joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400044d0
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov cl, 0x36
mov word [rbp - 0x50], 0x36
movsx r9d, cl
xor edi, edi
movzx edx, r9w
mov word [rbp - 0x34], di
movzx ecx, r9w
mov dword [rsp + 0x20], edi
movzx r8d, r9w
movzx eax, r9w
xor ax, 0x7f
xor r8w, 0x53
mov word [rbp - 0x4e], ax
xor dx, 0x58
movzx eax, r9w
mov word [rbp - 0x4c], dx
xor ax, 0x44
mov word [rbp - 0x48], r8w
mov word [rbp - 0x46], ax
xor cx, 0x42
movzx eax, r9w
mov word [rbp - 0x4a], cx
xor ax, 0x75
mov word [rbp - 0x44], dx
mov word [rbp - 0x3e], ax
lea edx, [rdi + 1]
movzx eax, r9w
mov word [rbp - 0x42], r8w
xor ax, 0x5e
mov word [rbp - 0x40], cx
mov word [rbp - 0x3c], ax
lea rcx, [rbp - 0x4e]
movzx eax, r9w
mov word [rbp - 0x3a], r8w
xor r9w, 0x5d
xor ax, 0x55
mov word [rbp - 0x36], r9w
xor r8d, r8d
xor r9d, r9d
mov word [rbp - 0x38], ax
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rbx, rax
test rax, rax
je 0x1400046a0
mov cl, 0x2f
mov qword [rsp + 0x28], rdi
movsx r8d, cl
xor r9d, r9d
movzx ecx, r8w
mov word [rbp - 0x24], r8w
xor cx, 0x47
mov word [rbp - 0x22], r8w
mov word [rbp - 0x2e], cx
movzx edx, r8w
movzx ecx, r8w
mov word [rbp - 0x30], 0x2f
xor cx, 0x5b
mov word [rbp - 4], di
movzx eax, r8w
mov word [rbp - 0x2c], cx
xor ax, 0x5f
mov word [rbp - 0x2a], cx
mov word [rbp - 0x28], ax
movzx ecx, r8w
xor cx, 0x40
mov dword [rsp + 0x20], 0x80000000
movzx eax, r8w
mov word [rbp - 0x16], cx
xor ax, 0x15
mov word [rbp - 0x14], cx
mov word [rbp - 0x26], ax
xor dx, 1
movzx eax, r8w
mov word [rbp - 0x1a], dx
xor ax, 0x58
mov word [rbp - 0xc], dx
mov word [rbp - 0x20], ax
lea rdx, [rbp - 0x2e]
mov word [rbp - 0x1e], ax
mov word [rbp - 0x1c], ax
movzx eax, r8w
xor ax, 0x48
mov word [rbp - 8], cx
mov word [rbp - 0x18], ax
mov rcx, rbx
mov word [rbp - 0x12], ax
movzx eax, r8w
xor ax, 0x43
mov word [rbp - 0x10], ax
movzx eax, r8w
xor ax, 0x4a
mov word [rbp - 0xe], ax
movzx eax, r8w
xor r8w, 0x42
xor ax, 0x4c
mov word [rbp - 6], r8w
xor r8d, r8d
mov word [rbp - 0xa], ax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
test rax, rax
je 0x140004697
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, 1
jmp 0x1400046a2
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140007010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140153040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000703d
xor eax, eax
jmp 0x1400071a9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140007077
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140007077
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400071a9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000719c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400070ba
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400070e5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400071a1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140007154
sub eax, 1
je 0x140007154
cmp eax, 2
jne 0x14000719c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400071a1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140007182
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000719c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400071a1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140059220
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140007950
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140153040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140007a23
cmp byte [rcx + 0x71], 0
je 0x140007a23
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140007a1f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400079e4
sub eax, 1
je 0x1400079e8
cmp eax, 2
jne 0x140007a1f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140059220
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140007a16
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140007a1f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400079cc
xor al, al
jmp 0x1400079cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140059220
add rsp, 0x60
pop rbx
ret
Function at 0x140009990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13e0
call fcn.14005a3a0
sub rsp, rax
mov rax, qword [0x140153040]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
movabs rax, 0x5555555555555555
mov qword [rsp + 0x13c8], rax
mov qword [rsp + 0x48], rdx
lea ecx, [rdi + 1]
movabs r8, 0x5851f42d4c957f2d
nop dword [rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rsp + rcx*8 + 0x48], rdx
inc rcx
cmp rcx, 0x138
jb 0x140009a00
mov dword [rsp + 0x40], 0x138
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
mov dword [rsp + 0x20], 1
mov edi, 0xa
mov edx, edi
mov rcx, rbx
call fcn.1400073b0
lea esi, [rdi + 0x36]
lea rbp, str.0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
lea rcx, [rsp + 0x40]
call fcn.14000ad50
mov rcx, rax
mov eax, 0x3e
mul rcx
cmp rax, 0x3e
jae 0x140009a9c
cmp rax, 0x10
jae 0x140009a9c
lea rcx, [rsp + 0x40]
call fcn.14000ad50
mov rcx, rax
mov eax, 0x3e
mul rcx
cmp rax, 0x10
jb 0x140009a81
mov ecx, esi
and ecx, 0x3f
shr rdx, cl
movsxd rcx, edx
movzx r9d, byte [rcx + rbp]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140009ad8
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x140009acd
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140009ae0
mov rcx, rbx
call fcn.1400091a0
sub rdi, 1
jne 0x140009a60
mov rax, rbx
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.140059220
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000ad50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14000adb7
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x14000ad72
mov ecx, dword [r10]
jmp 0x14000aec6
cmp ecx, 0x270
jb 0x14000aec6
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x14000adf0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x14000ae41
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x14000af20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x460
mov rax, qword [0x140153040]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x38], rcx
xor edi, edi
mov rdx, qword [0x14016c478]
mov rbx, rcx
cmp qword [rdx + 0x18], 7
jbe 0x14000af5a
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000afd1
cmp qword [0x14016c470], 7
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
lea rdx, [0x14016c458]
cmova rdx, qword [0x14016c458]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000afeb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rdx, [0x14005cd29]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov qword [rbx + 0x18], rdi
jmp 0x14000b01e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x14000b010
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140008ed0
mov rax, rbx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140059220
mov rbx, qword [rsp + 0x478]
add rsp, 0x460
pop rdi
ret

Function at 0x14000b050
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
cmp qword [0x14016c470], 7
lea r8, [0x14016c458]
mov rdx, qword [0x14016c478]
cmova r8, qword [0x14016c458]
cmp qword [rdx + 0x18], 7
jbe 0x14000b07c
mov rdx, qword [rdx]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test eax, eax
sete al
add rsp, 0x28
ret
Function at 0x14000b2b0
Capabilities:
Check for debugger via api
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140153040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x48], 0
je 0x14000b3a9
lea rdx, [rsp + 0x20]
call fcn.14000b3c0
mov ecx, 0x1001
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
xor byte [rax + 0x24], r8b
xor byte [rax + 0x25], r8b
mov byte [rax + 0x26], 0
call fcn.14000b240
mov ecx, 0x1001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140059220
add rsp, 0x68
ret

Function at 0x14000b410
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
lea rdx, str.OllyDbg____CPU_
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
xor ebx, ebx
lea rdx, str.Immunity_Debugger____CPU_
test rax, rax
setne bl
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
mov ecx, 1
cmovne ebx, ecx
test ebx, ebx
je 0x14000b502
lea rdx, [rsp + 0x20]
call fcn.14000b510
mov ecx, 0x1005
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
mov byte [rax + 0x23], 0
call fcn.14000b240
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x50
pop rbx
ret
Function at 0x14000b850
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
lea rcx, str.OLLYDBG
call qword [sym.imp.USER32.dll_FindWindowW]
xor ebx, ebx
lea rcx, [0x14005d170]
test rax, rax
setne bl
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
mov ecx, 1
cmovne ebx, ecx
test ebx, ebx
je 0x14000b93e
lea rdx, [rsp + 0x20]
call fcn.14000b950
mov ecx, 0x1005
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
mov byte [rax + 0x22], 0
call fcn.14000b240
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x50
pop rbx
ret

Function at 0x14000b9a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000ba4d
lea rdx, [rsp + 0x20]
call fcn.14000ba60
mov ecx, 0x1002
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
mov byte [rax + 0x1d], 0
call fcn.14000b240
mov ecx, 0x1002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x48
ret
Function at 0x14000baa0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0xb8
mov rax, qword [0x140153040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
mov dword [r11 - 0x18], 0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str.ntdll.dll
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000bc69
lea rdx, str.NtQueryInformationProcess
mov qword [rsp + 0xb0], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000bc61
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0xa0]
mov r9d, 0x30
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x70]
mov rcx, rax
xor edx, edx
call rbx
test eax, eax
js 0x14000bc61
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14000bc61
cmp byte [rax + 2], 0
je 0x14000bc61
lea rdx, [rsp + 0x30]
call fcn.14000bc90
mov ecx, 0x1004
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
xor byte [rax + 0x24], r8b
xor byte [rax + 0x25], r8b
xor byte [rax + 0x26], r8b
xor byte [rax + 0x27], r8b
xor byte [rax + 0x28], r8b
xor byte [rax + 0x29], r8b
xor byte [rax + 0x2a], r8b
xor byte [rax + 0x2b], r8b
xor byte [rax + 0x2c], r8b
xor byte [rax + 0x2d], r8b
xor byte [rax + 0x2e], r8b
xor byte [rax + 0x2f], r8b
xor byte [rax + 0x30], r8b
xor byte [rax + 0x31], r8b
xor byte [rax + 0x32], r8b
xor byte [rax + 0x33], r8b
xor byte [rax + 0x34], r8b
xor byte [rax + 0x35], r8b
xor byte [rax + 0x36], r8b
xor byte [rax + 0x37], r8b
mov byte [rax + 0x38], 0
call fcn.14000b240
mov ecx, 0x1004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140059220
add rsp, 0xb8
ret
Function at 0x14000bd00
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x410
mov rax, qword [0x140153040]
xor rax, rsp
mov qword [rsp + 0x400], rax
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea r8, str.antidbg
mov rbx, rcx
mov dword [rsp + 0xd4], eax
xor edi, edi
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov dword [rsp + 0x68], edi
xor edx, edx
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000bdb3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x14000be68
mov ecx, 0x22b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rsp + 0x1f0]
mov dword [rsp + 0x20], ebx
lea r8, str._ws__d
mov edx, 0x109
lea rcx, [rsp + 0xe0]
call fcn.14000b1e0
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.140059220
mov rbx, qword [rsp + 0x428]
add rsp, 0x410
pop rdi
ret