joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800918e8
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x18009196e
cmp rax, 0xffffffffffffffff
je 0x180091982
and dword [rsp + 0x60], 0
and dword [rsp + 0x58], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18009196e
cmp dword [rsp + 0x58], 4
jne 0x18009196e
cmp dword [rsp + 0x60], 0x21726152
jne 0x18009196e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180091984
cmp rbx, 0xffffffffffffffff
je 0x180091982
test rbx, rbx
je 0x180091982
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x18009198c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x80e0
call fcn.1800b3cb0
sub rsp, rax
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x80d0], rax
mov rsi, rcx
lea rcx, str.unrar64.dll
mov ebp, r9d
mov rdi, r8
call fcn.18009178c
mov rbx, rax
test rax, rax
jne 0x1800919da
mov eax, 0x453
jmp 0x180091ada
lea rdx, str.RAROpenArchiveEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARCloseArchive
mov rcx, rbx
mov qword [0x18010c6a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARReadHeaderEx
mov rcx, rbx
mov qword [0x18010c6a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARProcessFileW
mov rcx, rbx
mov qword [0x18010c6b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RARSetPassword
mov rcx, rbx
mov qword [0x18010c6b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, qword [0x18010c6a0]
mov qword [0x18010c6c0], rax
test rbx, rbx
je 0x180091ad5
cmp qword [0x18010c6a8], 0
je 0x180091ad5
cmp qword [0x18010c6b0], 0
je 0x180091ad5
cmp qword [0x18010c6b8], 0
je 0x180091ad5
test rax, rax
je 0x180091ad5
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0xa8
call fcn.18009e990
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x40], 0x4000
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x64], rax
call rbx
mov r11, rax
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x180091ada
mov qword [rdi], r11
jmp 0x180091ada
mov eax, 0x454
mov rcx, qword [rsp + 0x80d0]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x8108]
add rsp, 0x80e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800926cc
Capabilities:
Check if file exists
Move file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r12
sub rsp, 0x30
mov rax, qword [rcx + 0x30]
mov rdi, qword [rcx]
mov r12, rcx
mov rbx, qword [rax]
mov ebp, 1
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x10], rbx
mov rsi, qword [r12 + 0x30]
test rdi, rdi
je 0x18009270f
cmp rdi, qword [r12]
je 0x180092714
call fcn.18009a80c
cmp rbx, rsi
je 0x1800927df
test rdi, rdi
jne 0x18009272c
call fcn.18009a80c
xor r11d, r11d
jmp 0x18009272f
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x18009273a
call fcn.18009a80c
cmp qword [rbx + 0x60], 8
jb 0x180092747
mov rcx, qword [rbx + 0x48]
jmp 0x18009274b
lea rcx, [rbx + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800927c4
test rdi, rdi
jne 0x180092764
call fcn.18009a80c
xor r11d, r11d
jmp 0x180092767
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x180092772
call fcn.18009a80c
cmp qword [rbx + 0x38], 8
jb 0x18009277f
mov rsi, qword [rbx + 0x20]
jmp 0x180092783
lea rsi, [rbx + 0x20]
test rdi, rdi
jne 0x180092792
call fcn.18009a80c
xor r11d, r11d
jmp 0x180092795
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x1800927a0
call fcn.18009a80c
cmp qword [rbx + 0x60], 8
jb 0x1800927ad
mov rcx, qword [rbx + 0x48]
jmp 0x1800927b1
lea rcx, [rbx + 0x48]
mov r8d, 1
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1800927c6
xor ebp, ebp
lea rcx, [rsp + 0x20]
call fcn.180056788
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
jmp 0x1800926ff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop r12
ret
Function at 0x180094d64
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov r9, rcx
lea r8, [rsp + 0x10]
mov r10d, sendto
lea rcx, [rdx + 1]
movzx eax, byte [rcx]
movzx edx, byte [rcx - 1]
add rcx, 4
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx - 2]
shl edx, 8
or edx, eax
mov dword [r8], edx
add r8, 4
sub r10, 1
jne 0x180094d8d
lea r10, [rsp + 0x48]
mov r11d, 0x30
mov ecx, dword [r10 - 0x34]
mov edx, dword [r10]
add r10, 4
mov r8d, ecx
mov eax, ecx
shr ecx, 3
rol r8d, 0xe
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
rol eax, 0xd
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r10 - 0x3c]
add r8d, dword [r10 - 0x18]
sub r11, 1
mov dword [r10 + 4], r8d
jne 0x180094dc7
mov edi, dword [r9 + 0x5c]
mov r14d, dword [r9 + 0x50]
mov r10d, dword [r9 + 0x54]
mov r11d, dword [r9 + 0x58]
mov r15d, dword [r9 + 0x60]
mov ebx, dword [r9 + 0x64]
mov ebp, dword [r9 + 0x6c]
mov dword [rsp + 0x150], edi
mov edi, dword [r9 + 0x68]
mov esi, dword [rsp + 0x150]
xor r12d, r12d
lea r13d, [r12 + 0x40]
mov eax, r15d
mov r8d, r15d
mov ecx, r15d
ror r8d, 0xb
rol eax, 7
not ecx
xor r8d, eax
and ecx, edi
mov eax, r15d
ror eax, 6
mov edx, r14d
xor r8d, eax
mov eax, ebx
and eax, r15d
xor ecx, eax
lea rax, [0x1800d4690]
add r8d, ecx
mov ecx, r10d
add r8d, dword [r12 + rax]
xor ecx, r14d
mov eax, r14d
add r8d, dword [rsp + r12 + 0x10]
and ecx, r11d
add r12, 4
add r8d, ebp
ror edx, 0xd
rol eax, 0xa
xor edx, eax
mov eax, r14d
mov ebp, edi
ror eax, 2
mov edi, ebx
mov ebx, r15d
xor edx, eax
mov eax, r10d
lea r15d, [r8 + rsi]
and eax, r14d
mov esi, r11d
mov r11d, r10d
xor ecx, eax
mov r10d, r14d
add edx, ecx
sub r13, 1
lea r14d, [rdx + r8]
jne 0x180094e43
mov eax, dword [r9 + 0x50]
add eax, r14d
mov dword [r9 + 0x50], eax
mov eax, r10d
add eax, dword [r9 + 0x54]
mov dword [r9 + 0x54], eax
mov eax, r11d
add eax, dword [r9 + 0x58]
mov dword [r9 + 0x58], eax
mov eax, dword [r9 + 0x5c]
add eax, esi
mov dword [r9 + 0x5c], eax
mov eax, dword [r9 + 0x60]
add eax, r15d
mov dword [r9 + 0x60], eax
mov eax, ebx
mov rbx, qword [rsp + 0x158]
add eax, dword [r9 + 0x64]
mov dword [r9 + 0x64], eax
mov eax, edi
add eax, dword [r9 + 0x68]
mov dword [r9 + 0x68], eax
mov eax, ebp
add eax, dword [r9 + 0x6c]
mov dword [r9 + 0x6c], eax
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180095220
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
lea r9, str..________.dirty
mov r8d, 1
mov rdx, rcx
lea rcx, [rax - 0x48]
call fcn.18004ff38
mov r11, qword [rsp + 0x90]
mov rbx, qword [r11]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
test rdi, rdi
je 0x180095279
cmp rdi, qword [rsp + 0x60]
je 0x18009527e
call fcn.18009a80c
cmp rbx, rsi
je 0x180095322
test rdi, rdi
jne 0x180095296
call fcn.18009a80c
xor r11d, r11d
jmp 0x180095299
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x1800952a4
call fcn.18009a80c
cmp qword [rbx + 0x38], 8
jb 0x1800952b1
mov rcx, qword [rbx + 0x20]
jmp 0x1800952b5
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
jne 0x1800952c5
call fcn.18009a80c
cmp byte [rbx + 0x41], 0
je 0x1800952d2
call fcn.18009a80c
jmp 0x180095265
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x41], 0
jne 0x1800952fd
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
jne 0x180095265
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x1800952ec
jmp 0x180095265
mov rax, qword [rbx + 8]
cmp byte [rax + 0x41], 0
jne 0x18009531a
cmp rbx, qword [rax + 0x10]
jne 0x18009531a
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x41], 0
je 0x180095307
mov rbx, rax
jmp 0x180095265
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call fcn.18000e860
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
and qword [rsp + 0x90], 0
and qword [rsp + 0x98], 0
mov rcx, qword [rsp + 0x60]
call fcn.18009a864
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180095a8c
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, r8
mov rsi, rdx
lea rcx, [rsp + 0x52]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
call fcn.18009e990
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.drivers
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call fcn.180095220
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x180095b37
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x180095bbf
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.180050e2c
cmp eax, edi
jne 0x180095bbf
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
jne 0x180095bbf
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1800951e0
cmp qword [rsp + 0x40], 8
lea rdx, [rsp + 0x28]
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
je 0x180095ba8
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x180095bad
mov edi, 9
cmp qword [rsp + 0x40], 8
jb 0x180095bbf
mov rcx, qword [rsp + 0x28]
call fcn.18009a864
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180095e5c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
xor r11d, r11d
mov rdi, rcx
mov dword [rsp], 0x2ac3268c
mov dword [rsp + 4], 0x33747d9a
mov dword [rsp + 8], 0xd1de98ac
mov dword [rsp + 0xc], 0x6eee320c
lea ebx, [r11 + 0x20]
lea rsi, [0x180000000]
mov r9d, dword [r11 + rsi + 0xd45d0]
xor r9d, dword [rsp + r11 + 4]
xor r9d, dword [rsp + r11 + 0xc]
xor r9d, dword [rsp + r11 + 8]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + rsi + 0xd44c0]
movzx eax, cl
movzx ecx, byte [rax + rsi + 0xd44c0]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + rsi + 0xd44c0]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + rsi + 0xd44c0]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
rol ecx, 0xd
ror eax, 9
xor ecx, eax
xor ecx, dword [rsp + r11]
xor ecx, r10d
mov dword [rsp + r11 + 0x10], ecx
mov dword [r11 + rdi], ecx
add r11, 4
sub rbx, 1
jne 0x180095e9e
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180095f4c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xb0
mov rbp, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x90
call fcn.18009e990
movzx eax, byte [rbx + 1]
movzx r11d, byte [rbx]
movzx ecx, byte [rbx + 4]
shl r11d, 8
mov esi, 0x20
shl ecx, 8
or r11d, eax
movzx eax, byte [rbx + 2]
shl r11d, 8
lea r12, [0x1800d44c0]
or r11d, eax
movzx eax, byte [rbx + 3]
shl r11d, 8
or r11d, eax
movzx eax, byte [rbx + 5]
or ecx, eax
movzx eax, byte [rbx + 6]
mov dword [rsp + 0x20], r11d
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
mov dword [rsp + 0x24], ecx
movzx ecx, byte [rbx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
mov dword [rsp + 0x28], ecx
movzx ecx, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xf]
lea rbx, [rsp + 0x28]
shl ecx, 8
or ecx, eax
lea rax, [rsp + 0x28]
sub rbp, rax
mov dword [rsp + 0x2c], ecx
mov r9d, dword [rbx + rbp]
xor r9d, dword [rbx - 4]
xor r9d, dword [rbx]
add rbx, 4
xor r9d, dword [rbx]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + r12]
movzx eax, cl
movzx ecx, byte [rax + r12]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + r12]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + r12]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
ror ecx, 0xe
rol eax, 0xa
xor ecx, eax
mov eax, r10d
ror eax, 8
xor ecx, eax
mov eax, r10d
rol eax, 2
xor ecx, eax
xor ecx, dword [rbx - 0xc]
xor ecx, r10d
sub rsi, 1
mov dword [rbx + 4], ecx
jne 0x18009602f
mov ecx, dword [rsp + 0xac]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rdi], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 2], cl
mov ecx, dword [rsp + 0xa8]
mov byte [rdi + 1], al
mov al, byte [rsp + 0xac]
mov byte [rdi + 3], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 4], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 6], cl
mov ecx, dword [rsp + 0xa4]
mov byte [rdi + 5], al
mov al, byte [rsp + 0xa8]
mov byte [rdi + 7], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 8], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 0xa], cl
mov ecx, dword [rsp + 0xa0]
mov byte [rdi + 9], al
mov al, byte [rsp + 0xa4]
mov byte [rdi + 0xb], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 0x10
shr ecx, 8
mov byte [rdi + 0xd], al
mov al, byte [rsp + 0xa0]
mov byte [rdi + 0xe], cl
mov byte [rdi + 0xf], al
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x18009ba57
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180101090]
jne 0x180099ffa
rol rcx, 0x10
test cx, 0xffff
jne 0x180099ff6
repz ret
ror rcx, 0x10
jmp 0x18009b9b0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180107510]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180107608]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18009ba35
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180107510]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18009ba57
mov rax, qword [rsp + 0x88]
mov qword [0x180107608], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1801075a8], rax
mov rax, qword [0x180107608]
mov qword [0x180107480], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180107590], rax
mov dword [0x180107470], 0xc0000409
mov dword [0x180107474], 1
mov rax, qword [0x180101090]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180101098]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180107508], eax
mov ecx, 1
call fcn.18009e970
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800caf68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180107508], 0
jne 0x18009bade
mov ecx, 1
call fcn.18009e970
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18009c56c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18009c3e0
Function at 0x1800a45a0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18009bc48
xor ebx, ebx
mov rdi, rax
cmp qword [0x180108170], rbx
jne 0x1800a46a6
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800a477b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800a477b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180108170], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180108178], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180108180], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180108190], rax
test rax, rax
je 0x1800a469d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180108188], rax
jmp 0x1800a46ad
mov rax, qword [0x180108188]
jmp 0x1800a46b4
mov rax, qword [0x180108188]
mov r11, qword [0x180108190]
cmp rax, rdi
je 0x1800a471c
cmp r11, rdi
je 0x1800a471c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180108190]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800a471c
test rax, rax
je 0x1800a471c
call rsi
test rax, rax
je 0x1800a4716
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800a4716
test byte [rsp + 0x38], 1
jne 0x1800a471c
bts ebp, 0x15
jmp 0x1800a475a
mov rcx, qword [0x180108178]
cmp rcx, rdi
je 0x1800a475a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800a475a
call rax
mov rbx, rax
test rax, rax
je 0x1800a475a
mov rcx, qword [0x180108180]
cmp rcx, rdi
je 0x1800a475a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800a475a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180108170]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800a477b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800a477d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1800a56b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800a56f5
xor al, al
jmp 0x1800a5773
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x50]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x1800a571c
xor al, al
jmp 0x1800a5773
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xe8]
mov rax, qword [rsp + 0x50]
add rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x1800a576b
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rdx, qword [rsp + 0x50]
add rdx, rax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xec]
mov rax, rdx
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x1800a576b
mov al, 1
jmp 0x1800a5773
jmp 0x1800a5771
xor al, al
add rsp, 0x78
ret

Function at 0x1800a57f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1801082d0]
mov qword [rsp + 0x20], rax
jmp 0x1800a5810
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800a5841
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800a583f
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800a5843
jmp 0x1800a5802
xor eax, eax
add rsp, 0x38
ret
Function at 0x1800a5850
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1801082e8], eax
je 0x1800a586c
mov eax, 0x10dd
jmp 0x1800a5987
mov rax, qword [0x180108300]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800a5910
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx edx, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 0x28]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x1800a58e0
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x1800a58e0
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x20]
call fcn.1800a5a00
mov r11, qword [rsp + 0x20]
mov qword [r11 + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x1800a5878
mov qword [0x180108300], 0
call fcn.1800a5990
mov rax, qword [0x1801082f8]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800a5970
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.18009a864
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1800a592c
mov qword [0x1801082f8], 0
mov dword [0x1801082e8], 0
xor eax, eax
add rsp, 0x68
ret