joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14026a050
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
jne 0x14026a0e2
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x14026a115
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x14026a0d0
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401af190
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
test r12, r12
je 0x14026a1c7
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ad700
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x14026a1f3
lea rcx, [r15*8]
call fcn.1401abf00
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x14026a192
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x14026a1c7
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14026a17a
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.1401e9480
mov r12, qword [rsi + 0x10]
jmp 0x14026a0e2
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401f6bb0
call fcn.1401e8fd0
int3
Function at 0x14026a200
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14026a25f
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x14026a370
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ad700
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x14026a2ba
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x14026a2a9
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401af190
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14026a22e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
lea rax, [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x14026a39c
lea rcx, [r12*8]
call fcn.1401abf00
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x14026a33b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x14026a370
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14026a323
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1401e9480
mov r15, qword [rsi + 8]
jmp 0x14026a22e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401f6bb0
call fcn.1401e8fd0
int3
Function at 0x14026a3b0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
jne 0x14026a442
mov r14, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r14
jbe 0x14026a475
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x14026a430
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1401af190
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
mov r12, r14
test r12, r12
je 0x14026a527
mov rax, qword [rdi]
mov qword [r12], rax
add qword [rsi + 0x10], 8
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401ad700
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r12
sub rax, r14
sar rax, 2
cmp r12, r14
mov r15d, 1
cmovne r15, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x50], rax
mov rax, r15
shr rax, 0x3d
jne 0x14026a553
lea rcx, [r15*8]
call fcn.1401abf00
mov rdx, r15
and rdx, 0xfffffffffffffffc
mov rcx, r12
sub rcx, rbx
mov r9, r12
lea rdx, [rax + rdx*2]
mov r8, rdx
sub r9, rbx
je 0x14026a4f2
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x14026a527
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14026a4da
lea r9, [rax + r15*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x30]
mov qword [rcx], r14
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r12
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r12
call fcn.1401e9480
mov r12, qword [rsi + 0x10]
jmp 0x14026a442
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401f6bb0
call fcn.1401e8fd0
int3
Function at 0x14026a560
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, qword [rcx + 8]
cmp rbx, qword [rcx]
je 0x14026a5bf
mov r15, rbx
add r15, 0xfffffffffffffff8
je 0x14026a6d0
mov rax, qword [rdi]
mov qword [r15], rax
add qword [rsi + 8], 0xfffffffffffffff8
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401ad700
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r14, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
cmp r14, r15
jae 0x14026a61a
sub r15, r14
sar r15, 3
lea rax, [r15 + 1]
shr rax, 0x3f
lea r12, [r15 + rax]
inc r12
sar r12, 1
lea r15, [r14 + r12*8]
mov rax, r14
sub rax, rbx
sub r15, rax
sub r14, rbx
je 0x14026a609
mov rcx, r15
mov rdx, rbx
mov r8, r14
call fcn.1401af190
mov rbx, qword [rsi + 0x10]
mov qword [rsi + 8], r15
lea rax, [rbx + r12*8]
mov qword [rsi + 0x10], rax
jmp 0x14026a58e
mov rax, r15
sub rax, rbx
sar rax, 2
cmp r15, rbx
mov r12d, 1
cmovne r12, rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x48], rax
mov rax, r12
shr rax, 0x3d
jne 0x14026a6fc
lea rcx, [r12*8]
call fcn.1401abf00
lea rdx, [r12*2 + 6]
and rdx, 0xfffffffffffffff8
add rdx, rax
mov rcx, r14
sub rcx, rbx
mov r9, r14
mov r8, rdx
sub r9, rbx
je 0x14026a69b
sar rcx, 3
lea r8, [r9 + rdx]
shl rcx, 3
xor r9d, r9d
mov r10, rdx
add r10, r9
je 0x14026a6d0
mov r11, qword [rbx + r9]
mov qword [r10], r11
add r9, 8
cmp rcx, r9
jne 0x14026a683
lea r9, [rax + r12*8]
mov qword [rsi], rax
lea rcx, [rsp + 0x28]
mov qword [rcx], rbx
mov qword [rsi + 8], rdx
mov qword [rcx + 8], rbx
mov qword [rsi + 0x10], r8
mov qword [rcx + 0x10], r14
mov qword [rsi + 0x18], r9
mov qword [rcx + 0x18], r15
call fcn.1401e9480
mov r15, qword [rsi + 8]
jmp 0x14026a58e
lea rax, str.null_pointer_given_to_construct_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__location___nullptr
mov r8d, 0x28
call fcn.1401f6bb0
call fcn.1401e8fd0
int3

Function at 0x1402788a0
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x1402788ee
cmp byte [rcx], 0x4d
jne 0x1402788ee
cmp byte [rcx + 1], 0x5a
jne 0x1402788ee
mov r9d, dword [rcx + 0x3c]
mov r10, rdx
sub r10, r9
xor eax, eax
cmp r10, 0x18
jb 0x1402788f0
cmp rdx, r9
jbe 0x1402788f0
cmp r9d, 0x40
jb 0x1402788f0
mov r10d, r9d
and r10d, 7
jne 0x1402788f0
cmp byte [rcx + r9], 0x50
jne 0x1402788ee
cmp byte [rcx + r9 + 1], 0x45
jne 0x1402788ee
cmp byte [rcx + r9 + 2], 0
je 0x1402788f1
xor eax, eax
ret
cmp byte [rcx + r9 + 3], 0
jne 0x1402788ee
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x1402788f0
cmp rdx, 2
jb 0x1402788f0
cmp word [rcx + r9], r8w
sete al
jmp 0x1402788f0
Function at 0x140288be0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140288c40
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401ad700
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140295e60
Capabilities:
Decompress data using quicklz

Disassembly:
mov r8d, dword [rdx]
mov eax, r8d
and eax, 0xf800d000
xor eax, 0xf0008000
mov r9d, r8d
not r9d
test r9d, 0x3c00000
setne r9b
mov r10d, ecx
and r10d, 1
or r10d, eax
sete r10b
lea eax, [rcx + 0x100000]
cmp eax, 0x200000
setb al
and al, r9b
and al, r10b
cmp al, 1
jne 0x140295eff
mov r9d, ecx
shr r9d, 1
and r9d, 0x7ff
and r8d, 0xfbc0d000
mov r10d, ecx
shl r10d, 6
and r10d, 0x4000000
mov r11d, ecx
shl r11d, 4
and r11d, 0x3f0000
or r11d, r10d
mov r10d, ecx
shr r10d, 5
and r10d, 0x2000
or r10d, r11d
shr ecx, 8
and ecx, 0x800
or ecx, r10d
or ecx, r9d
or ecx, r8d
mov dword [rdx], ecx
ret

Function at 0x140295f90
Capabilities:
Decompress data using quicklz

Disassembly:
mov eax, edx
or eax, ecx
test al, 1
je 0x140295f9b
xor eax, eax
ret
sub edx, ecx
mov eax, edx
and eax, 1
lea ecx, [rdx + rax]
add ecx, 0xfffffffc
mov rdx, r8
jmp fcn.140295e60
Function at 0x140299d60
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1402af0f0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401e8d80
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14029ea70
test al, al
je 0x140299eb5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140299e2d
mov rcx, r14
call fcn.1401e8d80
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14029ea70
test al, al
je 0x140299e76
cmp dword [rbx], 0x4550
jne 0x140299ee6
mov sil, 1
test rdi, rdi
je 0x140299ec5
mov qword [rdi], r14
jmp 0x140299ec5
mov ecx, 1
call fcn.14018cad0
test al, al
je 0x140299ec3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400ff950
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140299f5a
mov ecx, 1
call fcn.14018cad0
test al, al
je 0x140299ec3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400ff950
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140299f54
mov ecx, 1
call fcn.14018cad0
test al, al
jne 0x140299f28
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14018cad0
test al, al
je 0x140299ec3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400ff950
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140299f5a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400ff950
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401e9050
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140299f6f
and r8d, 0x7f
jmp 0x140299f76
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401e9050
mov rcx, rdi
call fcn.1400fffa0
jmp 0x140299ec3
Function at 0x140299f90
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1402ea038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1402af0f0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401e8d80
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14029ea70
test al, al
je 0x14029a0e5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14029a05d
mov rcx, r14
call fcn.1401e8d80
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14029ea70
test al, al
je 0x14029a0a6
cmp dword [rbx], 0x4550
jne 0x14029a116
mov sil, 1
test rdi, rdi
je 0x14029a0f5
mov qword [rdi], r14
jmp 0x14029a0f5
mov ecx, 1
call fcn.14018cad0
test al, al
je 0x14029a0f3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400ff950
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14029a18a
mov ecx, 1
call fcn.14018cad0
test al, al
je 0x14029a0f3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400ff950
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x14029a184
mov ecx, 1
call fcn.14018cad0
test al, al
jne 0x14029a158
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401ad700
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.14018cad0
test al, al
je 0x14029a0f3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400ff950
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14029a18a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400ff950
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401e9050
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14029a19f
and r8d, 0x7f
jmp 0x14029a1a6
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401e9050
mov rcx, rdi
call fcn.1400fffa0
jmp 0x14029a0f3
Function at 0x140011140
Capabilities:
Create thread

Disassembly:
jmp 0x140013110
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x14002806d]
call fcn.1400115d7
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400111cc
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.140011311
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.140011163
nop
lea rcx, [rbp + 0x108]
call fcn.14001127b
lea rax, [0x14001141a]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.14001143d
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x140013210
lea rcx, [rbp + 8]
call fcn.140011294
jmp 0x140013229
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.140011177
nop
lea rcx, [rbp + 8]
call fcn.14001127b
lea rcx, [rbp - 0x30]
lea rdx, [0x14001dd00]
call fcn.140011528
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1400112f3
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x140011361
Capabilities:
Terminate process

Disassembly:
jmp 0x140016970
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011442
Capabilities:
Log keystrokes via application hook

Disassembly:
jmp 0x140014490
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x1400280fa]
call fcn.1400115d7
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14001188e]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbp + 8], rax
lea rdx, [0x140011811]
lea rcx, [rbp + 0x28]
call fcn.1400112a8
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x58]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140014526
lea rcx, [rbp + 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400144fa
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea rcx, [rbp + 0x28]
call fcn.140011005
mov dword [rbp + 0x164], 0
lea rcx, [rbp + 0x28]
call fcn.1400112b2
mov eax, dword [rbp + 0x164]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001dca0]
call fcn.140011528
mov eax, edi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1400112f3
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140011451
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017cc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017ce0
xor al, al
jmp 0x140017d61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017cf3
xor al, al
jmp 0x140017d61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140017d1d
xor al, al
jmp 0x140017d61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017d31
xor al, al
jmp 0x140017d61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017d43
xor al, al
jmp 0x140017d61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140017d5f
xor al, al
jmp 0x140017d61
mov al, 1
add rsp, 0x38
ret
Function at 0x140001770
Capabilities:
Reference http user-agent string

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14027dea0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x38], 0x10
lea r8, [rcx + 0x20]
mov rbx, rcx
jb 0x140001796
mov r8, qword [r8]
mov rcx, qword [rcx + 8]
mov edx, 0x2712
call fcn.1401866b0
lea rdx, str.Mozilla_5.0__Macintosh__Intel_Mac_OS_X_10.6__rv:2.0.1__Gecko_20100101_Firefox_4.0.1
lea rcx, [rsp + 0x20]
mov r8d, 0x53
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
call fcn.140001610
cmp qword [rsp + 0x38], 0x10
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x20]
mov edx, 0x2722
cmovae r8, qword [rsp + 0x20]
call fcn.1401866b0
mov rcx, qword [rbx + 8]
mov edx, 0x44
lea r8d, [rdx - 0x3f]
call fcn.1401866b0
mov rcx, qword [rbx + 8]
mov edx, 0x34
lea r8d, [rdx - 0x33]
call fcn.1401866b0
mov rcx, qword [rbx + 8]
mov edx, 0x63
lea r8d, [rdx - 0x62]
call fcn.1401866b0
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x2f]
call fcn.1401866b0
mov rcx, qword [rbx + 8]
lea r8, [0x140001110]
mov edx, 0x4e2b
call fcn.1401866b0
mov rcx, qword [rbx + 8]
mov r8, rbx
mov edx, 0x2711
call fcn.1401866b0
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x40]
call fcn.1401866b0
mov rcx, qword [rbx + 8]
xor r8d, r8d
lea edx, [r8 + 0x51]
call fcn.1401866b0
cmp qword [rsp + 0x38], 0x10
jb 0x14000188f
mov rcx, qword [rsp + 0x20]
call fcn.14000cfcc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14016c130
add rsp, 0x50
pop rbx
ret
Function at 0x140002da0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rsi, rdx
mov rbx, rcx
xor ebp, ebp
call fcn.140002d80
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
lea rdx, [0x1401d8fe8]
repne scasb al, byte [rdi]
not rcx
lea r13, [rcx - 1]
mov rcx, rbx
call fcn.14016c228
lea rdx, [0x1401d7e94]
mov rcx, rsi
mov rdi, rax
call fcn.14016c228
mov rcx, rdi
mov rbx, rax
call fcn.14016cb88
test eax, eax
jne 0x140002e66
nop word [rax + rax]
mov edx, 1
lea rcx, [rsp + 0x58]
mov r9, rdi
mov r8d, edx
call fcn.14016cb68
mov rcx, rdi
call fcn.14016cb88
test eax, eax
jne 0x140002e5a
mov eax, ebp
mov r9, rbx
cdq
idiv r13d
movsxd rax, edx
mov edx, 1
movzx ecx, byte [rax + r12]
mov r8d, edx
xor byte [rsp + 0x58], cl
lea rcx, [rsp + 0x58]
call fcn.14016b820
inc ebp
mov rcx, rdi
call fcn.14016cb88
test eax, eax
je 0x140002e10
mov rcx, rdi
call fcn.14016b92c
mov rcx, rbx
call fcn.14016b92c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x140002e90
Capabilities:
Delete file

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x160
mov rax, qword [0x14027dea0]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbp, rdx
mov rdi, rcx
lea rdx, [0x1401e8959]
mov rcx, rbp
call fcn.14000ce20
mov rbx, rax
test rax, rax
je 0x140002ef5
mov rdx, rdi
mov rcx, rax
call fcn.14000ad30
mov rcx, rbx
test eax, eax
jne 0x140002ef0
lea r8, [rsp + 0x20]
or edx, 0xffffffff
call fcn.14000acd0
test eax, eax
je 0x140002ef9
mov rcx, rbx
call fcn.14000ceb0
xor eax, eax
jmp 0x140002f52
mov qword [rsp + 0x190], rsi
mov esi, dword [rsp + 0x20]
xor edi, edi
test esi, esi
jle 0x140002f34
nop dword [rax + rax]
lea r8, [rsp + 0x20]
mov edx, edi
mov rcx, rbx
call fcn.14000acd0
lea r8, [rsp + 0x24]
mov edx, edi
mov rcx, rbx
call fcn.14000ce90
inc edi
cmp edi, esi
jl 0x140002f10
mov rcx, rbx
call fcn.14000ceb0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rsi, qword [rsp + 0x190]
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14016c130
add rsp, 0x160
pop rdi
pop rbp
pop rbx
ret