joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000704c
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rdx
mov r12, rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call fcn.18001c0d0
xor edx, edx
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800070bc
xor eax, eax
jmp 0x180007163
mov dword [rsp + 0x40], 0x238
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rbx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180006aa0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000714d
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x6c]
call fcn.18001ce80
test eax, eax
je 0x18000711c
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800070f2
lea ebx, [rax + 1]
jmp 0x18000714d
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8, r12
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x180007157
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x20]
call fcn.180006c3c
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18001bbd0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x18000718c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xb8]
sub rsp, 0x1b0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r13
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov rbx, rcx
mov esi, 1
cmp byte [0x1800500a8], 0
jne 0x1800072f0
mov byte [rbp - 0x70], 0
xor edx, edx
mov r8d, 0x103
lea rcx, [rbp - 0x6f]
call fcn.18001c0d0
mov r9d, esi
lea r8d, [rsi + 0x19]
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x1800072d0
lea r13d, [rsi + 0xe]
mov qword [rbp - 0x80], r13
and qword [rsp + 0x78], 0
mov byte [rsp + 0x68], 0
lea rcx, str.config_systemprofile
call fcn.18001c010
mov r8, rax
lea rdx, str.config_systemprofile
lea rcx, [rsp + 0x68]
call fcn.180003020
nop
mov qword [rsp + 0x58], r13
and qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
lea rcx, [rbp - 0x70]
call fcn.18001c010
mov r8, rax
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.180003020
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x78]
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.180003c30
movzx ecx, byte [0x1800500a8]
cmp rax, 0xffffffffffffffff
cmovne ecx, esi
mov byte [0x1800500a8], cl
cmp qword [rsp + 0x58], 0x10
jb 0x1800072af
mov rcx, qword [rsp + 0x40]
call fcn.18001c1c4
mov qword [rsp + 0x58], r13
and qword [rsp + 0x50], 0
mov byte [rsp + 0x40], 0
cmp qword [rbp - 0x80], 0x10
jb 0x1800072d0
mov rcx, qword [rsp + 0x68]
call fcn.18001c1c4
cmp byte [0x1800500a8], 0
jne 0x1800072f0
xor r9d, r9d
lea r8d, [r9 + 0x1a]
mov rdx, qword [rbx]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov al, sil
jmp 0x18000732d
and qword [rsp + 0x30], 0
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x30]
call fcn.18000704c
test eax, eax
je 0x18000732d
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov r8, qword [rsp + 0x30]
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
sete al
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.18001bbd0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r13, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800073c4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor edi, edi
lea rax, [rsp + 0x20]
mov rbx, rcx
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x50], rdi
mov qword [rcx + 0x58], rdi
mov qword [rcx + 0x60], rdi
mov qword [rcx + 0x70], rdi
mov qword [rcx + 0x78], rdi
mov qword [rcx + 0x80], rdi
mov qword [rcx + 0x88], rdi
mov qword [rcx + 0x48], rdi
test rax, rax
je 0x180007457
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x180007451
call rax
jmp 0x180007457
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x20], 9
je 0x18000746e
cmp word [rsp + 0x20], 6
lea rax, [0x18003ff50]
jne 0x180007475
lea rax, [0x18003ff4c]
mov rcx, rbx
mov qword [rbx + 0x10], rax
call fcn.180006c8c
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x18000d470
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rbp + 0x10], rax
lea rcx, [rsp + 0x30]
call fcn.1800073c4
nop
lea rcx, [rbp - 0x18]
call fcn.18000d42c
nop
mov esi, recv
mov qword [rbp - 0x28], rsi
xor ebx, ebx
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x40], bl
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x40]
call fcn.180003118
nop
lea rcx, str.install.cfg
call fcn.18001c010
mov r8, rax
lea rdx, str.install.cfg
lea rcx, [rbp - 0x40]
call fcn.180006208
cmp qword [rbp - 8], rbx
ja 0x18000d53e
cmp qword [rbp - 0x28], 0x10
jb 0x18000d513
mov rcx, qword [rbp - 0x40]
call fcn.18001c1c4
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x40], bl
cmp qword [rbp], 0x10
jb 0x18000d52e
mov rcx, qword [rbp - 0x18]
call fcn.18001c1c4
mov qword [rbp], rsi
mov qword [rbp - 8], rbx
mov byte [rbp - 0x18], bl
jmp 0x18000d5fc
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18000d5c2
and eax, 0x10
test al, al
jne 0x18000d5c2
mov ecx, 0xa0
call fcn.18001c2b0
mov qword [rsp + 0x20], rax
test rax, rax
je 0x18000d57f
mov rcx, rax
call fcn.1800082b4
mov rdi, rax
jmp 0x18000d582
mov rdi, rbx
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rdx, qword [rbp - 0x40]
mov rcx, rdi
call fcn.180008570
mov rcx, rdi
call fcn.180008bec
lea r8, str.install
lea rdx, str.config
mov rcx, rdi
call fcn.1800093cc
mov rcx, rax
call fcn.18001ccdc
mov edi, eax
jmp 0x18000d5c4
mov edi, ebx
cmp qword [rbp - 0x28], 0x10
jb 0x18000d5d4
mov rcx, qword [rbp - 0x40]
call fcn.18001c1c4
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x40], bl
cmp qword [rbp], 0x10
jb 0x18000d5ef
mov rcx, qword [rbp - 0x18]
call fcn.18001c1c4
mov qword [rbp], rsi
mov qword [rbp - 8], rbx
mov byte [rbp - 0x18], bl
mov ebx, edi
lea rcx, [rsp + 0x30]
call fcn.180007490
mov eax, ebx
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.18001bbd0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180011a00
Capabilities:
Hide graphical window
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0xe0]
test rcx, rcx
je 0x180011a35
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
or qword [rbx + 0xe0], 0xffffffffffffffff
mov rcx, qword [rbx + 0xe8]
cmp rcx, 0xffffffffffffffff
je 0x180011a62
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0xe8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
or qword [rbx + 0xe8], 0xffffffffffffffff
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x180011a82
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_DestroyWindow]
and qword [rbx + 0x40], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180011aa4
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
and dword [rdx], 0
and dword [rdx + 4], 0
cmp byte [rcx + 0x60], 0
mov rdi, rdx
mov rbx, rcx
jne 0x180011aca
mov rcx, qword [rcx + 0xd8]
jmp 0x180011b27
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x180011b20
cmp qword [rbx + 0x58], 0
je 0x180011b20
cmp qword [rbx + 0xd8], 0
jne 0x180011b3a
lea r8, [0x180040390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx + 0xd8], rax
test rax, rax
je 0x180011b3a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180011b3a
mov rcx, qword [rbx + 0xd8]
mov byte [rbx + 0x60], 0
jmp 0x180011b2c
mov rcx, qword [rbx + 0xd8]
test rcx, rcx
je 0x180011b3a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rbx + 0xd8], 0
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180011cdc
Capabilities:
Check mutex on windows
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rsi, rdx
mov rdi, rcx
call fcn.180011108
xor ebx, ebx
test rsi, rsi
je 0x180011ef2
cmp qword [0x1800500c0], rbx
jne 0x180011d2d
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1800500c0], rax
mov rax, qword [rsi]
lea r8, [rbp + 0x6f]
lea rdx, [0x180039840]
mov rcx, rsi
mov qword [rbp + 0x6f], rbx
call qword [rax]
test eax, eax
js 0x180011edd
cmp qword [rbp + 0x6f], rbx
je 0x180011edd
lea r8, [0x180040390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi + 0xc8], rax
test rax, rax
je 0x180011d97
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180011d97
mov rcx, qword [rdi + 0xc8]
mov byte [rdi + 0x50], bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0xc8], rbx
mov rcx, qword [rbp + 0x6f]
mov byte [rdi + 0x50], bl
mov qword [rdi + 0x38], rbx
mov rax, qword [rcx]
lea rdx, [rdi + 0x38]
call qword [rax + 0x18]
test eax, eax
js 0x180011ed3
xor edx, edx
lea rcx, [rbp - 0x11]
lea r8d, [rdx + 0x40]
call fcn.18001c0d0
mov edx, 0x7f00
xor ecx, ecx
mov dword [rbp - 0x19], recv
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [rbp + 0xf], rax
mov rax, qword [0x1800501d0]
mov qword [rbp - 1], rax
lea rax, [0x1800127b8]
mov qword [rbp - 0x11], rax
call fcn.18001a418
lea r14, [0x18003d390]
cmp qword [rax + 0x28], rbx
mov rcx, r14
cmovne rcx, qword [rax + 0x28]
mov qword [rbp + 0x27], rcx
mov ecx, 0xffff
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
lea rcx, [rbp - 0x19]
mov qword [rbp + 0x17], rax
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
jne 0x180011e35
mov eax, 0x80004005
jmp 0x180011ef4
mov byte [rdi + 0x51], 1
call fcn.18001a418
lea r13, [rdi - 0x10]
cmp qword [rax + 0x28], rbx
mov qword [rsp + 0x58], r13
mov r9d, 0x46000000
cmovne r14, qword [rax + 0x28]
mov rax, qword [0x1800501d0]
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov rax, qword [rdi + 0x38]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov rdx, r14
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rdi + 0x30], rax
test rax, rax
je 0x180011ed3
lea r8, [0x180011c54]
mov r9, r13
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rdi + 0x30]
xor r9d, r9d
mov edx, 0x2b14
mov r8d, 0xa4cb80
mov qword [rdi + 0xd0], rax
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [rbp + 0x6f]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, qword [rsi]
lea r8, [rdi + 0x18]
lea rdx, [0x1800397c0]
mov rcx, rsi
call qword [rax]
mov ebx, eax
mov eax, ebx
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x180014000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rbp + 0x140], rax
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x180014115
jmp 0x1800140c7
mov rcx, rdi
call fcn.18001e638
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.18001e638
lea rcx, [rbx + rax + 2]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.18001ad70
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.18001e680
lea rdx, [0x18004038c]
mov rcx, rbx
call fcn.18001e654
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.18001e654
mov rdx, rbx
mov rcx, rsi
call fcn.180014000
mov rcx, rbx
call fcn.18001c1bc
xor ebx, ebx
lea rcx, [rsp + 0x42]
mov r8d, 0x1f4
xor edx, edx
mov word [rsp + 0x40], bx
call fcn.18001c0d0
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0xfb
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x180014053
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.18001bbd0
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001e69c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x18001e6c6
call fcn.18001cd50
and dword [rax], 0
call fcn.18001cd30
mov ebx, socket
mov dword [rax], ebx
call fcn.180023c34
mov eax, ebx
jmp 0x18001e716
test edx, 0xfffffff9
jne 0x18001e6a9
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18001e6ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18001cd70
call fcn.18001cd30
mov eax, dword [rax]
jmp 0x18001e716
test al, 0x10
jne 0x18001e714
test al, 1
je 0x18001e714
test bl, 2
je 0x18001e714
call fcn.18001cd50
mov dword [rax], 5
call fcn.18001cd30
mov dword [rax], recv
jmp 0x18001e6e6
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180022c6f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18004b8d8]
jne 0x18001bbea
rol rcx, 0x10
test cx, 0xffff
jne 0x18001bbe6
repz ret
ror rcx, 0x10
jmp 0x180022bc8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18004f060]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18004f158]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180022c4d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18004f060]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180022c6f
mov rax, qword [rsp + 0x88]
mov qword [0x18004f158], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18004f0f8], rax
mov rax, qword [0x18004f158]
mov qword [0x18004efd0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18004f0e0], rax
mov dword [0x18004efc0], 0xc0000409
mov dword [0x18004efc4], 1
mov rax, qword [0x18004b8d8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18004b8e0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18004f058], eax
mov ecx, 1
call fcn.18003050c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18003a940]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18004f058], 0
jne 0x180022cf6
mov ecx, 1
call fcn.18003050c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180033eac
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18004b8d8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180024d88
xor ebx, ebx
cmp qword [0x180050078], rbx
mov rdi, rax
jne 0x180033fbf
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180034096
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180034096
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180050078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180050080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180050088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180050098], rax
test rax, rax
je 0x180033fb6
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180050090], rax
jmp 0x180033fc6
mov rax, qword [0x180050090]
jmp 0x180033fcd
mov rax, qword [0x180050090]
mov r11, qword [0x180050098]
cmp rax, rdi
je 0x180034034
cmp r11, rdi
je 0x180034034
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180050098]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180034034
test rax, rax
je 0x180034034
call rsi
test rax, rax
je 0x18003402e
lea rcx, [rsp + 0x30]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18003402e
test byte [rsp + 0x40], 1
jne 0x180034034
bts ebp, 0x15
jmp 0x180034074
mov rcx, qword [0x180050080]
cmp rcx, rdi
je 0x180034074
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180034074
call rax
mov rbx, rax
test rax, rax
je 0x180034074
mov rcx, qword [0x180050088]
cmp rcx, rdi
je 0x180034074
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180034074
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180050078]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180034096
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180034098
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18001bbd0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140027590]
mov dword [rax], 1
mov rax, qword [0x1400275a0]
mov dword [rax], 1
mov rax, qword [0x1400275b0]
mov dword [rax], 1
mov rax, qword [0x140027580]
mov dword [rax], 1
mov rax, qword [0x140027430]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140004766
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp - 8], 0
cmp qword [rbp + 0x18], 0
je 0x140004796
mov rax, qword [rbp + 0x18]
mov rcx, rax
call sym.nimCStrLen
mov rdx, rax
jmp 0x14000479b
mov edx, 0
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret

Function at 0x14000e6fe
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp - 8], 0
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, qword [rbp + 0x10]
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov qword [rbp - 8], rax
mov dword [rbp - 0xc], 0
mov rcx, qword [rbp + 0x10]
call sym.fflush
mov dword [rbp - 0xc], eax
nop
add rsp, 0x30
pop rbp
ret