joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000af50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x18000af83
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18000afc7
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x18000afc2
cmp rbx, r11
jae 0x18000afc7
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x18000afb0
cmp rbx, r11
jb 0x18000afcb
xor eax, eax
jmp 0x18000afd7
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18000b930
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x180067cd0], 0
mov rdi, rdx
mov rbx, rcx
jne 0x18000b98b
lea rcx, [0x180051fd0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000b97b
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [0x180067cd0], 1
mov qword [0x180067cd8], rax
jmp 0x18000b992
mov rax, qword [0x180067cd8]
mov byte [0x180067cd0], 1
jmp 0x18000b992
mov rax, qword [0x180067cd8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x18000b9b1
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]

Function at 0x18000b9d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
mov r12, rcx
test r8, r8
jne 0x18000ba03
lea eax, [r8 + 0xd]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
xor edi, edi
mov rbx, r8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea rbx, [rbx + rax*2]
lea edi, [rdi + rax*2]
cmp eax, 1
jne 0x18000ba12
mov rcx, qword [r12]
lea r9d, [rax + 6]
xor r8d, r8d
mov rdx, rbp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret
Function at 0x18000ba70
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180060ef8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x18000bbbc
test rcx, rcx
je 0x18000bae5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
and edi, 0x300
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], edi
test ebx, ebx
jne 0x18000bbbc
xor edi, edi
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x18000bb91
nop word [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.18000ba70
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test eax, eax
jne 0x18000bbbc
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x18000bb40
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18000bba6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rdi
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x50], edi
call fcn.18000b930
mov rcx, qword [rsp + 0x48]
mov ebx, eax
test rcx, rcx
je 0x18000bbc7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.18002fe70
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000c1c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x4b0], rbx
mov rax, qword [0x180060ef8]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rsi, r9
mov rbx, r8
mov rax, rdx
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x70], r12
xor edx, edx
lea r8d, [r12 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x18000c238
call fcn.18000b660
mov ebx, eax
jmp 0x18000c37a
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x18000c25b
call fcn.18000b660
mov ebx, eax
jmp 0x18000c370
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x18000c280
call fcn.18000b660
mov ebx, eax
jmp 0x18000c370
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x18000c2b9
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18000c2af
lea rcx, [rsp + 0x70]
call fcn.18000e700
nop
mov eax, 0x8007000e
jmp 0x18000c393
mov ecx, eax
test eax, eax
je 0x18000c2f6
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x18000c2ec
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x18000c2f6
lea rcx, [rsp + 0x70]
call fcn.18000e710
mov rax, qword [rsp + 0x70]
jmp 0x18000c300
mov ecx, 0x80070057
call fcn.180002080
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x18000c318
test rax, rax
jne 0x18000c324
mov ebx, 0x8007000e
jmp 0x18000c370
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x18000c34b
call fcn.18000b660
mov ebx, eax
jmp 0x18000c370
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], r12w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.18000d200
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x18000c391
lea rcx, [rsp + 0x70]
call fcn.18000e700
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18002fe70
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x18000f780
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rdi, r9
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.18000b530
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.18000e970
nop
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x98]
add dword [r11], edi
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.18000f5d0
mov r11, qword [rsp + 0x40]
mov esi, dword [r11 - 0x10]
mov rcx, qword [rsp + 0x50]
add esi, dword [rcx - 0x10]
add esi, edi
lea rdx, [rcx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000f874
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000f894
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x18000f8b5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
jmp 0x18000f8b7
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180011380
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rcx + 0x18]
mov rsi, rdx
mov rcx, rbp
call fcn.1800120f0
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
je 0x180011424
mov ecx, dword [rsp + 0x40]
inc ecx
call fcn.180030d98
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x50]
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18001144a
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x180011433
mov byte [rcx + rbx], 0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
mov rdx, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbp
call fcn.180008b20
mov rcx, rbx
call fcn.180030d58
lea rdx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x1800113b3
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.180030d58
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.180030d58
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180011426
mov rbx, qword [rsp + 0x48]
movzx eax, ax
or eax, 0x80070000
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180012570
Capabilities:
Parse url

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xd00
mov rax, qword [0x180060ef8]
xor rax, rsp
mov qword [rsp + 0xcf0], rax
mov rdi, rdx
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x20]
call fcn.1800325f0
lea rax, [rsp + 0x6c0]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x8d0]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xae0]
mov rcx, rdi
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x2a0]
mov dword [rsp + 0x20], 0x68
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x90]
mov dword [rsp + 0x30], 0x104
mov dword [rsp + 0x40], 0x104
mov dword [rsp + 0x50], 0x104
mov dword [rsp + 0x60], 0x104
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x70], 0x104
mov dword [rsp + 0x80], 0x104
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x18001273c
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0xd20], rsi
lea rdi, str.http
mov rsi, rax
mov ecx, 5
repe cmpsw word [rsi], word [rdi]
je 0x18001267e
lea rdi, str.https
mov rsi, rax
mov ecx, 6
repe cmpsw word [rsi], word [rdi]
jne 0x1800126a9
movzx eax, word [rsp + 0x44]
cmp ax, 0x50
je 0x180012693
mov ecx, 0x1bb
cmp ax, cx
jne 0x1800126a9
mov rax, qword [rsp + 0x48]
cmp word [rax], 0
jne 0x1800126a9
mov rax, qword [rsp + 0x58]
cmp word [rax], 0
je 0x1800126b0
xor al, al
jmp 0x180012734
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x4b0]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x4b0]
not rcx
lea r8d, [rcx - 1]
mov rcx, rbx
call fcn.18000b3b0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x2a0]
lea rdx, [rsp + 0x2a0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rbx + 8]
call fcn.18000b3b0
movzx edx, word [rsp + 0x44]
or rcx, 0xffffffffffffffff
xor eax, eax
mov dword [rbx + 0x78], edx
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x90]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rbx + 0x10]
call fcn.18000b3b0
mov al, 1
mov rsi, qword [rsp + 0xd20]
mov rcx, qword [rsp + 0xcf0]
xor rcx, rsp
call fcn.18002fe70
mov rbx, qword [rsp + 0xd28]
add rsp, 0xd00
pop rdi
ret

Function at 0x1800228a8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.18002d1dc
mov rsi, rax
test rax, rax
je 0x180022924
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x18002291f
cmp dword [rbx], 0x40
jb 0x18002291f
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x18002291f
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x180022928
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180033304
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.18003e008
nop
cmp dword [0x180066890], 1
je 0x1800332b0
mov dword [0x18006688c], 1
mov byte [0x180066888], r12b
test ebx, ebx
jne 0x18003329c
mov rcx, qword [0x180068f78]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180033289
mov rcx, qword [0x180068f70]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x180033228
call fcn.180033798
cmp qword [rdi], rax
jne 0x180033228
jmp 0x18003320e
cmp rdi, rsi
jb 0x180033289
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.180033798
mov qword [rdi], rax
call rbx
mov rcx, qword [0x180068f78]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x180068f70]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x180033267
cmp r13, rax
je 0x180033287
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x18003320e
lea rdx, [0x18004ba58]
lea rcx, [0x18004ba40]
call fcn.180033058
lea rdx, [0x18004ba68]
lea rcx, [0x18004ba60]
call fcn.180033058
nop
test r12d, r12d
je 0x1800332bf
mov ecx, 8
call fcn.18003df08
test r12d, r12d
jne 0x1800332ea
mov dword [0x180066890], 1
lea ecx, [r12 + 8]
call fcn.18003df08
mov ecx, r15d
call fcn.180032fec
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180033178
Function at 0x18003347b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180060ef8]
jne 0x18002fe8a
rol rcx, 0x10
test cx, 0xffff
jne 0x18002fe86
repz ret
ror rcx, 0x10
jmp 0x1800333d4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180066940]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180066a38]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180033459
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180066940]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18003347b
mov rax, qword [rsp + 0x88]
mov qword [0x180066a38], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800669d8], rax
mov rax, qword [0x180066a38]
mov qword [0x1800668b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800669c0], rax
mov dword [0x1800668a0], 0xc0000409
mov dword [0x1800668a4], 1
mov rax, qword [0x180060ef8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180060f00]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180066938], eax
mov ecx, 1
call fcn.180035690
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18004f770]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180066938], 0
jne 0x180033502
mov ecx, 1
call fcn.180035690
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x18004030c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180033798
xor ebx, ebx
mov rdi, rax
cmp qword [0x180067680], rbx
jne 0x180040412
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800404e7
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800404e7
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180067680], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1800512b0]
mov rcx, rsi
mov qword [0x180067688], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180067690], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1800676a0], rax
test rax, rax
je 0x180040409
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180067698], rax
jmp 0x180040419
mov rax, qword [0x180067698]
jmp 0x180040420
mov rax, qword [0x180067698]
mov r11, qword [0x1800676a0]
cmp rax, rdi
je 0x180040488
cmp r11, rdi
je 0x180040488
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1800676a0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180040488
test rax, rax
je 0x180040488
call rsi
test rax, rax
je 0x180040482
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180040482
test byte [rsp + 0x38], 1
jne 0x180040488
bts ebp, 0x15
jmp 0x1800404c6
mov rcx, qword [0x180067688]
cmp rcx, rdi
je 0x1800404c6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800404c6
call rax
mov rbx, rax
test rax, rax
je 0x1800404c6
mov rcx, qword [0x180067690]
cmp rcx, rdi
je 0x1800404c6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800404c6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180067680]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800404e7
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800404e9
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14000907c
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
neg r10
sbb edx, edx
and edx, eax
jmp fcn.140009a94

Function at 0x140009724
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, r9d
mov rsi, r8
test r8, r8
je 0x14000974b
and qword [r8], 0
call fcn.140009860
mov rbx, rax
test rax, rax
je 0x140009844
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000983b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000983b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000983b
mov rax, qword [0x140079db0]
mov rbp, rdi
test rax, rax
je 0x1400097b3
inc dword [rax + 0x3c8]
mov rdx, qword [0x140079dc0]
lea rcx, [r15 + rdi]
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x14000983b
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
je 0x140009812
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140079db0]
test rax, rax
je 0x140009800
dec dword [rax + 0x3c8]
mov rdx, qword [0x140079dc0]
mov rcx, rdi
call qword [0x140078008]
jmp 0x140009844
test r15d, r15d
jle 0x140009825
lea rcx, [rdi + rbp]
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140009836
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140009846
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140009a94
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x140079de4], 0
lea rsi, [0x140079de0]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x140009afb
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x140009ac9
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x140009ac1
not ebx
mov edx, ebx
test edi, edi
jle 0x140009b1d
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x140009b03
jmp 0x140009b57
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x140009b57
mov r9b, 0x23
cmp r8b, r9b
jne 0x140009b3c
cmp byte [r10], r9b
jne 0x140009b3c
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x140009b2b
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000fae8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140079db0]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000fb51
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000fb5c
lea rdx, [0x14004b9a4]
mov rcx, rbx
mov rdi, rax
call fcn.140009860
mov rbx, rax
test rax, rax
je 0x14000fb51
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret