joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005fb98
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x141158270]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x141154470]
test eax, eax
je 0x14005fbe3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141154470]
test eax, eax
jne 0x14005fbec
call fcn.140028e8c
test eax, eax
je 0x14005fc08
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14114be78]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14005fc10
xor eax, eax
jmp 0x14005fc75
test rbx, rbx
jne 0x14005fc30
lea rcx, str.DestroyPropertySheetPage
call fcn.14005fd8c
mov rbx, rax
test rax, rax
je 0x14005fc43
mov qword [0x141158270], rax
mov rcx, rbx
call fcn.1401d9204
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14005fc58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14005fc5a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14005fc73
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14005fc8c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x141158278]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x141154470]
test eax, eax
je 0x14005fcdb
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141154470]
test eax, eax
jne 0x14005fce4
call fcn.140028e8c
test eax, eax
je 0x14005fd00
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14114be78]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14005fd0a
or rax, 0xffffffffffffffff
jmp 0x14005fd74
test rbx, rbx
jne 0x14005fd2a
lea rcx, str.PropertySheetW
call fcn.14005fd8c
mov rbx, rax
test rax, rax
je 0x14005fd3f
mov qword [0x141158278], rax
mov rcx, rbx
call fcn.1401d9204
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x14005fd56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14005fd58
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14005fd71
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400644c4
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1411582f0]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x141154470]
test eax, eax
je 0x14006450f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141154470]
test eax, eax
jne 0x140064518
call fcn.140028e8c
test eax, eax
je 0x140064534
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14114be78]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14006453c
xor eax, eax
jmp 0x1400645a1
test rbx, rbx
jne 0x14006455c
lea rcx, str.GetOpenFileNameW
call fcn.140036cd4
mov rbx, rax
test rax, rax
je 0x14006456f
mov qword [0x1411582f0], rax
mov rcx, rbx
call fcn.1401d9204
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140064584
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x140064586
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006459f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400645b8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x1411582f8]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x141154470]
test eax, eax
je 0x140064603
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141154470]
test eax, eax
jne 0x14006460c
call fcn.140028e8c
test eax, eax
je 0x140064628
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14114be78]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x140064630
xor eax, eax
jmp 0x140064695
test rbx, rbx
jne 0x140064650
lea rcx, str.GetSaveFileNameW
call fcn.140036cd4
mov rbx, rax
test rax, rax
je 0x140064663
mov qword [0x1411582f8], rax
mov rcx, rbx
call fcn.1401d9204
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x140064678
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14006467a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x140064693
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140070064
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x140070096
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140070096
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.14007cab8
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400700a8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400700d3
mov r8, rdx
mov rdx, qword [rdi]
call fcn.14005201c
jmp 0x14007014b
cmp byte [0x141158380], 0
jne 0x14007011a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007010a
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x141158378], rax
jmp 0x140070111
mov rbx, qword [0x141158378]
mov byte [0x141158380], 1
jmp 0x140070121
mov rbx, qword [0x141158378]
test rbx, rbx
je 0x14007013f
mov rcx, rbx
call fcn.1401d9204
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
call rbx
jmp 0x14007014b
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a4968
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x1400a4999
call fcn.14002b4a8
mov rdi, qword [rax + 0x18]
lea r8, [0x140237058]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
test rax, rax
jne 0x1400a49b8
xor eax, eax
jmp 0x1400a4a04
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400a49b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400a49f9
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.1400a4a20
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400a7668
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x141158e08]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x141154470]
test eax, eax
je 0x1400a76b3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141154470]
test eax, eax
jne 0x1400a76bc
call fcn.140028e8c
test eax, eax
je 0x1400a76d8
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14114be78]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400a76e0
xor eax, eax
jmp 0x1400a7745
test rbx, rbx
jne 0x1400a7700
lea rcx, str.ImageList_GetImageCount
call fcn.140028870
mov rbx, rax
test rax, rax
je 0x1400a7713
mov qword [0x141158e08], rax
mov rcx, rbx
call fcn.1401d9204
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400a7728
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400a772a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400a7743
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14012d20c
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14012d3dc
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
test eax, eax
jne 0x14012d41e
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x14012d8a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14012d97a
test rbx, rbx
je 0x14012d980
test r9, r9
je 0x14012d986
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14012d963
cmp dword [rsp + 0x48], 3
jne 0x14012d963
test eax, eax
jne 0x14012d963
cmp dword [rdi], eax
je 0x14012d963
mov ecx, dword [rdi]
call fcn.14001d34c
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14012d957
cmp dword [rsp + 0x48], 3
jne 0x14012d957
test eax, eax
jne 0x14012d957
mov eax, 1
jmp 0x14012d965
mov rcx, qword [rbx]
call fcn.14001d344
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.14001d378
int3
call fcn.14001d378
int3
call fcn.14001d378
int3

Function at 0x14012dcb0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14012dcc1
xor eax, eax
jmp 0x14012dcef
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14012dcf8
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14012dd09
xor eax, eax
jmp 0x14012dd2d
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14018a5a8
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14115cb18]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x141154470]
test eax, eax
je 0x14018a5f3
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x141154470]
test eax, eax
jne 0x14018a5fc
call fcn.140028e8c
test eax, eax
je 0x14018a618
lea rdx, [rsp + 0x48]
mov rcx, qword [0x14114be78]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14018a620
xor eax, eax
jmp 0x14018a685
test rbx, rbx
jne 0x14018a640
lea rcx, str.ChooseColorW
call fcn.140036cd4
mov rbx, rax
test rax, rax
je 0x14018a653
mov qword [0x14115cb18], rax
mov rcx, rbx
call fcn.1401d9204
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14018a668
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14018a66a
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14018a683
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1401f4750
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1401f45e3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401f45e3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401f45e3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401f45e3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401f45e3
cmp dword [rcx + 0x84], 0xe
jbe 0x1401f45e3
cmp dword [rcx + 0xf8], 0
je 0x1401f45e3
mov ecx, ebx
call fcn.1401f4684
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1401f4474
cmp dword [rbp + 0x20], 0
je 0x1401f4630
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401f4638
int3
xor r8d, r8d
xor edx, edx
jmp 0x1401f457c
Function at 0x1400033d8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003422
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003422
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003422
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003422
cmp dword [rcx + 0x84], 0xe
jbe 0x140003422
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003424
xor al, al
add rsp, 0x28
ret
Function at 0x1400010f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x280
mov rax, qword [0x140005040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x30], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001151
lea rcx, str.____CreateSnapshot_Failed..._n
call fcn.140001020
mov eax, 0xffffffff
jmp 0x140001276
lea rcx, str.___CreateSnapshot_Done..._n
call fcn.140001020
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebx, eax
lea rcx, str.___Enum_process_pid_now__n
call fcn.140001020
test ebx, ebx
je 0x14000126b
xor r14d, r14d
lea ebp, [r14 - 1]
nop dword [rax + rax]
mov ecx, 0x18
call fcn.140001768
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400011d7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r14
mov dword [rbx + 0x10], 1
lea rcx, [rsp + 0x5c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14000131a
jmp 0x1400011da
mov rbx, r14
mov qword [rsp + 0x28], rbx
test rbx, rbx
je 0x14000130f
mov rdi, qword [rbx + 8]
test rdi, rdi
jne 0x140001200
mov rcx, qword [rbx]
call fcn.140001490
mov rdi, rax
mov qword [rbx + 8], rax
lea rdx, str.rdpclip.exe
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
mov rcx, rsi
test eax, eax
je 0x1400012a4
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov edi, eax
mov ecx, ebp
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140001263
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001244
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001256
call fcn.140001760
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140001760
test edi, edi
jne 0x140001190
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140001740
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, rdi
lea rcx, [0x140003434]
call fcn.140001020
mov edx, dword [rsp + 0x38]
lea rcx, str.___Pid_Found___d_n
call fcn.140001020
mov edi, dword [rsp + 0x38]
lock xadd dword [rbx + 0x10], ebp
cmp ebp, 1
jne 0x140001308
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400012e9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400012fb
call fcn.140001760
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140001760
mov eax, edi
jmp 0x140001276
mov ecx, 0x8007000e
call fcn.140001480
nop
mov ecx, 0x8007000e
call fcn.140001480
int3
Function at 0x140001330
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
sub rsp, 0x48
lea rcx, str.___Starting..._n
call fcn.140001020
call fcn.1400010f0
test eax, eax
jne 0x14000135c
lea rcx, str.____Pid_not_Found__n
call fcn.140001020
xor eax, eax
add rsp, 0x48
ret
mov r8d, eax
mov qword [rsp + 0x50], rbx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001391
mov rbx, qword [rsp + 0x50]
lea rcx, str.____OpenProcess_Failed..._n
call fcn.140001020
xor eax, eax
add rsp, 0x48
ret
lea rcx, str.___OpenProcess_Success..._n
mov qword [rsp + 0x40], rdi
call fcn.140001020
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov rcx, rbx
lea r8d, [rdx + 0x16]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x1400013d3
lea rcx, str.____VirtualAllocEx_Fail
jmp 0x140001466
lea rcx, str.___VirtualAllocEx_Done__n
call fcn.140001020
mov r9d, 0x16
mov qword [rsp + 0x20], 0
lea r8, str.C:Windowswinhlp.dll
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.___WriteProcessMemory_Done__n
call fcn.140001020
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.LoadLibraryA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
lea rcx, str.____CreateRemoteThread_Fail_n
lea rdx, str.___Inject_Success__n
cmovne rcx, rdx
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
call fcn.140001020
xor eax, eax
add rsp, 0x48
ret

Function at 0x140002284
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400022ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400022ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400022ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400022ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400022ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400022d0
xor al, al
add rsp, 0x28
ret
Function at 0x180009a3c
Capabilities:
Hash data using fnv

Disassembly:
mov r10, qword [0x1801b5a70]
movabs rcx, 0xcbf29ce484222325
mov dword [rsp + 0x10], edx
xor r8d, r8d
mov r9, qword [r10 + 0x1c0]
movzx eax, byte [rsp + r8 + 0x10]
movabs r11, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r11
cmp r8, 4
jb 0x180009a5b
mov r8, qword [r10 + 0x1e8]
and r8, rcx
mov rcx, qword [r10 + 0x1d0]
add r8, r8
mov rax, qword [rcx + r8*8 + 8]
cmp rax, r9
je 0x180009aaf
mov rcx, qword [rcx + r8*8]
jmp 0x180009aa8
cmp rax, rcx
je 0x180009aaf
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180009a9f
jmp 0x180009ab1
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
setne al
ret