joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ece0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ed83
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.0045b620
nop
test bl, bl
je 0x45ed7d
mov qword [rsp + 0x18], rax
lea rcx, [0x0045edc0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0046dee0
xorps xmm15, xmm15
mov r14, qword [0x0068a390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045ece0

Function at 0x46aec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x46b037
movzx edx, byte [rax]
test edx, edx
jne 0x46aef4
nop dword [rax]
test r8b, r8b
jne 0x46aef4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x46af07
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x46aff7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x46afe5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x46afd7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x46af5d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x46afa0
mov eax, 1
cmp rax, rbx
ja 0x46af8b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004703a0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x46afcf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x46af93
mov rcx, r11
mov eax, r12d
jmp 0x46af62
mov rcx, rbx
call fcn.004702e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004702e0
mov eax, r8d
mov rcx, rbx
call fcn.004703a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46b02d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x46aff0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46af0d
mov eax, edx
mov rcx, rbx
call fcn.004702e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004702e0
nop
int3
Function at 0x46c8e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c98f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00458ce0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046dee0
xorps xmm15, xmm15
mov r14, qword [0x0068a390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0046c8e0
Function at 0x46fe00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404503
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a4a0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4044e0
cmp byte [0x0068a10e], 0
je 0x46fe15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x46d040
jmp 0x4044e0

Function at 0x46fe20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x0068a4a8]
mov eax, dword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0068a4a0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0068a10e], 0
je 0x46fe55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0068a7e0]
aesenc xmm0, xmmword [0x0068a7f0]
aesenc xmm0, xmmword [0x0068a800]
movq rax, xmm0
ret
jmp 0x40a680

Function at 0x46fe60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x0068a4a8]
mov rax, qword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0068a4a0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0068a10e], 0
je 0x46fe96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0068a7e0]
aesenc xmm0, xmmword [0x0068a7f0]
aesenc xmm0, xmmword [0x0068a800]
movq rax, xmm0
ret
jmp 0x40a6c0

Function at 0x471c40
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x471c74
mov rcx, 0x28
jmp 0x471c7f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0068a390], rcx
pop rbp
ret
Function at 0x491720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4917ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004039a0
xorps xmm15, xmm15
mov r14, qword [0x0068a390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4917cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004f8260]
xor ebx, ebx
mov rcx, rdx
call fcn.00469740
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004925e0
inc rbx
cmp rcx, rbx
jae 0x4917be
mov edi, 1
lea rsi, [0x004f8260]
call fcn.00469820
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00554368]
lea rsi, [0x00553790]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00491720

Function at 0x4a1c20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1ccc
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.004039a0
xorps xmm15, xmm15
mov r14, qword [0x0068a390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x4a1c93
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.00450320
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x4a1ca6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x4a1cb9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x4a1ca3
mov byte [rax + rcx], dl
jmp 0x4a1ca3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0046a180
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.004a1c20
Function at 0x4b9520
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b972b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4b9644
cmp rdx, 0x40
ja 0x4b971d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4b95b4
mov rax, rdx
mov rcx, rsi
call fcn.00470c80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4b9620
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004b9960
xorps xmm15, xmm15
mov r14, qword [0x0068a390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4b9715
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4b9647
mov r8, rcx
cmp r8, 0x40
jl 0x4b96c5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004b9960
xorps xmm15, xmm15
mov r14, qword [0x0068a390]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4b9708
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4b9704
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00470c80
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.004703a0
mov rax, rdx
mov ecx, 0x40
call fcn.004703a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046e000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004b9520
Function at 0x1400022e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004770]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002300
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002308
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002300
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000235d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002354
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002300
add rax, 0x28
cmp rax, r9
jne 0x140002340
xor eax, eax
ret

Function at 0x140002360
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004770]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000237f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002388
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000237f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140004770]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000243f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002448
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140001a84
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
xor r9d, r9d
mov edx, 0x40000000
mov qword [rax - 0x18], rbp
mov dword [rax - 0x20], ebp
lea esi, [rbp + 1]
mov r8d, esi
mov dword [rax - 0x28], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x58]
lea rdx, [0x14061d820]
cmp rax, 0xffffffffffffffff
movzx ebx, bpl
mov r8d, 0xe64672
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x20], rbp
cmove ebx, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
cmp eax, ebp
cmovne ebx, esi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov al, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140001b10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x141481eb0]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rcx, [rsp + 0x22]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], di
call fcn.1400032b0
lea r9d, [rdi + 1]
lea r8d, [rdi + 0x23]
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.ckq
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
call fcn.140001a84
lea rcx, [0x140434620]
mov edx, 0x1e9200
call fcn.140001794
mov rbx, rax
cmp rax, rdi
je 0x140001bb0
lea rdx, [0x14000c004]
mov rcx, rax
call fcn.14000163c
cmp rax, rdi
je 0x140001ba8
call rax
mov rcx, rbx
call fcn.1400015e0
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140003aa0
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x14000517f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x141481eb0]
jne 0x140003aba
rol rcx, 0x10
test cx, 0xffff
jne 0x140003ab6
repz ret
ror rcx, 0x10
jmp 0x1400050d8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x141484360]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x141484458]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000515d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x141484360]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000517f
mov rax, qword [rsp + 0x88]
mov qword [0x141484458], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1414843f8], rax
mov rax, qword [0x141484458]
mov qword [0x1414842d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1414843e0], rax
mov dword [0x1414842c0], 0xc0000409
mov dword [0x1414842c4], 1
mov rax, qword [0x141481eb0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x141481eb8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x141484358], eax
mov ecx, 1
call fcn.140007958
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140009680]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x141484358], 0
jne 0x140005206
mov ecx, 1
call fcn.140007958
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400055c8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400066f4
nop
cmp dword [0x141484880], 1
je 0x140005574
mov dword [0x14148487c], 1
mov byte [0x141484878], r12b
test ebx, ebx
jne 0x140005560
mov rcx, qword [0x141485270]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000554d
mov rcx, qword [0x141485268]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400054ec
call fcn.140004bcc
cmp qword [rdi], rax
jne 0x1400054ec
jmp 0x1400054d2
cmp rdi, rsi
jb 0x14000554d
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140004bcc
mov qword [rdi], rax
call rbx
mov rcx, qword [0x141485270]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x141485268]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000552b
cmp r13, rax
je 0x14000554b
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400054d2
lea rdx, [0x1400093b8]
lea rcx, [0x1400093b0]
call fcn.14000531c
lea rdx, [0x1400093c8]
lea rcx, [0x1400093c0]
call fcn.14000531c
nop
test r12d, r12d
je 0x140005583
mov ecx, 8
call fcn.1400065f4
test r12d, r12d
jne 0x1400055ae
mov dword [0x141484880], 1
lea ecx, [r12 + 8]
call fcn.1400065f4
mov ecx, r15d
call fcn.1400052b0
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000543c

Function at 0x1400055d4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000543c
Function at 0x140007e2c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140004bcc
xor ebx, ebx
mov rdi, rax
cmp qword [0x141484f50], rbx
jne 0x140007f32
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140008007
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008007
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x141484f50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x141484f58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x141484f60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x141484f70], rax
test rax, rax
je 0x140007f29
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x141484f68], rax
jmp 0x140007f39
mov rax, qword [0x141484f68]
jmp 0x140007f40
mov rax, qword [0x141484f68]
mov r11, qword [0x141484f70]
cmp rax, rdi
je 0x140007fa8
cmp r11, rdi
je 0x140007fa8
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x141484f70]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140007fa8
test rax, rax
je 0x140007fa8
call rsi
test rax, rax
je 0x140007fa2
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140007fa2
test byte [rsp + 0x38], 1
jne 0x140007fa8
bts ebp, 0x15
jmp 0x140007fe6
mov rcx, qword [0x141484f58]
cmp rcx, rdi
je 0x140007fe6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140007fe6
call rax
mov rbx, rax
test rax, rax
je 0x140007fe6
mov rcx, qword [0x141484f60]
cmp rcx, rdi
je 0x140007fe6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140007fe6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x141484f50]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140008007
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140008009
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18001d110
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18001d134
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x18001d1c2
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18001d190
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18001d190
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.180085fd0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18001d1ad
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18001d1b5
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x18001d151
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x18001d2a0
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x18001d1d9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001d1db
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001d20d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.180085fd0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18001d29d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18001d248
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18001d27e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.18006c4d0
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18001d29d
cmp rsi, rax
ja 0x18001d251
test rsi, rsi
je 0x18001d29d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18006c4d0
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret