbp, rbx
cmp word [rax], si
je 0x1800b4469
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800b4450
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800b444c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800b42c4
movsxd r14, eax
test eax, eax
jne 0x1800b44a7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800b443d
mov rcx, r14
call fcn.1800a8888
mov rdi, rax
test rax, rax
jne 0x1800b44c0
xor ecx, ecx
call fcn.1800a8968
jmp 0x1800b449c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800b42c4
test eax, eax
jne 0x1800b44f1
mov rcx, rdi
call fcn.1800a8968
jmp 0x1800b44fb
xor ecx, ecx
call fcn.1800a8968
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800b4524
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1800b45ab
mov rsi, rbx
cmp word [rax], bp
je 0x1800b456a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1800b4554
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1800b4550
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1800a8888
mov rdi, rax
test rax, rax
je 0x1800b4598
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.18006b4f0
mov rbp, rdi
xor ecx, ecx
call fcn.1800a8968
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c0184
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1800f0280]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1800c01e2
cmp word [rdx], r12w
jne 0x1800c01e2
or byte [rax + r8*8 + 0x38], cl
jmp 0x1800c01e8
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x1800c0343
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x1800c031e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1800c0221
mov rcx, r9
jmp 0x1800c0244
cmp r9, rdx
jae 0x1800c025b
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1800c0205
jmp 0x1800c0343
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800c0318
cmp dword [rsp + 0x80], edi
je 0x1800c0318
mov rdx, r14
lea r11, [0x1800f0280]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1800c02f1
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1800c02c4
mov word [rbx], r12w
jmp 0x1800c033f
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1800c02cd
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x1800c033f
cmp word [rsp + 0x70], r12w
jne 0x1800c02fe
cmp rbx, rsi
je 0x1800c02be
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.1800bfe50
cmp word [rsp + 0x70], r12w
je 0x1800c0343
mov word [rbx], r13w
jmp 0x1800c033f
lea r11, [0x1800f0280]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x1800c033b
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x1800c0343
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800c502c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800bfe50
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800bfe50
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800c517c
cmp rax, 0xffffffffffffffff
je 0x1800c517c
xor edi, edi
test rbp, rbp
jle 0x1800c5127
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800a88e8
mov rbx, rax
test rax, rax
jne 0x1800c50b4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800c511d
mov edx, 0x8000
mov ecx, r14d
call fcn.1800c4c24
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800afce0
cmp eax, 0xffffffff
je 0x1800c50fd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800c50c4
mov edx, r15d
mov ecx, r14d
call fcn.1800c4c24
jmp 0x1800c511d
cmp byte [rsi + 0x38], dil
je 0x1800c5114
cmp dword [rsi + 0x34], 5
jne 0x1800c5114
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800c511d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800a8968
jmp 0x1800c5190
jns 0x1800c5190
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800bfe50
cmp rax, 0xffffffffffffffff
jne 0x1800c5148
cmp byte [rsi + 0x30], dil
je 0x1800c5190
mov edi, dword [rsi + 0x2c]
jmp 0x1800c5190
mov ecx, r14d
call fcn.1800b9df8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800c5190
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800c5190
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800c5189
mov eax, dword [rsi + 0x2c]
jmp 0x1800c518e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800bfe50
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x405778
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x03650000]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.004014c4
xor ebx, ebx
cmp qword [0x03652928], rbx
mov rdi, rax
jne 0x40588b
lea rcx, str.USER32.DLL
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x405962
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x405962
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x03652928], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x03652930], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x03652938], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
mov r11, rax
mov qword [0x03652948], rax
test rax, rax
je 0x405882
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.kernel32.dll_EncodePointer]
mov qword [0x03652940], rax
jmp 0x405892
mov rax, qword [0x03652940]
jmp 0x405899
mov rax, qword [0x03652940]
mov r11, qword [0x03652948]
cmp rax, rdi
je 0x405900
cmp r11, rdi
je 0x405900
mov rcx, rax
call qword [sym.imp.kernel32.dll_DecodePointer]
mov rcx, qword [0x03652948]
mov rsi, rax
call qword [sym.imp.kernel32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x405900
test rax, rax
je 0x405900
call rsi
test rax, rax
je 0x4058fa
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x4058fa
test byte [rsp + 0x40], 1
jne 0x405900
bts ebp, 0x15
jmp 0x405940
mov rcx, qword [0x03652930]
cmp rcx, rdi
je 0x405940
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x405940
call rax
mov rbx, rax
test rax, rax
je 0x405940
mov rcx, qword [0x03652938]
cmp rcx, rdi
je 0x405940
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x405940
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x03652928]
call qword [sym.imp.kernel32.dll_DecodePointer]
test rax, rax
je 0x405962
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x405964
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.00405384
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x405cab
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x03650000]
jne 0x40539e
rol rcx, 0x10
test cx, 0xffff
jne 0x40539a
repz ret
ror rcx, 0x10
jmp 0x405c04
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x036529f0]
call qword [sym.imp.kernel32.dll_RtlCaptureContext]
mov rax, qword [0x03652ae8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.kernel32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x405c89
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x036529f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.kernel32.dll_RtlVirtualUnwind
jmp 0x405cab
mov rax, qword [rsp + 0x88]
mov qword [0x03652ae8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x03652a88], rax
mov rax, qword [0x03652ae8]
mov qword [0x03652960], rax
mov rax, qword [rsp + 0x90]
mov qword [0x03652a70], rax
mov dword [0x03652950], 0xc0000409
mov dword [0x03652954], 1
mov rax, qword [0x03650000]
mov qword [rsp + 0x68], rax
mov rax, qword [0x03650008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x036529e8], eax
mov ecx, 1
call fcn.00405764
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x03651948]
call qword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x036529e8], 0
jne 0x405d32
mov ecx, 1
call fcn.00405764
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.kernel32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400019a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x140083100]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor ebx, ebx
mov rdx, qword [rcx + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rdx
cmp rax, 0x15
jb 0x140001ba4
cmp qword [rcx + 0x18], 7
jbe 0x1400019e7
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x15
lea r9, str.powershell__Command__
lea rcx, [rsp + 0x58]
call fcn.140002030
nop
mov r8d, 1
lea rdx, [0x140073308]
lea rcx, [rsp + 0x58]
call fcn.140002170
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140001a92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001baa
call fcn.1400361dc
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rax
mov dword [rbp - 0x50], 0x68
mov dword [rbp - 0x14], 1
mov word [rbp - 0x10], bx
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rdx, qword [rbp - 0x70]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140001b1b
xor bl, bl
jmp 0x140001b42
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x140001b7e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001b9e
call fcn.1400361dc
movzx eax, bl
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140036180
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rbp
ret
call fcn.14003c334
int3
call fcn.140001980
int3
call fcn.14003c334
int3