joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ea20
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180074010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x180056d80]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x180056d84]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x180056d68]
mov word [rsp + 0x6c], ax
mov eax, 0x30
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x180056d78]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x18004eb24
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18004ead8
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x18004eb47
inc ax
mov word [rsp + 0x6a], ax
jmp 0x18004eaf3
cmp eax, 0xe7
jne 0x18004eb47
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x18004eb47
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x18004eab8
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18004b300
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x18004eb29

Function at 0x18004eb50
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x18004eb70
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x18004eb66
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18004eb66
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18004ebfb
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x18004ec10
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x18004ebe4
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.18004e9d0
mov rbp, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x18004ec20
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x18004ec36
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x18004ec43
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18004ec3b
test rdx, rdx
je 0x18004ec3b
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18004ec7a
cmp dword [rsp + 0x50], edi
jne 0x18004ec7a
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140001af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4b0
mov r15, r9
mov r12, r8
mov rbx, rdx
mov rdi, qword [rdx + 0x10]
mov rbp, rdi
shr rbp, 4
lea r14d, [rbp + 1]
shl r14d, 4
mov dword [rsp + 0x4f8], r14d
movsxd rsi, r14d
inc rsi
mov rcx, rsi
call fcn.140004ad4
mov r13, rax
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
cmp qword [rbx + 0x18], 0x10
jb 0x140001b58
mov rbx, qword [rbx]
mov rcx, r13
sub rcx, rbx
nop
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140001b60
and edi, 0xf
mov edx, 0x10
sub edx, edi
test edx, edx
jle 0x140001b93
movsxd rax, ebp
shl rax, 4
mov ecx, edi
add rax, r13
add rcx, rax
mov r8d, edx
call sub.VCRUNTIME140.dll_memset
movsxd r14, r14d
mov byte [r14 + r13], 0
mov rcx, rsi
call fcn.140004ad4
mov rbp, rax
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rax, vtable.AES.0
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x38], 0
xor ebx, ebx
mov qword [rsp + 0x3fc], rbx
mov dword [rsp + 0x404], ebx
mov r8, r15
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.1400043a0
movzx r8d, byte [rsp + 0x38]
test r8b, r8b
je 0x140001cc0
test r14, r14
je 0x140001cc0
movsxd r9, dword [rsp + 0x400]
xor edx, edx
mov rax, r14
div r9
test rdx, rdx
jne 0x140001cc0
mov esi, ebx
mov rbx, r13
mov rdi, rbp
test rax, rax
je 0x140001cc0
nop word [rax + rax]
lea rax, [rsp + 0x428]
test r8b, r8b
je 0x140001c68
xor edx, edx
test r9d, r9d
jle 0x140001c68
lea rcx, [rsp + 0x428]
mov r8, rbx
sub r8, rcx
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
inc edx
cmp edx, dword [rsp + 0x400]
jl 0x140001c52
mov r8, rdi
lea rdx, [rsp + 0x428]
lea rcx, [rsp + 0x30]
call fcn.140003cf0
movsxd r8, dword [rsp + 0x400]
mov rdx, rdi
lea rcx, [rsp + 0x428]
call sub.VCRUNTIME140.dll_memcpy
movsxd r9, dword [rsp + 0x400]
add rbx, r9
add rdi, r9
inc esi
xor edx, edx
mov rax, r14
div r9
movsxd rcx, esi
cmp rcx, rax
jae 0x140001cc0
movzx r8d, byte [rsp + 0x38]
jmp 0x140001c30
mov r8d, dword [rsp + 0x4f8]
mov rdx, rbp
mov rcx, qword [rsp + 0x4f0]
call fcn.140002c20
mov rcx, r13
call fcn.14000481c
mov rcx, rbp
call fcn.14000481c
nop
mov rax, qword [rsp + 0x4f0]
mov rbx, qword [rsp + 0x500]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140001b18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b64
xor al, al
add rsp, 0x28
ret

Function at 0x1415c0898
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1415c0a1f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1415c08c9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415c08af
add dl, dl
jne 0x1415c08d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415c0936
xor eax, eax
add dl, dl
jne 0x1415c08e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1415c09ed
add dl, dl
jne 0x1415c08f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415c0903
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415c0910
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415c091d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1415c092a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1415c08be
mov eax, 1
add dl, dl
jne 0x1415c0946
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1415c0953
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415c093b
sub eax, ebx
mov ebx, 1
jne 0x1415c098c
mov ecx, 1
add dl, dl
jne 0x1415c096e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415c097b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415c0963
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415c08be
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1415c09a8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1415c09b5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1415c099d
cmp eax, 0x7d00
jae 0x1415c09db
cmp eax, 0x500
jb 0x1415c09d6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415c08be
cmp eax, 0x7f
ja 0x1415c09de
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1415c08be
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1415c0a12
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1415c08be
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180ea35e8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x180ea35f2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x180ea361b
pop rbp
sub rbp, 0x33
sub rbp, 0xea35e8
cmp edx, 1
je 0x180ea365e
ldmxcsr dword [rsp]
add rsp, 8
popfq
pop r15
pop r14
pop r13
pop r12
pop r11
pop r10
pop r9
pop r8
pop rdi
pop rsi
pop rbp
pop rbx
pop rdx
pop rcx
pop rax
xor rax, rax
ret
sub rsp, 0x20
jmp 0x180ea366e
mov rax, 0xea35e8
add rax, rbp
add rax, 0xb8
mov rcx, 0x60b
mov rdx, 0xffffffffd7636f02
xor byte [rax], dl
inc rax
dec rcx
jne 0x180ea368d
jmp 0x180ea36a4
mov rbp, rbx
mov dword [rbx + 0x202023e], ecx
add rbx, 0xa
add eax, dword [rdx]
add cl, byte [rdx + 3]
jmp 0x180ea3702
invalid
Function at 0x6a0f00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x6a0f0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x6a0f1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x6a0f05
lea eax, [rcx + 1]
jmp 0x6a0f2b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x6a0f3e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x6a0f24
sub eax, 3
jb 0x6a0f5e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x6a0fad
sar eax, 1
movsxd rbp, eax
jb 0x6a0f94
jmp 0x6a0f6c
add ebx, ebx
jne 0x6a0f6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6a0f94
inc ecx
add ebx, ebx
jne 0x6a0f7a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x6a0f94
call r11
adc ecx, ecx
add ebx, ebx
jne 0x6a0f8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x6a0f7c
add ecx, 2
jmp 0x6a0f99
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.006a0ec2
jmp 0x6a0f0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x105000
mov dl, 0x29
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x6a0ff9
cmp rsi, rcx
jae 0x6a1001
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x6a0fe0
cmp al, 0x8f
ja 0x6a0fe0
cmp byte [rsi - 2], 0xf
je 0x6a0fe6
sub al, 0xe8
cmp al, 1
ja 0x6a0fca
cmp rsi, rcx
jae 0x6a1001
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x6a0fd0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x6a1001
lodsb al, byte [rsi]
jmp 0x6a0fe0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x29c000]
mov eax, dword [rdi]
or eax, eax
je 0x6a105e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2a52f8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x6a100e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x6a1058
mov qword [rbx], rax
add rbx, 8
jmp 0x6a102e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x6a10a2
cmp al, 0xef
ja 0x6a108a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x6a106a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x6a1079
mov eax, dword [rdi]
add rdi, 4
jmp 0x6a1079
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x6a10f6
sub rsp, 0xffffffffffffff80
jmp 0x4648e0
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x30], 0
jmp 0x140001021
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x30], eax
jae 0x140001034
cmp dword [rsp + 0x30], 0x64
jae 0x140001034
jmp 0x140001017
mov eax, dword [rsp + 0x58]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140002070
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140001ee0
Function at 0x140004428
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000b4d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140002f54
xor ebx, ebx
cmp qword [0x14000cab8], rbx
mov rdi, rax
jne 0x14000453b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140004612
lea rdx, [0x140007f68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004612
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000cab8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000cac0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000cac8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000cad8], rax
test rax, rax
je 0x140004532
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000cad0], rax
jmp 0x140004542
mov rax, qword [0x14000cad0]
jmp 0x140004549
mov rax, qword [0x14000cad0]
mov r11, qword [0x14000cad8]
cmp rax, rdi
je 0x1400045b0
cmp r11, rdi
je 0x1400045b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000cad8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400045b0
test rax, rax
je 0x1400045b0
call rsi
test rax, rax
je 0x1400045aa
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400045aa
test byte [rsp + 0x40], 1
jne 0x1400045b0
bts ebp, 0x15
jmp 0x1400045f0
mov rcx, qword [0x14000cac0]
cmp rcx, rdi
je 0x1400045f0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400045f0
call rax
mov rbx, rax
test rax, rax
je 0x1400045f0
mov rcx, qword [0x14000cac8]
cmp rcx, rdi
je 0x1400045f0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400045f0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000cab8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140004612
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140004614
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140004860
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400058cf
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000b4d0]
jne 0x14000487a
rol rcx, 0x10
test cx, 0xffff
jne 0x140004876
repz ret
ror rcx, 0x10
jmp 0x140005828
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000cc10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000cd08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400058ad
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000cc10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400058cf
mov rax, qword [rsp + 0x88]
mov qword [0x14000cd08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000cca8], rax
mov rax, qword [0x14000cd08]
mov qword [0x14000cb80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000cc90], rax
mov dword [0x14000cb70], 0xc0000409
mov dword [0x14000cb74], 1
mov rax, qword [0x14000b4d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000b4d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000cc08], eax
mov ecx, 1
call fcn.14000570c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140008c68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000cc08], 0
jne 0x140005956
mov ecx, 1
call fcn.14000570c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14005fe6c
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x14005feb4
lea ebx, [rsi + 0xd]
jmp 0x14005ff1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
jne 0x14005ff1f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14003cffc
lea r8, [rbp + 0x30]
mov rdx, qword [rbp - 0x20]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14005ff11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14005ff1f
mov rdx, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1400033fc
mov ebx, esi
lea rcx, [rbp - 0x20]
call fcn.1400174fc
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140060a48
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400bd0c0], eax
call fcn.140060cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400bd0c0], 0
jne case.default.0x140060a9e
mov ecx, 1
call fcn.140060cf8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
adc eax, 0xed9f6872
and cl, byte [rax - 0x29]
and dword [rax + 0x14], eax
mov word [rsi - 0x37bdfd4e], ds
jbe 0x140125f08
invalid
idiv ebp
xchg ecx, eax
outsd dx, dword [rsi]
imul edx, dword [rdx - 0x482fe4d7], 0xffffffd1
invalid
push rsi
int 0x3b
jb 0x140125eee
cmc
mov ebx, 0x2f8d381b
mov bl, 0xfb
test al, 3
invalid
Function at 0x4047a0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x90], rax
jne 0x404944
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x30]
nop
inc dword [rcx + 0x244]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov rdx, qword [rcx + 0x30]
nop
mov rbx, rcx
mov qword [rdx + 0x138], rcx
mov rcx, qword [rbx + 0x30]
mov qword [rbx + 0xd8], rcx
mov rcx, qword [rax + 0x30]
movups xmm0, xmmword [rcx + 0x2e0]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x2f0]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x300]
movups xmmword [rsp + 0x40], xmm0
mov rcx, qword [rax + 0x70]
mov qword [rsp + 0x50], rcx
mov rdx, qword [rax + 0x78]
mov qword [rsp + 0x18], rdx
call fcn.00466b40
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov byte [rcx + 0xe8], 0
mov rcx, qword [rax + 0x30]
xor edx, edx
xchg dword [rcx + 0x350], edx
mov rcx, qword [rsp + 0x78]
mov qword [rsp], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 8], rcx
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x10], rcx
call fcn.004049a0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x30]
mov qword [rsp + 0x58], rcx
jmp 0x4048cf
nop
mov rax, qword [0x00799708]
mov qword [rsp], rax
mov dword [rsp + 8], 0
call fcn.0046d740
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, rax
xor eax, eax
mov ebx, 1
lock cmpxchg dword [rcx + 0x350], ebx
sete sil
test sil, sil
je 0x4048ac
mov rax, qword [rdx + 0x30]
mov byte [rax + 0xe8], 1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
call fcn.00443540
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x2e0], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rax + 0x2f0], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x300], xmm0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.0043a5e0
lea rax, [0x0064526e]
mov qword [rsp], rax
mov qword [rsp + 8], 0x1e
nop dword [rax]
call fcn.0043b060
call fcn.0043a680
mov dword [rsp], 2
call fcn.004344e0
mov rax, qword [rsp + 0x60]
nop dword [rax + rax]
jmp 0x4047d4