joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400010e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor eax, eax
cpuid
mov eax, 1
cpuid
movabs r9, 0xb2d05e00
cpuid
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, rax
fldpi
frndint
rdtsc
shl rdx, 0x20
or rax, rdx
sub rax, rcx
cmp rax, r9
jb 0x140001104
push rbp
mov rbp, rsp
sub rsp, 8
mov r10, 0xa
mov rcx, 0xffffffff9f345678
dec rcx
xor r9, r9
mov rax, rcx
jne 0x14000112f
xor rax, rax
mov rax, rbx
add rax, rdx
nop
nop
nop
dec r10
xor r11, r11
jne 0x140001128
xor rax, rax
mov rax, 0xa
dec rax
nop
nop
add rsp, 8
pop rbp
ret

Function at 0x140003000
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x14001f4b8]
lea r9, [rsp + 0x30]
lea rdx, str._r_n________Remove_Files_or_Directories__Release_5.2.g_Demo_r_n_r_nUsage:
mov r8d, 0x45
call fcn.140009b60
mov r8d, dword [0x14001f700]
mov rdx, qword [0x14001e428]
mov rcx, qword [0x14001f4b8]
lea r9, [rsp + 0x30]
call fcn.140009b60
mov rcx, qword [0x14001f4b8]
lea r9, [rsp + 0x30]
lea rdx, str.___rfcHSxZilh___pathname1___pathname2_...___r_n
mov r8d, 0x2d
call fcn.140009b60
lea rbx, [0x14001c510]
lea rsi, str.SWITCHCHARS
nop dword [rax + rax]
mov rdx, qword [rbx]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
lea r9, [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, qword [0x14001f4b8]
call fcn.140009b60
add rbx, 8
cmp rbx, rsi
jb 0x140003080
mov ecx, 0xff00
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140003180
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rax, rdx
mov ebx, ecx
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140006dd0
cmp dword [0x14001e404], 0
jne 0x1400031bc
test ebx, ebx
je 0x1400031bc
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x20
pop rbx
ret
Function at 0x1400039b0
Capabilities:
Delete directory
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400039c4
cmp qword [rcx], 0
jne 0x1400039dd
lea rdx, [0x14001c678]
lea rcx, str.d__d__Path
mov r8d, 0x5d6
call fcn.14000a0c4
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140003a1e
mov rcx, qword [rbx]
lea edx, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140003a07
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140003a1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Couldnt_remove_directory__P.
mov r8, rbx
mov ecx, eax
call fcn.140003180
add rsp, 0x20
pop rbx
ret
Function at 0x140003c10
Capabilities:
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
je 0x140003c32
cmp qword [rcx], 0
jne 0x140003c4b
lea rdx, [0x14001c6f0]
lea rcx, [0x14001c700]
mov r8d, 0x926
call fcn.14000a0c4
mov rcx, qword [rbx]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea r8d, [rbp + 3]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov edi, ebp
mov rsi, rax
setne dil
test edi, edi
je 0x140003d0b
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0x2000
jbe 0x140003cd2
mov rdx, qword [0x14001e420]
lea r9, [rsp + 0x50]
mov r8d, 0x2000
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test eax, eax
je 0x140003d02
sub ebx, dword [rsp + 0x50]
cmp ebx, 0x2000
ja 0x140003ca0
test ebx, ebx
je 0x140003cf5
mov rdx, qword [0x14001e420]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
je 0x140003d02
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x40
pop rdi
ret
Function at 0x140003fc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov ebx, ecx
mov ecx, 1
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rcx, qword [rdi]
lea rdx, [0x14001f700]
xor r8d, r8d
call fcn.140008200
mov ecx, 0xfffffff4
mov qword [0x14001e428], rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x14001f6c0], rax
cmp rax, 0xffffffffffffffff
jne 0x14000401a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x14001f4b8], rax
cmp rax, 0xffffffffffffffff
jne 0x140004046
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Couldnt_get_the_stdout_handle.
mov ecx, eax
call fcn.140006eb0
call fcn.140009200
call fcn.1400033e0
call fcn.140008510
mov rdx, rdi
mov ecx, ebx
call fcn.1400031d0
sub ebx, eax
cmp dword [0x14001e40c], 0
cdqe
lea rdi, [rdi + rax*8]
je 0x1400040bd
xor eax, eax
lea rcx, str.CONIN_
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea r8d, [rax + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14001f6f8], rax
cmp rax, 0xffffffffffffffff
jne 0x1400040bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Couldnt_open_the_keyboard.
mov ecx, eax
call fcn.140006eb0
cmp ebx, 1
jge 0x1400040c8
call fcn.1400030d0
int3
cmp dword [0x14001e41c], 0
je 0x1400040e8
mov edx, 0x2000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [0x14001e420], rax
mov rdx, rdi
mov ecx, ebx
call fcn.140003f20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400046a0
Capabilities:
Query environment variable

Disassembly:
push rdi
push r12
sub rsp, 0x48
mov rax, qword [0x14001ce70]
xor rax, rsp
mov qword [rsp + 0x28], rax
add cx, 0x41
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r13
xor r13d, r13d
mov word [rsp + 0x22], cx
mov r12, rdx
mov eax, 0x3d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x20]
mov r14d, 0x3a
xor r8d, r8d
xor edx, edx
mov rdi, r13
mov word [rsp + 0x20], ax
mov word [rsp + 0x26], r13w
mov word [rsp + 0x24], r14w
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov qword [rsp + 0x70], rbx
mov esi, eax
mov qword [rsp + 0x78], rbp
test esi, esi
je 0x140004752
test rdi, rdi
je 0x140004722
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea ebp, [rsi - 1]
mov ecx, 0x40
mov ebx, esi
lea edx, [rbp + rbp + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea rcx, [rsp + 0x20]
mov r8d, esi
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp eax, ebx
ja 0x140004710
jmp 0x14000478f
test rdi, rdi
je 0x140004760
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebp, 3
lea edx, [rbp + 5]
lea ecx, [rbp + 0x3d]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
movzx eax, word [rsp + 0x22]
mov word [rdi], ax
mov eax, 0x5c
mov word [rdi + 2], r14w
mov word [rdi + 4], ax
mov word [rdi + 6], r13w
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
test r12, r12
je 0x1400047ac
mov dword [r12], ebp
mov rax, rdi
mov rbp, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000a080
add rsp, 0x48
pop r12
pop rdi
ret
Function at 0x1400059d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x14001ce70]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140005a5f
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140005a52
mov rcx, rdi
call fcn.1400042c0
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140005a52
mov rcx, rdi
call fcn.1400052c0
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x140005a52
mov eax, ebx
jmp 0x140005a5f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14000a080
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rdi
ret

Function at 0x140006eb0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rax, rdx
mov ebx, ecx
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140006dd0
test ebx, ebx
je 0x140006ee3
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
add rsp, 0x20
pop rbx
ret
Function at 0x140008510
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x14001ce70]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x28]
lea rcx, str.CshCookie
mov r8d, 9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp eax, 8
jne 0x1400086d0
movzx ecx, byte [rsp + 0x28]
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov edi, r8d
test cl, cl
je 0x14000859e
nop word [rax + rax]
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x14000856f
movsx eax, cl
sub eax, 0x57
jmp 0x14000858f
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x14000857e
movsx eax, cl
sub eax, 0x37
jmp 0x14000858f
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400086d0
movsx eax, cl
sub eax, 0x30
mov cl, byte [rdx + 1]
inc rdx
shl edi, 4
add edi, eax
test cl, cl
jne 0x140008560
lea rax, [rsp + 0x28]
sub rdx, rax
cmp rdx, 8
sete r8b
test r8d, r8d
je 0x1400086d0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp byte [rax], 0
mov r11, rax
mov r8, rax
je 0x1400085db
inc r8
cmp byte [r8], 0
jne 0x1400085d2
sub r8d, eax
mov ebx, 0xffffffff
je 0x140008625
nop word [rax + rax]
movzx ecx, byte [r11]
dec r8d
mov edx, 8
nop dword [rax]
movzx eax, cl
xor eax, ebx
test al, 1
je 0x140008613
shr ebx, 1
xor ebx, 0xccb88320
jmp 0x140008615
shr ebx, 1
shr cl, 1
sub rdx, 1
jne 0x140008600
inc r11
test r8d, r8d
jne 0x1400085f0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x32]
movzx r11d, word [rsp + 0x30]
imul r11d, r11d, 0x3c
add r11d, eax
movzx eax, word [rsp + 0x34]
mov esi, 0x32
imul r11d, r11d, 0x3c
add r11d, eax
mov dword [rsp + 0x20], r11d
nop dword [rax + rax]
dec esi
mov r10d, 4
lea r9, [rsp + 0x20]
or ecx, 0xffffffff
movzx edx, byte [r9]
dec r10d
mov r8d, 8
nop dword [rax]
movzx eax, dl
xor eax, ecx
test al, 1
je 0x140008693
shr ecx, 1
xor ecx, 0xccb88320
jmp 0x140008695
shr ecx, 1
shr dl, 1
sub r8, 1
jne 0x140008680
inc r9
test r10d, r10d
jne 0x140008670
lea eax, [rcx + rbx]
cmp eax, edi
je 0x1400086d6
test r11d, r11d
je 0x1400086bb
dec r11d
mov dword [rsp + 0x20], r11d
jmp 0x1400086c6
mov r11d, 0x1517f
mov dword [rsp + 0x20], r11d
test esi, esi
jne 0x140008660
call fcn.140008440
int3
call fcn.140008440
int3
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000a080
add rsp, 0x40
pop rdi
ret
Function at 0x140009410
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
lea rbp, [0x14001fa00]
mov rdi, rcx
sub edi, ebp
je 0x140009665
movzx r10d, word [0x14001f9c4]
movzx r9d, word [0x14001f9c0]
movzx r8d, word [0x14001f9c6]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
lea esi, [rdi + r10]
cmp si, r9w
mov bx, r8w
jl 0x14000946e
movsx eax, si
movsx ecx, r9w
cdq
idiv ecx
mov ebx, eax
mov esi, edx
add bx, r8w
movzx eax, word [0x14001f9c2]
cmp bx, ax
jge 0x1400094d9
mov r9d, dword [0x14001f9c4]
mov rcx, qword [0x14001f7b0]
lea rax, [rsp + 0x40]
mov r8d, edi
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov r9d, dword [0x14001f9c4]
movzx edx, word [0x14001f9c8]
mov rcx, qword [0x14001f7b0]
lea r11, [rsp + 0x40]
mov r8d, edi
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov word [0x14001f9c4], si
mov word [0x14001f9c6], bx
jmp 0x140009648
sub bx, ax
inc bx
cmp r8w, bx
jge 0x1400095c4
movsx eax, r10w
movsx ecx, r9w
sub ecx, eax
movsx eax, r8w
sub ecx, eax
movsx eax, bx
lea edx, [rcx + rax - 1]
mov rcx, qword [0x14001f7b0]
xor eax, eax
mov word [0x14001f9c4], ax
mov word [0x14001f9c6], ax
mov r9d, dword [0x14001f9c4]
sub edi, edx
lea rax, [rsp + 0x40]
add rdx, rbp
mov r8d, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
movsx eax, word [0x14001f9c0]
movsx r8d, word [0x14001f9c2]
imul r8d, eax
mov r9d, dword [0x14001f9c4]
movzx edx, word [0x14001f9c8]
mov rcx, qword [0x14001f7b0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
movsx r11d, word [0x14001f9c0]
movsx r8d, word [0x14001f9c2]
mov rcx, qword [0x14001f7b0]
xor edx, edx
mov eax, edi
div r11d
imul r8d, r11d
sub r8d, edi
mov word [0x14001f9c6], ax
mov word [0x14001f9c4], dx
mov r9d, dword [0x14001f9c4]
movzx edx, byte [0x14001ce58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
jmp 0x140009648
movsx r8d, bx
or edx, 0xffffffff
xor ecx, ecx
call fcn.1400092a0
sub word [0x14001f9c6], bx
mov r9d, dword [0x14001f9c4]
mov rcx, qword [0x14001f7b0]
lea rax, [rsp + 0x40]
mov r8d, edi
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov r9d, dword [0x14001f9c4]
movzx edx, word [0x14001f9c8]
mov rcx, qword [0x14001f7b0]
lea r11, [rsp + 0x40]
mov r8d, edi
mov qword [rsp + 0x20], r11
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
movzx eax, word [0x14001f9c4]
movsx ecx, word [0x14001f9c0]
add ax, di
cwde
cdq
idiv ecx
add word [0x14001f9c6], ax
mov word [0x14001f9c4], dx
mov edx, dword [0x14001f9c4]
mov rcx, qword [0x14001f7b0]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140009b60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
cmp rcx, qword [0x14001ce50]
jne 0x140009b91
mov eax, dword [0x14001f9d8]
jmp 0x140009bc4
mov qword [0x14001ce50], rcx
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
jne 0x140009bbc
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x140009bbc
mov eax, 1
jmp 0x140009bbe
xor eax, eax
mov dword [0x14001f9d8], eax
test eax, eax
je 0x140009beb
mov edx, edi
mov rcx, rbp
call fcn.140009680
mov dword [rsi], edi
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r9, rsi
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140009bd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140009bd6

Function at 0x14000c0b8
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14000c698
nop
cmp dword [0x14001e7d0], 1
je 0x14000c058
mov dword [0x14001e7cc], 1
mov byte [0x14001e7c8], r12b
test ebx, ebx
jne 0x14000c044
mov rcx, qword [0x140021460]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000c031
mov rcx, qword [0x140021458]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000bfd0
call fcn.14000e7e0
cmp qword [rdi], rax
jne 0x14000bfd0
jmp 0x14000bfb6
cmp rdi, rsi
jb 0x14000c031
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14000e7e0
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140021460]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140021458]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000c00f
cmp r13, rax
je 0x14000c02f
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000bfb6
lea rdx, [0x1400173c0]
lea rcx, [0x1400173a8]
call fcn.14000be00
lea rdx, [0x1400173d0]
lea rcx, [0x1400173c8]
call fcn.14000be00
nop
test r12d, r12d
je 0x14000c067
mov ecx, 8
call fcn.14000c598
test r12d, r12d
jne 0x14000c092
mov dword [0x14001e7d0], 1
lea ecx, [r12 + 8]
call fcn.14000c598
mov ecx, r15d
call fcn.14000bd94
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000bf20
Function at 0x14000c7a3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14001ce70]
jne 0x14000a09a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000a096
repz ret
ror rcx, 0x10
jmp 0x14000c6fc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14001eab0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14001eba8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000c781
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14001eab0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000c7a3
mov rax, qword [rsp + 0x88]
mov qword [0x14001eba8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14001eb48], rax
mov rax, qword [0x14001eba8]
mov qword [0x14001ea20], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14001eb30], rax
mov dword [0x14001ea10], 0xc0000409
mov dword [0x14001ea14], 1
mov rax, qword [0x14001ce70]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14001ce78]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14001eaa8], eax
mov ecx, 1
call fcn.140010098
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140018178]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14001eaa8], 0
jne 0x14000c82a
mov ecx, 1
call fcn.140010098
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000d348
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000e7e0
xor ebx, ebx
mov rdi, rax
cmp qword [0x14001efb0], rbx
jne 0x14000d44e
lea rcx, [0x1400181f8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000d523
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000d523
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001efb0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001efb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14001efc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14001efd0], rax
test rax, rax
je 0x14000d445
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14001efc8], rax
jmp 0x14000d455
mov rax, qword [0x14001efc8]
jmp 0x14000d45c
mov rax, qword [0x14001efc8]
mov r11, qword [0x14001efd0]
cmp rax, rdi
je 0x14000d4c4
cmp r11, rdi
je 0x14000d4c4
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14001efd0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14000d4c4
test rax, rax
je 0x14000d4c4
call rsi
test rax, rax
je 0x14000d4be
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000d4be
test byte [rsp + 0x38], 1
jne 0x14000d4c4
bts ebp, 0x15
jmp 0x14000d502
mov rcx, qword [0x14001efb8]
cmp rcx, rdi
je 0x14000d502
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000d502
call rax
mov rbx, rax
test rax, rax
je 0x14000d502
mov rcx, qword [0x14001efc0]
cmp rcx, rdi
je 0x14000d502
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000d502
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001efb0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14000d523
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14000d525
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140012d18
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.14000e7e0
xor ebx, ebx
mov rdi, rax
cmp qword [0x14001f3b0], rbx
jne 0x140012e1e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140012ef3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140012ef3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001f3b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001f3b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14001f3c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14001f3d0], rax
test rax, rax
je 0x140012e15
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14001f3c8], rax
jmp 0x140012e25
mov rax, qword [0x14001f3c8]
jmp 0x140012e2c
mov rax, qword [0x14001f3c8]
mov r11, qword [0x14001f3d0]
cmp rax, rdi
je 0x140012e94
cmp r11, rdi
je 0x140012e94
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14001f3d0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140012e94
test rax, rax
je 0x140012e94
call rsi
test rax, rax
je 0x140012e8e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140012e8e
test byte [rsp + 0x38], 1
jne 0x140012e94
bts ebp, 0x15
jmp 0x140012ed2
mov rcx, qword [0x14001f3b8]
cmp rcx, rdi
je 0x140012ed2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140012ed2
call rax
mov rbx, rax
test rax, rax
je 0x140012ed2
mov rcx, qword [0x14001f3c0]
cmp rcx, rdi
je 0x140012ed2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140012ed2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001f3b0]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140012ef3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140012ef5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret