joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18060b590
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x18060b738
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x18060b5f5
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x18060b5f5
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x18060b5f5
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x18060b62c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x18060b682
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x18060b682
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x18060b682
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x18060b682
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x18060b682
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.18060aa60
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x18060b6e4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180227fe9
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.18060b3b0
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x18060b730
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.180227fe9
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x18060d950
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1807e6e00]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x18060d9e5
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.180220c2b
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x18060da46
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.180227fe9
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180220b8b
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x18060db01
sub ecx, 1
je 0x18060db74
sub ecx, 1
je 0x18060dab0
cmp ecx, 1
je 0x18060da93
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x180682884]
call fcn.180227fe9
jmp 0x18060db74
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.18060d560
test eax, eax
je 0x18060db74
jmp 0x18060da1a
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call fcn.180222e95
test rax, rax
je 0x18060db74
sub rax, rsi
cmp rax, rbp
jae 0x18060db74
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.180225cd0
jmp 0x18060db74
cmp r8d, 4
jle 0x18060db74
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x18060db74
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.180221301
mov esi, eax
test eax, eax
je 0x18060db53
mov edx, 5
mov rcx, rbx
call fcn.18060e960
mov eax, esi
jmp 0x18060da1a
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.1802233ae
mov rcx, r14
call fcn.180225b72
test eax, eax
je 0x18060da18
mov edx, 5
mov rcx, rbx
call fcn.18060e960
mov eax, Ordinal_46
jmp 0x18060da1a
Function at 0x180626350
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1807e6e00]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov dword [rbp - 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x180626487
movzx edx, byte [rdi + 1]
movzx ecx, byte [rdi]
movzx eax, dl
movzx r8d, byte [rdi + 5]
shr al, 1
mov byte [rbp - 0x1c], cl
shl cl, 7
or al, cl
shl dl, 6
movzx ecx, byte [rdi + 2]
mov byte [rbp - 0x1b], al
movzx eax, cl
shr al, 2
or al, dl
shl cl, 5
movzx edx, byte [rdi + 3]
mov byte [rbp - 0x1a], al
movzx eax, dl
shr al, 3
or al, cl
shl dl, 4
movzx ecx, byte [rdi + 4]
mov byte [rbp - 0x19], al
movzx eax, cl
shr al, 4
or al, dl
shl cl, 3
mov byte [rbp - 0x18], al
movzx eax, r8b
shr al, 5
or al, cl
shl r8b, 2
movzx ecx, byte [rdi + 6]
mov byte [rbp - 0x17], al
movzx eax, cl
add cl, cl
shr al, 6
or al, r8b
mov byte [rbp - 0x15], cl
mov qword [rsp + 0xa0], r14
lea rcx, [rbp - 0x1c]
xor r14d, r14d
mov byte [rbp - 0x16], al
mov dword [rbp - 0x28], 0x208
mov dword [rbp - 0x24], 0x6601
mov dword [rbp - 0x20], 8
lea edx, [r14 + 8]
call fcn.180223f61
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r8d, [r14 + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
lea rdx, [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14, qword [rsp + 0xa0]
test eax, eax
jne 0x18062648b
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x1806264d0
mov rax, qword [rsi]
xor r9d, r9d
mov rcx, qword [rbp - 0x30]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180220b8b
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x8ae3f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x8ae3fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x8ae40d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x8ae3f5
lea eax, [rcx + 1]
jmp 0x8ae41b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x8ae42e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x8ae414
sub eax, 3
jb 0x8ae44e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x8ae49d
sar eax, 1
movsxd rbp, eax
jb 0x8ae484
jmp 0x8ae45c
add ebx, ebx
jne 0x8ae45a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x8ae484
inc ecx
add ebx, ebx
jne 0x8ae46a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x8ae484
call r11
adc ecx, ecx
add ebx, ebx
jne 0x8ae47d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x8ae46c
add ecx, 2
jmp 0x8ae489
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.008ae3b2
jmp 0x8ae3fd
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x201200
mov dl, 0x63
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x8ae4e9
cmp rsi, rcx
jae 0x8ae4f1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x8ae4d0
cmp al, 0x8f
ja 0x8ae4d0
cmp byte [rsi - 2], 0xf
je 0x8ae4d6
sub al, 0xe8
cmp al, 1
ja 0x8ae4ba
cmp rsi, rcx
jae 0x8ae4f1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x8ae4c0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x8ae4f1
lodsb al, byte [rsi]
jmp 0x8ae4d0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x4a8000]
mov eax, dword [rdi]
or eax, eax
je 0x8ae54e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4b2ef4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x8ae4fe
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x8ae548
mov qword [rbx], rax
add rbx, 8
jmp 0x8ae51e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x8ae592
cmp al, 0xef
ja 0x8ae57a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x8ae55a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x8ae569
mov eax, dword [rdi]
add rdi, 4
jmp 0x8ae569
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x8ae5e6
sub rsp, 0xffffffffffffff80
jmp 0x466ec0
Function at 0x1400010d0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
and dword [rsp + 0x48], 0
mov rdi, rcx
cmp qword [0x140004050], 0
je 0x140001107
test rcx, rcx
je 0x1400011f6
mov eax, dword [0x140004058]
mov dword [rcx], eax
jmp 0x1400011f6
lea rdx, [0x140002740]
lea rcx, [rsp + 0x20]
call fcn.140001734
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov rsi, rax
test rax, rax
je 0x1400011ff
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 0xb]
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400011ff
mov edx, eax
xor ecx, ecx
mov r8d, 0x454e4f45
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.140002280
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov rdx, rbx
mov ecx, 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
js 0x1400011e3
mov r8d, dword [rbx]
xor edx, edx
test r8d, r8d
je 0x1400011e3
lea rcx, [rbx + 0x20]
mov r9, qword [rcx - 8]
cmp rsi, r9
jb 0x1400011ad
mov eax, dword [rcx]
add rax, r9
cmp rsi, rax
jb 0x1400011bd
inc edx
add rcx, 0x128
cmp edx, r8d
jae 0x1400011e3
jmp 0x14000119a
mov eax, edx
imul rcx, rax, 0x128
mov rax, qword [rcx + rbx + 0x18]
mov qword [0x140004050], rax
mov eax, dword [rcx + rbx + 0x20]
mov dword [0x140004058], eax
test rdi, rdi
je 0x1400011e3
mov dword [rdi], eax
test rbx, rbx
je 0x1400011f6
mov edx, 0x454e4f45
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [0x140004050]
jmp 0x140001201
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400111f4
Capabilities:
Terminate process

Disassembly:
jmp 0x140012d60
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400140b0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400140d0
xor al, al
jmp 0x140014151
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400140e3
xor al, al
jmp 0x140014151
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001410d
xor al, al
jmp 0x140014151
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014121
xor al, al
jmp 0x140014151
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014133
xor al, al
jmp 0x140014151
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001414f
xor al, al
jmp 0x140014151
mov al, 1
add rsp, 0x38
ret
Function at 0x1400193e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xe0
xor eax, eax
xor edi, edi
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdi + 0x68]
xor edx, edx
mov dword [rsp + 0xf0], edi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call fcn.140019cf0
lea edx, [rdi + 1]
lea rcx, [0x1400193b0]
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140019499
call fcn.140019a70
lea rdx, str.failed_to_create_process._n
lea rcx, [rax + 0x60]
call fcn.1400198f8
xor eax, eax
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
mov dword [0x14002b540], eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1400194f0
call fcn.140019a70
lea rdx, str.failed_to_get_exit_code_from_process._n
lea rcx, [rax + 0x60]
call fcn.1400198f8
xor eax, eax
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret
mov eax, dword [rsp + 0xf0]
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rdi
ret
Function at 0x14001a950
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14001c708
nop
cmp dword [0x14002b598], 1
je 0x14001a8fc
mov dword [0x14002b594], 1
mov byte [0x14002b590], r12b
test ebx, ebx
jne 0x14001a8e8
mov rcx, qword [0x14002c5a0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001a8d5
mov rcx, qword [0x14002c598]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001a874
call fcn.14001d74c
cmp qword [rdi], rax
jne 0x14001a874
jmp 0x14001a85a
cmp rdi, rsi
jb 0x14001a8d5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14001d74c
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14002c5a0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14002c598]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14001a8b3
cmp r13, rax
je 0x14001a8d3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14001a85a
lea rdx, [0x1400272e8]
lea rcx, [0x1400272d0]
call fcn.14001a6a4
lea rdx, [0x1400272f8]
lea rcx, [0x1400272f0]
call fcn.14001a6a4
nop
test r12d, r12d
je 0x14001a90b
mov ecx, 8
call fcn.14001c608
test r12d, r12d
jne 0x14001a936
mov dword [0x14002b598], 1
lea ecx, [r12 + 8]
call fcn.14001c608
mov ecx, r15d
call fcn.14001a638
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14001a7c4

Function at 0x14001a95c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001a7c4
Function at 0x14001cab7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14002a3c0]
jne 0x14001a36a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001a366
repz ret
ror rcx, 0x10
jmp 0x14001ca10
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002b8b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14002b9a8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001ca95
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002b8b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001cab7
mov rax, qword [rsp + 0x88]
mov qword [0x14002b9a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002b948], rax
mov rax, qword [0x14002b9a8]
mov qword [0x14002b820], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002b930], rax
mov dword [0x14002b810], 0xc0000409
mov dword [0x14002b814], 1
mov rax, qword [0x14002a3c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14002a3c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14002b8a8], eax
mov ecx, 1
call fcn.14001f3c4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140027470]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14002b8a8], 0
jne 0x14001cb3e
mov ecx, 1
call fcn.14001f3c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14002188c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14001d74c
xor ebx, ebx
mov rdi, rax
cmp qword [0x14002c270], rbx
jne 0x140021992
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140021a67
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140021a67
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14002c270], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14002c278], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14002c280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14002c290], rax
test rax, rax
je 0x140021989
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14002c288], rax
jmp 0x140021999
mov rax, qword [0x14002c288]
jmp 0x1400219a0
mov rax, qword [0x14002c288]
mov r11, qword [0x14002c290]
cmp rax, rdi
je 0x140021a08
cmp r11, rdi
je 0x140021a08
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14002c290]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140021a08
test rax, rax
je 0x140021a08
call rsi
test rax, rax
je 0x140021a02
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140021a02
test byte [rsp + 0x38], 1
jne 0x140021a08
bts ebp, 0x15
jmp 0x140021a46
mov rcx, qword [0x14002c278]
cmp rcx, rdi
je 0x140021a46
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140021a46
call rax
mov rbx, rax
test rax, rax
je 0x140021a46
mov rcx, qword [0x14002c280]
cmp rcx, rdi
je 0x140021a46
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140021a46
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14002c270]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140021a67
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140021a69
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
add dl, ch
adc al, 0xdf
sar dl, cl
mov eax, 0x1388af76
invalid
xchg edx, eax
pop r15
mov sil, 0xb9
push 0x129fb3d5
fiadd word [rax - 0x56]
jge 0x140020988
scasd eax, dword [rdi]
jnp 0x1400209ba
push 0x1d
scasd eax, dword [rdi]
adc ebx, dword [rbp + 0x5ab7dafe]
add al, 0xe4
jg 0x14002099a
xor dword [rax + 0x45e1e2f4], ebx
invalid
int1
jbe 0x1400209d8
and byte [rdi + 0x7d5e2a73], dl
jbe 0x1400209db
pop rbp
pop rdi
invalid
jnp 0x140020a14
sub dword [rdi + rcx*4], ebx
sbb eax, 0xcf1dcbf6
enter 0x72ed, 0x78
pop rax
invalid
dec dword [rsi + 0x3e]
in eax, 0xea
xchg dword [rdi], esi
jns 0x1400209b6
push 0xffffffffffffffbc
mov ebx, 0x6109d853
mov ebp, 0x2e3e8623
mov ecx, eax
mov cl, dl
invalid