joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006890
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x290
mov rax, qword [0x18006f1d0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor eax, eax
mov rbx, rcx
xor edi, edi
lea rcx, [rsp + 0x70]
mov edx, 0x208
mov word [rsp + 0x58], di
mov qword [rsp + 0x5a], rax
mov dword [rsp + 0x62], eax
mov word [rsp + 0x66], ax
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1800068ed
mov eax, 0x43
mov word [rsp + 0x70], ax
jmp 0x1800068f2
movzx eax, word [rsp + 0x70]
mov dword [rsp + 0x38], edi
mov word [rsp + 0x58], ax
mov eax, 0x3a
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rdi
mov word [rsp + 0x5a], ax
mov dword [rsp + 0x5c], 0x5c
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov r8d, dword [rsp + 0x40]
mov rcx, rbx
imul r8d, r8d, 0x14a30b
sub r8d, 0x69427551
mov edx, r8d
imul edx, edx, 0x14a30b
sub edx, 0x69427551
imul edx, edx, 0x14a30b
sub edx, 0x69427551
mov eax, edx
movzx r9d, dx
lea rdx, str._08lX_04lX_lu
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [rsp + 0x52], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [rsp + 0x53], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [rsp + 0x54], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov byte [rsp + 0x55], al
imul eax, eax, 0x14a30b
sub eax, 0x69427551
imul eax, eax, 0x14a30b
sub eax, 0x69427551
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x52]
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18000ae20
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rdi
ret
Function at 0x180006a10
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x18006f1d0]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov rsi, rdx
mov qword [rsp + 0x20], rdx
xor eax, eax
lea rcx, [rbp + 0x5a2]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x5a0], ax
call fcn.180006860
lea rcx, [rbp + 0x5a0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x180068754]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180006aa5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180006c1d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x5a0]
mov qword [rsp + 0x8f0], rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180006c15
nop dword [rax]
xor eax, eax
lea rcx, [rbp + 0x392]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x390], ax
call fcn.180006860
lea rcx, [rbp + 0x390]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x18006875c]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor eax, eax
lea rcx, [rbp + 0x182]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x180], ax
call fcn.180006860
lea rcx, [rbp + 0x180]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x18006875c]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test byte [rsp + 0x30], 0x10
je 0x180006bde
lea rsi, [rsp + 0x5c]
lea rdi, [0x180068760]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x180006bde
lea rsi, [rsp + 0x5c]
lea rdi, [0x180068764]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x180006bde
lea rcx, [rbp + 0x180]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180006bc9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180006bf5
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x390]
call fcn.180006a10
jmp 0x180006bf5
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x390]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
test eax, eax
jne 0x180006ad0
mov rbx, qword [rsp + 0x8f0]
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.18000ae20
add rsp, 0x8c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180006c40
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x18006f1d0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180006cfa
mov qword [rsp + 0x280], rsi
mov qword [rsp + 0x288], rdi
lea rsi, [rsp + 0x4c]
lea rdi, str.brave.exe
mov ecx, 0xa
repe cmpsw word [rsi], word [rdi]
jne 0x180006cd8
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x180006cd8
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180006c93
mov rdi, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x280]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000ae20
add rsp, 0x270
pop rbx
ret

Function at 0x180006d20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov qword [rcx + 8], rdx
mov r8, rdx
lea rax, vtable.CManager.0
mov qword [rcx], rax
mov rax, qword [rdx]
mov rbx, rcx
mov rdx, rcx
mov rcx, r8
call qword [rax + 0x18]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rbx + 0x58]
xor edi, edi
mov qword [rbx + 0x18], rax
lea rax, vtable.CScreenHideManager.0
mov dword [rbx + 0x10], edi
mov qword [rbx], rax
call fcn.1800066b0
mov dword [rbx + 0x28], edi
mov dword [rbx + 0x3c], 0x20
mov dword [rbx + 0x40], 1
mov byte [rbx + 0x2c], 1
mov byte [rbx + 0x39], dil
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
lea ecx, [rdi + 0x4e]
mov qword [rbx + 0x168], rax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea ecx, [rdi + 0x4f]
mov dword [rbx + 0x30], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r8, [0x1800088c0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov dword [rbx + 0x34], eax
mov qword [rbx + 0x198], rdi
mov dword [rbx + 0x1a0], 0x18
mov dword [rsp + 0x20], edi
call fcn.18000b82c
lea r8, [0x180008a60]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rdi
mov qword [rbx + 0x48], rax
mov dword [rsp + 0x20], edi
call fcn.18000b82c
mov dword [rbx + 0x28], 1
mov qword [rbx + 0x50], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180006f50
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
or edx, 0xffffffff
xchg dword [rcx + 0x2c], eax
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x160]
test rcx, rcx
je 0x180006f96
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x160], 0
lea r8, [0x1800088c0]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rbx + 0x3c], 0x20
mov dword [rsp + 0x20], 0
call fcn.18000b82c
mov qword [rbx + 0x48], rax
add rsp, 0x30
pop rbx
ret
Function at 0x1800090f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
movsxd rbx, edx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180009172
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbx
mov ecx, 2
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x180009167
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.18000ae50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x180009180
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rbp
sub rsp, 0x20
mov rbp, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18000924e
mov ecx, 1
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
jne 0x1800091c2
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
jmp qword [sym.imp.USER32.dll_CloseClipboard]
mov qword [rsp + 0x30], rbx
mov rcx, rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], r12
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov rcx, rdi
lea r12d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
movsxd rcx, r12d
mov rbx, rax
call fcn.18000adfc
lea ecx, [r12 - 1]
movsxd r8, ecx
lea rcx, [rax + 1]
mov rdx, rbx
mov rsi, rax
mov byte [rax], 2
call fcn.18000ae50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [rbp + 0x10], 0
mov rbx, qword [rsp + 0x30]
jne 0x180009237
mov rcx, qword [rbp + 8]
mov r8d, r12d
mov rdx, rsi
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
mov rcx, rsi
call fcn.18000b920
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
Function at 0x180009300
Capabilities:
Create process on windows
Print debug messages

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x520
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x18006f1d0]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov rbx, rcx
xor r13b, r13b
test rcx, rcx
je 0x1800094cf
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x1800094cf
or rcx, 0xffffffffffffffff
lea rsi, [0x180071e80]
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x1800094cf
xor r12d, r12d
mov word [r11 - 0x438], r12w
xor edx, edx
mov r8d, 0x40e
lea rcx, [r11 - 0x436]
call fcn.180006860
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x100]
call fcn.18000b620
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_PathIsExe]
test eax, eax
jne 0x1800093e4
lea rax, str.Invalid_File_Extension
mov qword [rsp + 0x68], rax
lea rdx, [0x18006cf70]
lea rcx, [rsp + 0x68]
call fcn.18000bdc8
lea rcx, [rsp + 0x100]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x98]
call fcn.180006860
mov qword [rsp + 0x70], r12
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x90], WSAGetLastError
mov qword [rsp + 0xa0], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20
mov esi, 1
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
mov qword [rsp + 0x58], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
lea rcx, [0x180068ed0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
movzx r11d, r13b
test edi, edi
cmovne r11d, esi
jmp 0x1800094f3
lea rax, str.Invalid_Argument.
mov qword [rsp + 0x60], rax
lea rdx, [0x18006cf70]
lea rcx, [rsp + 0x60]
call fcn.18000bdc8
nop
movzx r11d, byte [rsp + 0x50]
movzx eax, r11b
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.18000ae20
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x180009950
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x18000999c
cmp dword [0x180070b14], edx
je 0x18000999c
cmp qword [0x1800720a0], 0
jne 0x18000999c
xor eax, eax
lea r8, [0x180009880]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
mov qword [0x1800720a0], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1800099b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov edi, r8d
mov r8, rcx
mov ebx, edx
lea rcx, str.iamasbcx.asuscomm.com
mov edx, 0xff
mov esi, r9d
call fcn.18000b620
xor eax, eax
lea r8, [0x180009880]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [0x180070b0c], ebx
mov dword [0x180070b10], edi
mov dword [rsp + 0x20], eax
mov dword [0x180070b14], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
or edx, 0xffffffff
mov qword [0x1800720a0], rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor al, al
add rsp, 0x30
pop rdi
ret

Function at 0x180009a40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [0x180009880]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
add rsp, 0x38
ret

Function at 0x180009e30
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x18006f1d0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x180009ef8
mov r8, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, rbx
call fcn.180009d30
mov edx, 0xffffffec
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, 0xffffffec
mov rcx, rbx
bts eax, 0x19
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 6
jae 0x180009ef8
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetTopWindow]
test rax, rax
je 0x180009ef8
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
je 0x180009ef8
mov rdx, rdi
mov rcx, rbx
call fcn.180009e30
test eax, eax
je 0x180009ef8
mov edx, 3
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
jne 0x180009ed3
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18000ae20
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
Function at 0x18000a4b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push r12
sub rsp, 0x28
cmp qword [rcx + 0xa0], 0
mov r12, rdx
mov rbx, rcx
jne 0x18000a4d2
xor eax, eax
add rsp, 0x28
pop r12
pop rbx
ret
cmp qword [rcx + 8], 0
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
je 0x18000a4fb
mov rdx, qword [rcx + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rbx + 0x40], rax
mov rax, qword [rbx + 0xa0]
movzx ebp, byte [rbx + 0x2c]
mov dword [rbx + 0xa8], 0
mov byte [rax], bpl
mov rax, qword [rbx + 0x40]
inc dword [rbx + 0xa8]
mov qword [rbx + 0x1b8], rax
mov rax, qword [rbx + 0x50]
xor ecx, ecx
mov qword [rbx + 0x1c0], rax
mov byte [rsp + 0x40], bpl
call qword [sym.imp.USER32.dll_GetTopWindow]
test rax, rax
je 0x18000a58e
mov edx, 1
mov rcx, rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
test rax, rax
je 0x18000a589
nop dword [rax]
lea rdx, [rbx + 0x1b8]
mov rcx, rdi
call fcn.180009e30
test eax, eax
je 0x18000a589
mov edx, 3
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
test rax, rax
jne 0x18000a560
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
cmp bpl, 0x10
mov rbp, qword [rsp + 0x48]
jne 0x18000a5a6
mov rcx, rbx
call fcn.18000aa50
mov eax, dword [rbx + 0xa8]
mov dword [r12], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x1d0]
cmp eax, dword [rbx + 0x1d4]
jae 0x18000a5e3
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x1d0]
cmp eax, dword [rbx + 0x1d4]
jb 0x18000a5c4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xchg dword [rbx + 0x1d0], eax
mov rax, qword [rbx + 0xa0]
add rsp, 0x28
pop r12
pop rbx
ret
Function at 0x18000bf03
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18006f1d0]
jne 0x18000ae3a
rol rcx, 0x10
test cx, 0xffff
jne 0x18000ae36
repz ret
ror rcx, 0x10
jmp 0x18000be5c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180070e80]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180070f78]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000bee1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180070e80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000bf03
mov rax, qword [rsp + 0x88]
mov qword [0x180070f78], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180070f18], rax
mov rax, qword [0x180070f78]
mov qword [0x180070df0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180070f00], rax
mov dword [0x180070de0], 0xc0000409
mov dword [0x180070de4], 1
mov rax, qword [0x18006f1d0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18006f1d8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180070e78], eax
mov ecx, 1
call fcn.18000eecc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18003f7e0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180070e78], 0
jne 0x18000bf8a
mov ecx, 1
call fcn.18000eecc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x18000c5e0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.18000c450
Function at 0x18000f398
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18006f1d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000db94
xor ebx, ebx
cmp qword [0x180071df0], rbx
mov rdi, rax
jne 0x18000f4ab
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18000f582
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000f582
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180071df0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180071df8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180071e00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180071e10], rax
test rax, rax
je 0x18000f4a2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180071e08], rax
jmp 0x18000f4b2
mov rax, qword [0x180071e08]
jmp 0x18000f4b9
mov rax, qword [0x180071e08]
mov r11, qword [0x180071e10]
cmp rax, rdi
je 0x18000f520
cmp r11, rdi
je 0x18000f520
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180071e10]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18000f520
test rax, rax
je 0x18000f520
call rsi
test rax, rax
je 0x18000f51a
lea rcx, [rsp + 0x30]
mov r9d, recv
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18000f51a
test byte [rsp + 0x40], 1
jne 0x18000f520
bts ebp, 0x15
jmp 0x18000f560
mov rcx, qword [0x180071df8]
cmp rcx, rdi
je 0x18000f560
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000f560
call rax
mov rbx, rax
test rax, rax
je 0x18000f560
mov rcx, qword [0x180071e00]
cmp rcx, rdi
je 0x18000f560
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000f560
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180071df0]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x18000f582
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x18000f584
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000ae20
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180015590
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
mov qword [rcx + 8], rsi
call fcn.18002f180
mov edx, 0xa0
mov rcx, rbx
mov dword [rsp + 0x38], eax
call fcn.180016c30
mov rdi, rax
test rax, rax
jne 0x1800155e7
mov rcx, rbx
call fcn.18002f190
mov r11, qword [rbx]
mov dword [r11 + 0x28], 0x36
mov rcx, qword [rbx]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
mov dword [rdi + 0x5c], 0x3b9aca00
lea rax, [fcn.180014500]
lea rcx, str.JPEGMEM
mov qword [rdi], rax
lea rax, [fcn.1800146b0]
mov qword [rdi + 8], rax
lea rax, [fcn.1800147e0]
mov qword [rdi + 0x10], rax
lea rax, [fcn.180014900]
mov qword [rdi + 0x18], rax
lea rax, [0x180014a10]
mov qword [rdi + 0x20], rax
lea rax, [0x180014ac0]
mov qword [rdi + 0x28], rax
lea rax, [0x180014b70]
mov qword [rdi + 0x30], rax
lea rax, [0x180014dd0]
mov qword [rdi + 0x38], rax
lea rax, [0x180015030]
mov qword [rdi + 0x40], rax
lea rax, [0x1800152a0]
mov qword [rdi + 0x48], rax
lea rax, [0x1800153f0]
mov qword [rdi + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x58], eax
mov qword [rdi + 0x68], rsi
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x90], 0xa0
mov qword [rbx + 8], rdi
call fcn.180035e28
test rax, rax
je 0x1800156f3
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call fcn.180035d4c
test eax, eax
jle 0x1800156f3
movzx eax, byte [rsp + 0x30]
cmp al, 0x6d
je 0x1800156e0
cmp al, 0x4d
je 0x1800156e0
mov eax, dword [rsp + 0x38]
jmp 0x1800156ea
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
imul eax, eax, 0x3e8
mov dword [rdi + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret