joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018fb0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rcx, qword [0x140021620]
call fcn.140014ea0
mov rcx, qword [0x140021620]
call fcn.14000b160
mov rcx, qword [0x140021620]
call fcn.140016a80
mov rax, qword [0x140021630]
xor ebp, ebp
test rax, rax
jne 0x1400190b7
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140019098
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140019098
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x224a0163
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140019093
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140019070
cmp edx, 0xfb015cbb
je 0x1400191b9
test r8d, r8d
jne 0x140019050
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400190ad
cmp qword [rax + 0x30], rbp
jne 0x140019020
mov rax, rbp
mov qword [0x140021630], rax
mov qword [rsp + 0x28], rbp
lea r8, [0x1400066e0]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call rax
mov rax, qword [0x140021628]
test rax, rax
jne 0x140019193
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140019174
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140019174
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x9c10a5eb
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14001916f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140019150
cmp edx, 0x97d11573
je 0x1400191d5
test r8d, r8d
jne 0x140019130
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140019189
cmp qword [rax + 0x30], rbp
jne 0x140019100
mov rax, rbp
mov qword [0x140021628], rax
mov qword [rsp + 0x28], rbp
lea r8, [0x140011100]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call rax
mov rcx, qword [0x140021620]
call fcn.140011560
int3
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400190b0
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14001918c
Function at 0x140019208
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140019242
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140019247
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140019290
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14001c3a0]
cmp byte [rcx + rax], 0
je 0x140019290
dec r8
sub rdx, 1
jne 0x140019276
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14001a0e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a12e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a12e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a12e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a12e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a12e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001a130
xor al, al
add rsp, 0x28
ret
Function at 0x140003bc8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 5]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 5
jb 0x140003bce
mov rax, rcx
ret

Function at 0x140003be4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x30]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x18
jb 0x140003bea
mov rax, rcx
ret

Function at 0x140003c08
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xa]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 5
jb 0x140003c0e
mov rax, rcx
ret
Function at 0x4015dd
Capabilities:
Create thread
Hide graphical window
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
call sym.__main
mov dword [rbp - 0x34], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
movabs rax, 0x6e6f437465472340
mov qword [rbp - 0x80], rax
movabs rax, 0x646e6957656c6f73
mov qword [rbp - 0x78], rax
movabs rdx, 0x6e6f43746547776f
mov qword [rbp - 0x70], rdx
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x48], rax
mov word [rbp - 0x40], 0x776f
mov byte [rbp - 0x3e], 0
lea rdx, section..rdata
lea rcx, str.userdemo.png
call sym.fopen
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.ftell
cdqe
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 8]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sym.malloc
mov qword [rbp - 0x28], rax
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 8]
mov r9, rcx
mov r8d, 1
mov rcx, rax
call sym.fread
mov rax, qword [rbp - 0x20]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp - 0x30], rax
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x28]
lea rcx, [rbp - 0x80]
mov r9d, 0x43
mov r8, rcx
mov rcx, rax
call dbg.XOR(char*, unsigned long long, char*, unsigned long long)
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call sym.memmove
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x34]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0
je 0x4017a7
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0xb0
pop rbp
ret
Function at 0x401ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00407624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x401e68
mov rax, qword [0x00407628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x401d2c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x401db5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x401d10
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401e9d
mov rax, qword [0x00407628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00407628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401e80
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401dae
sub eax, 0x40
and eax, 0xffffffbf
jne 0x401e10
add dword [0x00407624], 1
cmp edi, 8
jae 0x401de3
test dil, 4
jne 0x401e54
test edi, edi
je 0x401dd8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x401e6f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x401dd8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x401dfc
jmp 0x401dd8
add rsi, qword [0x00407628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x401dae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x401dd8
xor esi, esi
jmp 0x401d37
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x401dd8
mov rax, qword [0x00407628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x4025f0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004078e0]
test rbx, rbx
je 0x402644
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x40263b
test rsi, rsi
je 0x40263b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402620
lea rcx, [0x00407900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x402880
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402890
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x4028a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x4028e1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4028d8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x4028e3
add rax, 0x28
cmp rax, r9
jne 0x4028c4
xor eax, eax
ret

Function at 0x402980
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00404340]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x4029ed
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4029ed
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x4029ed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x4029e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4029ef
add rax, 0x28
cmp rax, r9
jne 0x4029d0
xor eax, eax
add rsp, 0x28
ret

Function at 0x402af0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00404340]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x402b10
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402b08
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x402b6d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x402b64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402b74
add rax, 0x28
cmp rax, r9
jne 0x402b50
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x402b90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00404340]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x402bfe
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402bfe
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x402bfe
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402bfe
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x402bf5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x402c05
add rcx, 0x28
cmp rcx, rax
jne 0x402be0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x402c18
jmp 0x402bfe
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x402c26
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x402bfe
test r9d, r9d
jg 0x402c10
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x402eb0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001a40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140002820
nop
cmp dword [0x14000c130], 1
je 0x1400019ec
mov dword [0x14000c12c], 1
mov byte [0x14000c128], r12b
test ebx, ebx
jne 0x1400019d8
mov rcx, qword [0x14000d1c0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400019c5
mov rcx, qword [0x14000d1b8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140001964
call fcn.140002050
cmp qword [rdi], rax
jne 0x140001964
jmp 0x14000194a
cmp rdi, rsi
jb 0x1400019c5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140002050
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14000d1c0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14000d1b8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400019a3
cmp r13, rax
je 0x1400019c3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000194a
lea rdx, [0x140008238]
lea rcx, [0x140008230]
call fcn.140001794
lea rdx, [0x140008248]
lea rcx, [0x140008240]
call fcn.140001794
nop
test r12d, r12d
je 0x1400019fb
mov ecx, 8
call fcn.140002720
test r12d, r12d
jne 0x140001a26
mov dword [0x14000c130], 1
lea ecx, [r12 + 8]
call fcn.140002720
mov ecx, r15d
call fcn.140001728
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400018b4

Function at 0x140001a4c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400018b4
Function at 0x140001e97
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000b010]
jne 0x1400016ea
rol rcx, 0x10
test cx, 0xffff
jne 0x1400016e6
repz ret
ror rcx, 0x10
jmp 0x140001df0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000c1f0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14000c2e8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001e75
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000c1f0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001e97
mov rax, qword [rsp + 0x88]
mov qword [0x14000c2e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000c288], rax
mov rax, qword [0x14000c2e8]
mov qword [0x14000c160], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000c270], rax
mov dword [0x14000c150], 0xc0000409
mov dword [0x14000c154], 1
mov rax, qword [0x14000b010]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000b018]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000c1e8], eax
mov ecx, 1
call fcn.140003e90
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140008298]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000c1e8], 0
jne 0x140001f1e
mov ecx, 1
call fcn.140003e90
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140004e00
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140002050
xor ebx, ebx
mov rdi, rax
cmp qword [0x14000ce00], rbx
jne 0x140004f06
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140004fdb
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004fdb
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000ce00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000ce08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14000ce10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14000ce20], rax
test rax, rax
je 0x140004efd
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14000ce18], rax
jmp 0x140004f0d
mov rax, qword [0x14000ce18]
jmp 0x140004f14
mov rax, qword [0x14000ce18]
mov r11, qword [0x14000ce20]
cmp rax, rdi
je 0x140004f7c
cmp r11, rdi
je 0x140004f7c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14000ce20]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140004f7c
test rax, rax
je 0x140004f7c
call rsi
test rax, rax
je 0x140004f76
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140004f76
test byte [rsp + 0x38], 1
jne 0x140004f7c
bts ebp, 0x15
jmp 0x140004fba
mov rcx, qword [0x14000ce08]
cmp rcx, rdi
je 0x140004fba
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140004fba
call rax
mov rbx, rax
test rax, rax
je 0x140004fba
mov rcx, qword [0x14000ce10]
cmp rcx, rdi
je 0x140004fba
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140004fba
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000ce00]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140004fdb
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140004fdd
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140002bc0
Capabilities:
Encrypt data using aes
Encrypt data using rc4 prga
Reference aes constants

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140254018]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r11, rdx
mov r10, rcx
xor r9d, r9d
mov rax, rcx
test r9b, r9b
je 0x140002c10
movzx r8d, r9b
nop
movzx ecx, byte [rax + 2]
movzx edx, byte [rax + 3]
mov byte [rax + 3], cl
movzx ecx, byte [rax + 1]
mov byte [rax + 2], cl
movzx ecx, byte [rax]
mov byte [rax + 1], cl
mov byte [rax], dl
sub r8, 1
jne 0x140002bf0
inc r9d
add rax, 4
cmp r9d, 4
jl 0x140002be5
movzx eax, byte [r10]
lea rcx, [0x140222960]
movdqu xmm0, xmmword [r11]
lea rbx, [r10 + 8]
mov edi, 4
movzx eax, byte [rax + rcx]
mov byte [r10], al
movzx eax, byte [r10 + 1]
movzx eax, byte [rax + rcx]
mov byte [r10 + 1], al
movzx eax, byte [r10 + 2]
movzx eax, byte [rax + rcx]
mov byte [r10 + 2], al
movzx eax, byte [r10 + 3]
movzx eax, byte [rax + rcx]
mov byte [r10 + 3], al
movzx eax, byte [r10 + 4]
movzx eax, byte [rax + rcx]
mov byte [r10 + 4], al
movzx eax, byte [r10 + 5]
movzx eax, byte [rax + rcx]
mov byte [r10 + 5], al
movzx eax, byte [r10 + 6]
movzx eax, byte [rax + rcx]
mov byte [r10 + 6], al
movzx eax, byte [r10 + 7]
movzx eax, byte [rax + rcx]
mov byte [r10 + 7], al
movzx eax, byte [rbx]
movzx eax, byte [rax + rcx]
mov byte [rbx], al
movzx eax, byte [r10 + 9]
movzx eax, byte [rax + rcx]
mov byte [r10 + 9], al
movzx eax, byte [r10 + 0xa]
movzx eax, byte [rax + rcx]
mov byte [r10 + 0xa], al
movzx eax, byte [r10 + 0xb]
movzx eax, byte [rax + rcx]
mov byte [r10 + 0xb], al
movzx eax, byte [r10 + 0xc]
movzx eax, byte [rax + rcx]
mov byte [r10 + 0xc], al
movzx eax, byte [r10 + 0xd]
movzx eax, byte [rax + rcx]
mov byte [r10 + 0xd], al
movzx eax, byte [r10 + 0xe]
movzx eax, byte [rax + rcx]
mov byte [r10 + 0xe], al
movzx eax, byte [r10 + 0xf]
movzx eax, byte [rax + rcx]
mov byte [r10 + 0xf], al
movdqu xmm1, xmmword [r10]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
nop word [rax + rax]
movzx eax, byte [rbx - 8]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], al
movzx eax, byte [rbx - 4]
mov byte [rsp + 0x21], al
movzx eax, byte [rbx]
mov byte [rsp + 0x22], al
movzx eax, byte [rbx + 4]
mov byte [rsp + 0x23], al
call fcn.140002630
movzx eax, byte [rsp + 0x20]
mov byte [rbx - 8], al
lea rbx, [rbx + 1]
movzx eax, byte [rsp + 0x21]
mov byte [rbx - 5], al
movzx eax, byte [rsp + 0x22]
mov byte [rbx - 1], al
movzx eax, byte [rsp + 0x23]
mov byte [rbx + 3], al
sub rdi, 1
jne 0x140002d10
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140005870
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret