joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019596
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
jmp 0x140029410
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2b8
lea rbp, [rsp + 0x40]
lea rcx, [0x14006611b]
call fcn.140019fa0
mov r8d, dword [0x14005d6c0]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140029474
lea rdx, str.failed_to_open_process.
lea rcx, [rbp + 0x188]
call fcn.140019d70
lea rdx, [0x14005c038]
lea rcx, [rbp + 0x188]
call fcn.14001a108
mov rcx, qword [rbp + 0x290]
call fcn.140019d48
inc rax
mov qword [rbp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x28]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x1400294d6
lea rdx, str.memory_allocation_error.
lea rcx, [rbp + 0x1b8]
call fcn.140019d70
lea rdx, [0x14005c038]
lea rcx, [rbp + 0x1b8]
call fcn.14001a108
mov rcx, qword [rbp + 0x290]
call fcn.14001919a
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x28]
mov r8, rax
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14002952a
lea rdx, str.memory_write_error.
lea rcx, [rbp + 0x1e8]
call fcn.140019d70
lea rdx, [0x14005c038]
lea rcx, [rbp + 0x1e8]
call fcn.14001a108
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x68], rax
lea rdx, str.LoadLibraryA
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x140029583
lea rdx, str.failed_to_get_LoadLibraryA_address.
lea rcx, [rbp + 0x218]
call fcn.140019d70
lea rdx, [0x14005c038]
lea rcx, [rbp + 0x218]
call fcn.14001a108
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x88]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x1400295ea
lea rdx, str.failed_to_create_remote_thread.
lea rcx, [rbp + 0x248]
call fcn.140019d70
lea rdx, [0x14005c038]
lea rcx, [rbp + 0x248]
call fcn.14001a108
mov edx, 0xffffffff
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret

Function at 0x1400198cf
Capabilities:
Terminate process

Disassembly:
jmp 0x140049710
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140019a19
Capabilities:
Get geographical location

Disassembly:
jmp 0x140043080
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1400430bd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.140019f8c
add rsp, 0x58
ret
Function at 0x140019a91
Capabilities:
Execute command
Set console window title

Disassembly:
jmp 0x140031160
push rbp
push rdi
sub rsp, 0x408
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x9a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14005d040]
xor rax, rbp
mov qword [rbp + 0x3d0], rax
mov dword [rbp + 0x3a4], 0
lea rcx, [0x14006611c]
call fcn.140019fa0
lea rcx, str.ver._0.1__coded_by_rubus
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor eax, eax
cmp eax, 1
je 0x1400313bd
lea rcx, [rbp + 8]
call fcn.140019f82
nop
lea rdx, str.dll_path:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400191e0
lea rdx, [rbp + 8]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.1400198ca
xor r8d, r8d
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x48]
call fcn.140019c44
mov qword [rbp + 0x3b8], rax
lea rcx, [rbp + 0x48]
call fcn.140019708
mov byte [rbp + 0x3b4], al
movzx eax, byte [rbp + 0x3b4]
test eax, eax
je 0x140031295
xor r8d, r8d
lea rdx, str..dll
lea rcx, [rbp + 0x248]
call fcn.14001937f
mov qword [rbp + 0x3b8], rax
mov eax, dword [rbp + 0x3a4]
or eax, 1
mov dword [rbp + 0x3a4], eax
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x48]
call fcn.140019294
mov qword [rbp + 0x3c0], rax
mov eax, dword [rbp + 0x3a4]
or eax, 2
mov dword [rbp + 0x3a4], eax
lea rdx, [rbp + 0x248]
mov rcx, qword [rbp + 0x3c0]
call fcn.140019145
movzx eax, al
test eax, eax
je 0x140031295
mov dword [rbp + 0x3c8], 0
jmp 0x14003129f
mov dword [rbp + 0x3c8], 1
movzx eax, byte [rbp + 0x3c8]
mov byte [rbp + 0x224], al
mov eax, dword [rbp + 0x3a4]
and eax, 2
test eax, eax
je 0x1400312cd
and dword [rbp + 0x3a4], 0xfffffffd
lea rcx, [rbp + 0x288]
call fcn.140019e4c
nop
mov eax, dword [rbp + 0x3a4]
and eax, 1
test eax, eax
je 0x1400312ed
and dword [rbp + 0x3a4], 0xfffffffe
lea rcx, [rbp + 0x248]
call fcn.140019e4c
movzx eax, byte [rbp + 0x224]
test eax, eax
je 0x140031357
lea rdx, str.invalid_or_non_existent_DLL_path._n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400191e0
mov dword [rbp + 0x2e4], 0x15e
lea rdx, [rbp + 0x2e4]
lea rcx, [rbp + 0x2c8]
call fcn.140019b5e
mov rcx, rax
call fcn.140019cb2
lea rcx, [0x140054abc]
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [rbp + 0x48]
call fcn.140019e4c
nop
lea rcx, [rbp + 8]
call fcn.1400192ee
nop
jmp 0x1400311b4
lea rcx, [rbp + 8]
call fcn.140019a7d
mov dword [rbp + 0x324], 3
lea rdx, [rbp + 0x324]
lea rcx, [rbp + 0x308]
call fcn.1400193a2
mov rcx, rax
call fcn.140019302
nop
lea rcx, [rbp + 0x48]
call fcn.140019e4c
nop
lea rcx, [rbp + 8]
call fcn.1400192ee
nop
jmp 0x1400313bd
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140052d80]
call fcn.140019cdf
mov rax, rdi
mov rcx, qword [rbp + 0x3d0]
xor rcx, rbp
call fcn.14001978a
lea rsp, [rbp + 0x3e8]
pop rdi
pop rbp
ret
Function at 0x140019abe
Capabilities:
Parse pe header

Disassembly:
jmp 0x140048ad0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140048af0
xor al, al
jmp 0x140048b71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140048b03
xor al, al
jmp 0x140048b71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140048b2d
xor al, al
jmp 0x140048b71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140048b41
xor al, al
jmp 0x140048b71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140048b53
xor al, al
jmp 0x140048b71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140048b6f
xor al, al
jmp 0x140048b71
mov al, 1
add rsp, 0x38
ret
Function at 0x140019edd
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400290e0
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14005d040]
xor rax, rbp
mov qword [rbp + 0x290], rax
lea rcx, [0x14006611b]
call fcn.140019fa0
mov dword [rbp + 4], 0
mov dword [rbp + 0x30], 0x130
xor edx, edx
mov ecx, 2
call fcn.140019762
mov qword [rbp + 0x178], rax
lea rdx, str.waiting_for_cs2.exe_process...
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400191e0
mov qword [rbp + 0x288], rax
lea rdx, [0x1400190a0]
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
cmp eax, 1
je 0x1400291f1
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x178]
call fcn.140019cc6
test eax, eax
je 0x1400291c7
lea rdx, str.cs2.exe
lea rcx, [rbp + 0x5c]
call fcn.14001a135
test eax, eax
jne 0x1400291b3
mov eax, dword [rbp + 0x38]
mov dword [rbp + 4], eax
mov rcx, qword [rbp + 0x178]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
jmp 0x1400291f1
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x178]
call fcn.140019fbe
test eax, eax
jne 0x140029187
mov dword [rbp + 0x274], 0x96
lea rdx, [rbp + 0x274]
lea rcx, [rbp + 0x258]
call fcn.140019b5e
mov rcx, rax
call fcn.140019cb2
jmp 0x14002916c
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140052970]
call fcn.140019cdf
mov rax, rdi
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.14001978a
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret
Function at 0x1400021f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004380]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002210
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002218
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002210
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000226d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002264
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002210
add rax, 0x28
cmp rax, r9
jne 0x140002250
xor eax, eax
ret

Function at 0x140002270
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004380]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000228f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002298
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000228f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002330
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004380]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000234f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002358
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400026e0
Capabilities:
Create thread

Disassembly:
push rsi
push rbx
sub rsp, 0x48
lea rsi, [0x1400030a0]
lea rbx, [0x140003080]
call fcn.140001500
lea r8, str.secret
mov edx, 0x1b1
mov rcx, rsi
mov r9d, 7
mov dword [rsp + 0x3c], 0
call fcn.140002690
mov r9d, 7
mov edx, 0xc
mov rcx, rbx
call fcn.140002690
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 4
xor ecx, ecx
mov r8d, 0x3000
mov edx, 0x1b1
mov qword [0x140003090], rax
call rax
mov r8d, 0x1b1
mov rdx, rsi
mov rbx, rax
mov rcx, rax
call sub.msvcrt.dll_memmove
lea r9, [rsp + 0x3c]
mov edx, 0x1b1
mov rcx, rbx
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000279d
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
ret
xor eax, eax
xor edx, edx
xor ecx, ecx
xor r9d, r9d
mov dword [rsp + 0x20], edx
mov r8, rbx
xor edx, edx
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140002794
Function at 0x140001480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1400110c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x28], 0x77
mov byte [rsp + 0x29], 0x58
mov byte [rsp + 0x2a], 0x52
mov byte [rsp + 0x2b], 0x79
mov byte [rsp + 0x2c], 0x4a
mov byte [rsp + 0x2d], 0x4a
mov byte [rsp + 0x2e], 0x5a
mov byte [rsp + 0x2f], 0x77
mov byte [rsp + 0x30], 0x53
mov byte [rsp + 0x31], 0x42
mov byte [rsp + 0x32], 0x49
mov byte [rsp + 0x33], 0x56
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0x54
mov byte [rsp + 0x36], 0x67
mov byte [rsp + 0x37], 0x4e
mov byte [rsp + 0x38], 0x44
mov byte [rsp + 0x39], 0x52
mov byte [rsp + 0x3a], 0x61
mov byte [rsp + 0x3b], 0x43
mov byte [rsp + 0x3c], 0
mov rcx, qword [rsp + 0x80]
call fcn.140002cd0
movzx eax, al
test eax, eax
jne 0x140001538
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.140002e30
test eax, eax
jne 0x140001555
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x80]
call fcn.140002b60
mov rax, qword [rsp + 0x40]
jmp 0x1400015cf
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x140001592
mov rcx, qword [rsp + 0x80]
call fcn.140002ca0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x80]
call fcn.140002b60
mov rax, qword [rsp + 0x48]
jmp 0x1400015cf
mov rcx, qword [rsp + 0x80]
call fcn.140002ca0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x80]
call fcn.140002b60
mov rax, qword [rsp + 0x50]
jmp 0x1400015cf
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140005020
add rsp, 0x78
ret
Function at 0x140002040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x138
mov rax, qword [0x1400110c0]
xor rax, rsp
mov qword [rsp + 0x128], rax
mov byte [rsp + 0x70], 4
mov byte [rsp + 0x71], 7
mov byte [rsp + 0x72], 0x2a
mov byte [rsp + 0x73], 0xb
mov byte [rsp + 0x74], 0
mov byte [rsp + 0x75], 0x26
mov byte [rsp + 0x76], 0x38
mov byte [rsp + 0x77], 0x29
mov byte [rsp + 0x78], 0x28
mov byte [rsp + 0x79], 0x3d
mov byte [rsp + 0x7a], 0x35
mov byte [rsp + 0x7b], 0x3b
mov byte [rsp + 0x7c], 0x17
mov byte [rsp + 0x7d], 0
mov byte [rsp + 0x5c], 0x56
mov byte [rsp + 0x5d], 0x62
mov byte [rsp + 0x5e], 0x4d
mov byte [rsp + 0x5f], 0
mov byte [rsp + 0x58], 0x44
mov byte [rsp + 0x59], 0x70
mov byte [rsp + 0x5a], 0x43
mov byte [rsp + 0x5b], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
mov r8d, 0xd
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xa8]
call fcn.140001340
mov qword [rsp + 0x110], rax
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x140]
call fcn.1400015f0
mov r11, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000001
call r11
mov byte [rsp + 0x48], 4
mov byte [rsp + 0x49], 7
mov byte [rsp + 0x4a], 0x2a
mov byte [rsp + 0x4b], 0x17
mov byte [rsp + 0x4c], 0x15
mov byte [rsp + 0x4d], 0x37
mov byte [rsp + 0x4e], 0
mov byte [rsp + 0x4f], 3
mov byte [rsp + 0x50], 0x21
mov byte [rsp + 0x51], 0x31
mov byte [rsp + 0x52], 0x15
mov byte [rsp + 0x53], 6
mov byte [rsp + 0x54], 0x2e
mov byte [rsp + 0x55], 0x23
mov byte [rsp + 0x56], 0
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
mov r8d, 0xe
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xd8]
call fcn.140001340
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x140]
call fcn.1400015f0
mov r11, rax
mov rax, qword [rsp + 0x148]
mov eax, dword [rax + 8]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x148]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.lpData
mov rcx, qword [rsp + 0x30]
call r11
test eax, eax
je 0x140002230
xor eax, eax
jmp 0x1400022cc
mov byte [rsp + 0x60], 4
mov byte [rsp + 0x61], 7
mov byte [rsp + 0x62], 0x2a
mov byte [rsp + 0x63], 7
mov byte [rsp + 0x64], 0x1c
mov byte [rsp + 0x65], 0x2c
mov byte [rsp + 0x66], 0x25
mov byte [rsp + 0x67], 7
mov byte [rsp + 0x68], 6
mov byte [rsp + 0x69], 0x21
mov byte [rsp + 0x6a], 9
mov byte [rsp + 0x6b], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
mov r8d, 0xb
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x108]
call fcn.140001340
mov qword [rsp + 0x120], rax
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x140]
call fcn.1400015f0
mov rcx, qword [rsp + 0x30]
call rax
mov eax, 1
mov rcx, qword [rsp + 0x128]
xor rcx, rsp
call fcn.140005020
add rsp, 0x138
ret
Function at 0x140005fcb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400110c0]
jne 0x14000503a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005036
repz ret
ror rcx, 0x10
jmp 0x140005f24
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140012260]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140012358]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140005fa9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140012260]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140005fcb
mov rax, qword [rsp + 0x88]
mov qword [0x140012358], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400122f8], rax
mov rax, qword [0x140012358]
mov qword [0x1400121d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400122e0], rax
mov dword [0x1400121c0], 0xc0000409
mov dword [0x1400121c4], 1
mov rax, qword [0x1400110c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400110c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140012258], eax
mov ecx, 1
call fcn.140006960
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000d4f8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012258], 0
jne 0x140006052
mov ecx, 1
call fcn.140006960
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140007068
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400098f0
nop
cmp dword [0x140012798], 1
je 0x140007014
mov dword [0x140012794], 1
mov byte [0x140012790], r12b
test ebx, ebx
jne 0x140007000
mov rcx, qword [0x140013250]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140006fed
mov rcx, qword [0x140013248]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140006f8c
call fcn.140006970
cmp qword [rdi], rax
jne 0x140006f8c
jmp 0x140006f72
cmp rdi, rsi
jb 0x140006fed
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140006970
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140013250]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140013248]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140006fcb
cmp r13, rax
je 0x140006feb
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140006f72
lea rdx, [0x14000d248]
lea rcx, [0x14000d240]
call fcn.140006dbc
lea rdx, [0x14000d258]
lea rcx, [0x14000d250]
call fcn.140006dbc
nop
test r12d, r12d
je 0x140007023
mov ecx, 8
call fcn.1400097f0
test r12d, r12d
jne 0x14000704e
mov dword [0x140012798], 1
lea ecx, [r12 + 8]
call fcn.1400097f0
mov ecx, r15d
call fcn.140006d50
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140006edc

Function at 0x140007074
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140006edc
Function at 0x14000abf4
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140006970
xor ebx, ebx
mov rdi, rax
cmp qword [0x140012f20], rbx
jne 0x14000acfa
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000adcf
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000adcf
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140012f20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140012f28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140012f30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140012f40], rax
test rax, rax
je 0x14000acf1
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140012f38], rax
jmp 0x14000ad01
mov rax, qword [0x140012f38]
jmp 0x14000ad08
mov rax, qword [0x140012f38]
mov r11, qword [0x140012f40]
cmp rax, rdi
je 0x14000ad70
cmp r11, rdi
je 0x14000ad70
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140012f40]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14000ad70
test rax, rax
je 0x14000ad70
call rsi
test rax, rax
je 0x14000ad6a
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000ad6a
test byte [rsp + 0x38], 1
jne 0x14000ad70
bts ebp, 0x15
jmp 0x14000adae
mov rcx, qword [0x140012f28]
cmp rcx, rdi
je 0x14000adae
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000adae
call rax
mov rbx, rax
test rax, rax
je 0x14000adae
mov rcx, qword [0x140012f30]
cmp rcx, rdi
je 0x14000adae
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000adae
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140012f20]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000adcf
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14000add1
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret