joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c090
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.18002add0
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6e69645c
mov dword [rsp + 0x24], 0x2e747570
mov dword [rsp + 0x28], 0x6c6c64
call fcn.180025d08
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000c114
xor eax, eax
jmp 0x18000c11b
test ebx, ebx
je 0x18000c110
add rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180024b60
add rsp, 0x240
pop rbx
ret

Function at 0x18000c140
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, ecx
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x1ff
mov byte [rsp + 0x30], 0
call fcn.18002add0
lea rcx, [rsp + 0x30]
mov edx, 0x200
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov dword [rsp + 0x20], 0x6778645c
mov dword [rsp + 0x24], 0x6c642e69
mov word [rsp + 0x28], 0x6c
call fcn.180025d08
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000c1c3
xor eax, eax
jmp 0x18000c1ca
test ebx, ebx
je 0x18000c1bf
add rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180024b60
add rsp, 0x240
pop rbx
ret
Function at 0x18000df00
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdx, qword [0x18007c098]
mov rax, qword [0x18007c090]
xor ecx, ecx
sub rdx, rax
sar rdx, 2
test edx, edx
je 0x18000e129
cmp dword [rax], 0x6435437f
je 0x18000df4d
inc ecx
add rax, 4
cmp ecx, edx
jb 0x18000df36
jmp 0x18000e129
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6e65706f
mov dword [rbp - 0x2c], 0x32336c67
mov dword [rbp - 0x28], 0x6c6c642e
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000e129
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x50], 0x65526c67
mov dword [rbp - 0x4c], 0x69506461
mov qword [rbp - 0x48], 0x736c6578
mov qword [rbp - 0x40], 0
mov dword [rbp - 0x38], 0
mov byte [rbp - 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x50], 0x536c6777
mov dword [rbp - 0x4c], 0x42706177
mov dword [rbp - 0x48], 0x65666675
mov qword [rbp - 0x44], 0x7372
mov qword [0x18007bab0], rax
mov qword [rbp - 0x3c], 0
mov byte [rbp - 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x50], 0x536c6777
mov dword [rbp - 0x4c], 0x4c706177
mov dword [rbp - 0x48], 0x72657961
mov dword [rbp - 0x44], 0x66667542
mov qword [0x18007bb00], rax
mov qword [rbp - 0x40], 0x737265
mov dword [rbp - 0x38], 0
mov byte [rbp - 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x50], 0x436c6777
mov dword [rbp - 0x4c], 0x74616572
mov dword [rbp - 0x48], 0x6e6f4365
mov qword [rbp - 0x44], 0x74786574
mov qword [0x18007bb20], rax
mov qword [rbp - 0x3c], 0
mov byte [rbp - 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x50], 0x446c6777
mov dword [rbp - 0x4c], 0x74656c65
mov dword [rbp - 0x48], 0x6e6f4365
mov qword [rbp - 0x44], 0x74786574
mov qword [0x18007baa8], rax
mov qword [rbp - 0x3c], 0
mov byte [rbp - 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x50], 0x4d6c6777
mov dword [rbp - 0x4c], 0x43656b61
mov dword [rbp - 0x48], 0x65727275
mov qword [rbp - 0x44], 0x746e
mov qword [0x18007bac8], rax
mov qword [rbp - 0x3c], 0
mov byte [rbp - 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007bb18], rax
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180024b60
add rsp, 0x70
pop rbp
ret
Function at 0x18000e140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdx, qword [0x18007c098]
mov rax, qword [0x18007c090]
xor ecx, ecx
sub rdx, rax
sar rdx, 2
test edx, edx
je 0x18000e256
cmp dword [rax], 0x264d4161
je 0x18000e18d
inc ecx
add rax, 4
cmp ecx, edx
jb 0x18000e176
jmp 0x18000e256
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x6562696c
mov dword [rbp - 0x4c], 0x642e6c67
mov word [rbp - 0x48], 0x6c6c
mov byte [rbp - 0x46], 0
mov dword [rbp - 0x40], 0x4762696c
mov dword [rbp - 0x3c], 0x7653454c
mov dword [rbp - 0x38], 0x6c642e32
mov word [rbp - 0x34], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000e256
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000e256
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x20], 0x536c6765
mov dword [rbp - 0x1c], 0x42706177
mov dword [rbp - 0x18], 0x65666675
mov word [rbp - 0x14], 0x7372
mov byte [rbp - 0x12], 0
mov dword [rbp - 0x30], 0x65526c67
mov dword [rbp - 0x2c], 0x69506461
mov dword [rbp - 0x28], 0x736c6578
mov byte [rbp - 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x40]
mov qword [0x18007ba90], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007bae0], rax
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180024b60
add rsp, 0x70
pop rbp
ret
Function at 0x18000e270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdx, qword [0x18007c098]
mov rax, qword [0x18007c090]
xor ebx, ebx
sub rdx, rax
mov rdi, rcx
mov r8d, ebx
sar rdx, 2
test edx, edx
je 0x18000e2c4
mov rcx, rax
nop dword [rax]
cmp dword [rcx], 0x5f141e32
je 0x18000e308
inc r8d
add rcx, 4
cmp r8d, edx
jb 0x18000e2b0
mov dword [0x18007bad8], ebx
mov r8d, ebx
test edx, edx
je 0x18000e2e8
mov rcx, rax
cmp dword [rcx], 0x4766a246
je 0x18000e314
inc r8d
add rcx, 4
cmp r8d, edx
jb 0x18000e2d4
mov r8d, ebx
test edx, edx
je 0x18000e366
mov rcx, rax
cmp dword [rcx], 0x5f141e32
je 0x18000e314
inc r8d
add rcx, 4
cmp r8d, edx
jb 0x18000e2f2
jmp 0x18000e366
mov dword [0x18007bad8], 1
jmp 0x18000e2ca
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x61726464
mov dword [rsp + 0x24], 0x6c642e77
mov word [rsp + 0x28], 0x6c
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000e35f
mov ecx, dword [rdi + 0x1000438]
call fcn.18000bf30
mov qword [0x18007bac0], rax
mov ecx, dword [rdi + 0x100043c]
call fcn.18000bf30
mov qword [0x18007bb08], rax
mov rax, qword [0x18007c090]
mov rcx, qword [0x18007c098]
sub rcx, rax
sar rcx, 2
test ecx, ecx
je 0x18000e3e7
cmp dword [rax], 0x4766a2c9
je 0x18000e38c
inc ebx
add rax, 4
cmp ebx, ecx
jb 0x18000e378
jmp 0x18000e3e7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x39643364
mov dword [rsp + 0x24], 0x6c6c642e
mov byte [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18000e3e7
mov ecx, dword [rdi + 0x100042c]
call fcn.18000be80
mov qword [0x18007bae8], rax
mov ecx, dword [rdi + 0x1000430]
call fcn.18000be80
mov qword [0x18007baa0], rax
mov ecx, dword [rdi + 0x1000434]
call fcn.18000be80
mov qword [0x18007bab8], rax
mov eax, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180024b60
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180010520
Capabilities:
Log keystrokes

Disassembly:
lea eax, [rcx - 0x10]
cmp eax, 0x94
ja case.0x180010549.19
lea r8, [0x180000000]
movzx eax, byte [r8 + rax + 0x10668]
mov edx, dword [r8 + rax*4 + 0x105f8]
add rdx, r8
jmp rdx
mov eax, 0xcb
ret
mov eax, 0xcd
ret
mov eax, 0xc8
ret
mov eax, 0xd0
ret
mov eax, 0x3b
ret
mov eax, 0x3c
ret
mov eax, 0x3d
ret
mov eax, 0x3e
ret
mov eax, 0x3f
ret
mov eax, 0x40
ret
mov eax, 0x41
ret
mov eax, 0x42
ret
mov eax, 0x43
ret
mov eax, 0x44
ret
mov eax, 0x57
ret
mov eax, 0x58
ret
mov eax, 0x1d
ret
mov eax, 0x38
ret
mov eax, 0x2a
ret
mov eax, 0xd1
ret
mov eax, 0xc9
ret
mov eax, 0xc7
ret
mov eax, 0xcf
ret
mov eax, 0xd2
ret
mov eax, 0xd3
ret
mov eax, 0xb5
ret
mov eax, 0xdd
ret
xor edx, edx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyA]
call 0x12f080ed2
lsl eax, word [rax]
adc byte [rcx], ch
add al, 0
mov al, 0xf
add eax, dword [rax]
loope 0x180080be2
add eax, dword [rax]
test byte [rsi], bh
add al, 0
in al, 0x10
add eax, dword [rax]
pushfq
adc dword [rbx], eax
add byte [rcx + rbp], ch
sub al, 0x29
sub al, 0x29
add al, 0
pushfq
adc dword [rbx], eax
add byte [rax + 0x38000312], dl
cmp byte [rcx], ch
add al, 0
cmp byte [rcx], ch
add al, 0
nop
adc al, byte [rbx]
add al, cl
adc al, byte [rbx]
add byte [rax + rsi], bl
sbb al, 0x30
sbb al, 0x30
add al, 0
enter 0x312, 0
add byte [rbx], dl
add eax, dword [rax]
sbb al, 0x30
add al, 0
add byte [rbx], dl
add eax, dword [rax]
outsb dx, byte [rsi]
adc eax, dword [rbx]
add byte [rax + 0x2a], ch
add al, 0
jo 0x180080c29
add eax, dword [rax]
xchg ecx, eax
adc eax, dword [rbx]
add byte [rax], cl
sub eax, 0x13a40004
add eax, dword [rax]
fst qword [rbx]
add eax, dword [rax]
sbb al, 0x30
add al, 0
xor byte [rax + rax], al
loopne 0x180080c41
add eax, dword [rax]
movabs eax, dword [0xa4000429f4000314]
movsb byte [rdi], byte [rsi]
movsb byte [rdi], byte [rsi]
adc al, 3
add byte [rax + 0x19], bl
add eax, dword [rax]
fsubr dword [rcx]
add al, 0
sub dword [rax + rax], eax
pop rax
sbb dword [rbx], eax
add byte [rbp + 0x5000031b], bh
push rax
push rax
sub al, byte [rax + rax]
rcr byte [rbx], 3
add byte [rdi - 0x77fffce4], dl
sub al, byte [rax + rax]
mov esp, 0x7200031c
add eax, dword [rax]
jb 0x180080c7f
add eax, dword [rax]
or al, 0x2a
add eax, dword [rax]
jb 0x180080c7f
add eax, dword [rax]
or al, 0x2a
add al, 0
je 0x180080c87
add eax, dword [rax]
jno 0x180080c8d
add eax, dword [rax]
mov esp, 0x7400042a
invalid
add byte [rax + 0x21], bh
add eax, dword [rax]
retf
add byte [rax], al
add al, 0
int3
and dword [rbx], eax
add byte [rsi + 0x23], bl
add eax, dword [rax]
pushfq
sub dword [rax + rax], eax
invalid
movabs byte [0xa400042a38000326], al
add eax, dword es:[rax]
retf
add al, 0
int3
invalid
invalid
Function at 0x180013ba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, rdx
mov rdi, rcx
xor ebx, ebx
movsxd rsi, r8d
lea r9, [rsp + 0x30]
lea r8d, [rbx + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180013c14
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.180024b90
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov eax, ebx
jmp 0x180013c1c
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180024b60
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1800145c9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp rcx, rdx
ja 0x180014664
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, r9
mov r9, rcx
mov ecx, dword [r8]
lea eax, [rcx + 0x12]
mov rbx, r8
mov dword [rsp + 0x28], 0x3649257c
mov word [rsp + 0x2c], 0x5834
mov byte [rsp + 0x2e], 0
mov dword [rsp + 0x20], 0x34364925
mov word [rsp + 0x24], 0x58
cmp eax, 0xf4240
jae 0x18001464d
mov edx, 0x12
lea r8, [rsp + 0x28]
test ecx, ecx
jne 0x18001462e
lea r8, [rsp + 0x20]
add rcx, rdi
call fcn.180026600
mov edx, dword [rbx]
or rax, 0xffffffffffffffff
lea rcx, [rdi + rdx]
inc rax
cmp byte [rcx + rax], 0
jne 0x180014640
add eax, edx
mov dword [rbx], eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180024b60
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
repz ret
Function at 0x180015b30
Capabilities:
Create thread

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor r8d, r8d
lea rax, [r11 - 0x28]
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], r8
test edx, edx
je 0x180015bc4
lea rax, [r11 - 0x20]
mov dword [r11 - 0x20], r8d
lea r9, [r11 - 0x38]
mov qword [r11 - 0x40], rax
mov dword [r11 - 0x48], r8d
lea r8, [0x180015b10]
xor edx, edx
xor ecx, ecx
mov qword [r11 - 8], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp eax, 0xffffffff
je 0x180015ba8
test rax, rax
je 0x180015ba8
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180024b60
add rsp, 0x68
ret
call rcx
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180024b60
add rsp, 0x68
ret

Function at 0x1800231e0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor edi, edi
cmp dword [0x18007bf64], 0x40
mov rbp, r8
mov rbx, rdx
mov r14, rcx
mov esi, edi
jae 0x18002335a
mov rax, qword [0x18007c070]
test rax, rax
je 0x18002323b
call rax
mov rsi, rax
test rax, rax
jne 0x18002331d
add rbx, r14
mov eax, 0x80000000
cmp rbx, rax
jae 0x18002324f
mov ebx, 1
jmp 0x180023256
sub rbx, 0x7fff0000
add rbp, r14
cmp rbp, 0xffffffff80000000
jae 0x18002326b
add rbp, 0x7ff80000
jmp 0x180023272
mov rbp, 0xfffffffffff80000
xor edx, edx
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x50], edi
lea r8d, [rdx + 0x2c]
call fcn.18002add0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp rbx, rbp
jae 0x18002335a
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180023318
cmp dword [rsp + 0x40], 0x10000
jne 0x180023306
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xa8
jb 0x18002330b
mov eax, dword [rsp + 0x78]
mov r8d, eax
cmp rcx, rax
jb 0x18002330b
dec eax
xor edx, edx
mov r9d, 0x20
add rax, rbx
div r8
mov edx, 0xa8
imul rax, r8
mov rcx, rax
call fcn.1800023b0
mov rsi, rax
test rax, rax
jne 0x18002331d
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x20]
add rbx, rcx
cmp rbx, rbp
jb 0x1800232a0
test rsi, rsi
je 0x18002335a
lea rcx, [0x18007c150]
mov rax, rcx
cmp qword [rax], 0
je 0x18002333a
inc edi
add rax, 8
cmp edi, 0x40
jb 0x180023327
jmp 0x18002335a
inc dword [0x18007bf64]
mov eax, edi
mov qword [rcx + rax*8], rsi
mov rax, qword [0x18007bf68]
test rax, rax
je 0x18002335a
mov rdx, rsi
mov rcx, r14
call rax
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180024b60
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180024420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
sub rsp, 0x1e0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180047520]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r15d, r8d
mov r13d, edx
movsxd rsi, ecx
mov eax, 1
xchg dword [0x18007c078], eax
cmp eax, 1
jne 0x18002449b
nop dword [rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
xchg dword [0x18007c078], eax
cmp eax, 1
je 0x180024480
mov r14, rsi
lea r12, [0x180000000]
shl r14, 8
test r13d, r13d
je 0x1800244db
lea rax, [r12 + 0x7c350]
add rax, r14
or rdi, 0xffffffffffffffff
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800244c0
test rcx, rcx
je 0x1800244fb
xor ebx, ebx
xchg dword [0x18007c078], ebx
jmp 0x180024674
lea rax, [r12 + 0x7ce50]
add rax, r14
or rdi, 0xffffffffffffffff
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800244f0
jmp 0x1800244c9
xor edx, edx
mov r8d, 0xff
lea rcx, [rbp - 0x2f]
call fcn.18002add0
mov dword [rbp - 0x30], 0x61636f4c
mov word [rbp - 0x2c], 0x5c6c
mov byte [rbp - 0x2a], 0
mov dword [rsp + 0x48], 0x4e565354
mov byte [rsp + 0x4c], 0
lea r8, [rsp + 0x48]
mov edx, pe_nt_image_headers64
lea rcx, [rbp - 0x30]
call fcn.180025d08
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], bl
cmp byte [rbp - 0x30], bl
jne 0x180024565
mov r8d, ebx
jmp 0x180024579
lea rax, [rbp - 0x30]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x180024570
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x28]
call fcn.1800013c0
nop
test r15d, r15d
jne 0x18002459d
mov word [rbp - 0x50], 0x6425
mov byte [rbp - 0x4e], r15b
lea rdx, [rbp - 0x50]
jmp 0x1800245d9
cmp r15d, 1
jne 0x1800245b9
mov dword [rsp + 0x70], 0x25256425
mov word [rsp + 0x74], 0x64
lea rdx, [rsp + 0x70]
jmp 0x1800245d9
cmp r15d, 2
jne 0x1800245e5
mov dword [rsp + 0x50], 0x25256425
mov dword [rsp + 0x54], 0x64252564
mov byte [rsp + 0x58], 0
lea rdx, [rsp + 0x50]
mov r8d, esi
lea rcx, [rbp - 0x70]
call fcn.1800164a0
cmp byte [rbp - 0x70], 0
jne 0x1800245f0
mov rdi, rbx
jmp 0x1800245fd
lea rax, [rbp - 0x70]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800245f4
mov r8, rdi
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x28]
call fcn.180016500
lea r8, [rsp + 0x28]
mov edx, pe_nt_image_headers64
test r13d, r13d
lea rdi, [r12 + 0x7c350]
jne 0x18002462d
lea rdi, [r12 + 0x7ce50]
cmp qword [rsp + 0x40], 0x10
cmovae r8, qword [rsp + 0x28]
add rdi, r14
mov rcx, rdi
call fcn.180025958
mov ecx, ebx
xchg dword [0x18007c078], ecx
cmp qword [rsp + 0x40], 0x10
jb 0x18002465e
mov rcx, qword [rsp + 0x28]
call fcn.180025210
mov qword [rsp + 0x40], 0xf
mov qword [rsp + 0x38], rbx
mov byte [rsp + 0x28], 0
mov rax, rdi
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180024b60
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180004fa0
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, qword [0x18000d9c8]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 0xa
jb 0x1800051b2
cmp qword [0x18000d9d0], 0xf
xorps xmm0, xmm0
mov qword [rsp + 0x68], rbx
xorps xmm1, xmm1
mov qword [rsp + 0x70], rbp
mov ebx, 0xf
mov qword [rsp + 0x48], rdi
lea rbp, [rsi + 0xa]
mov qword [rsp + 0x40], r14
lea rdi, [rsp + 0x20]
lea r14, [0x18000d9b8]
cmova r14, qword [0x18000d9b8]
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
cmp rbp, rbx
jbe 0x180005090
mov rbx, rbp
or rbx, 0xf
cmp rbx, rcx
jbe 0x180005052
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.1800070d4
test rax, rax
je 0x180005113
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000508b
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x18000506b
xor edi, edi
jmp 0x18000508b
cmp rcx, 0x1000
jb 0x180005083
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800051b8
jmp 0x180005033
call fcn.1800070d4
mov rdi, rax
mov qword [rsp + 0x20], rdi
mov r8, rsi
mov qword [rsp + 0x30], rbp
mov rdx, r14
mov qword [rsp + 0x38], rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.TJ_app.dll]
lea rcx, [rsp + 0x20]
movsd qword [rdi + rsi], xmm0
movzx eax, word [0x180009638]
mov word [rdi + rsi + 8], ax
mov byte [rdi + rbp], 0
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdx, qword [rsp + 0x38]
mov rbx, rax
cmp rdx, 0xf
jbe 0x18000511f
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000511a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000511a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800070a0
movdqa xmm0, xmmword [0x1800097f0]
mov byte [rsp + 0x20], 0
movdqu xmmword [rsp + 0x30], xmm0
test rbx, rbx
jne 0x18000515c
mov r9d, 0x10
lea r8, str.error__TeamsJack
lea rdx, str.application_dll_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.Start
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x180005196
mov r9d, 0x10
lea r8, str.error__TeamsJack
lea rdx, str.invalid_dll
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x50
pop rsi
jmp rax
call fcn.180001390
int3
call fcn.1800012f0
int3
Function at 0x180005250
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800052be
cmp qword [0x18000d9f0], 0xf
lea rcx, [0x18000d9d8]
mov r8, qword [0x18000d9e8]
cmova rcx, qword [0x18000d9d8]
cmp r8, 0xc
jne 0x1800052be
lea rdx, str.ms_teams.exe
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800052be
call fcn.180003fd0
test al, al
je 0x1800052be
xor eax, eax
lea r8, [0x1800051c0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180005660
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180005688
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800056ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800056b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180005709
test ecx, ecx
jle 0x1800056e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180005709
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180005709
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret