joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fe70
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x128
mov eax, 0x43
mov word [rsp + 0x40], ax
jmp 0x14002fe98
movzx eax, word [rsp + 0x40]
add ax, 1
mov word [rsp + 0x40], ax
movzx eax, word [rsp + 0x40]
cmp eax, 0x5a
jg 0x14003005d
mov rax, qword [0x140040ca0]
mov qword [rsp + 0x80], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x80], ax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 3
je 0x14002fef3
cmp dword [rsp + 0x88], 2
jne 0x14002fefd
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14002feff
jmp 0x14002fe8a
lea rdi, [rsp + 0x70]
lea rsi, [0x140040ca8]
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x7e]
xor eax, eax
mov ecx, 2
rep stosb byte [rdi], al
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x78], ax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0xffffffffffffffff
jne 0x14002ff6e
jmp 0x14002fe8a
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x74004
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14003002d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x90
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70048
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140030010
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002fe8a
cmp dword [rsp + 0x90], 0
jne 0x140030028
movzx eax, byte [rsp + 0xb1]
mov byte [rsp + 0x61], al
jmp 0x14003002d
jmp 0x14002fe8a
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rsp + 0x61]
test eax, eax
je 0x140030058
mov rcx, qword [rsp + 0x140]
movzx eax, word [rsp + 0x40]
mov word [rcx], ax
mov eax, 1
jmp 0x14003005f
jmp 0x14002fe8a
xor eax, eax
add rsp, 0x128
pop rdi
pop rsi
ret
Function at 0x140033c50
Capabilities:
Get common file path
Persist via windows service
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x3d0
lea rcx, [rsp + 0x170]
call qword [sym.imp.ole32.dll_CoCreateGuid]
movzx ebx, byte [rsp + 0x17f]
movzx r11d, byte [rsp + 0x17e]
movzx r10d, byte [rsp + 0x17d]
movzx r9d, byte [rsp + 0x17c]
movzx r8d, byte [rsp + 0x17b]
movzx esi, byte [rsp + 0x17a]
movzx edi, byte [rsp + 0x179]
movzx edx, byte [rsp + 0x178]
movzx ecx, word [rsp + 0x176]
movzx eax, word [rsp + 0x174]
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x60], r11d
mov dword [rsp + 0x58], r10d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x170]
lea r8, str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov edx, 0x100
lea rcx, [rsp + 0x1c0]
call fcn.14001d240
lea r9, [0x140041bb8]
lea r8, [0x140041bd0]
mov edx, 0x80
lea rcx, [rsp + 0x70]
call fcn.14001d240
lea rcx, [rsp + 0x1c0]
call fcn.14001e2f0
add eax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [0x140041c20]
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x3c0], eax
cmp dword [rsp + 0x3c0], 0
je 0x140033d91
mov ecx, dword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140033e87
mov edx, 0x100
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, str._bootstat.dat
mov edx, 0x100
lea rcx, [rsp + 0x1c0]
call fcn.14001d288
lea rdi, [rsp + 0x180]
lea rsi, str._C:BootBCD
mov ecx, 0x1a
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x19a]
xor eax, eax
mov ecx, 0x26
rep stosb byte [rdi], al
movzx eax, word [rsp + 0x1c0]
mov word [rsp + 0x182], ax
lea rcx, [rsp + 0x182]
call fcn.14002fe70
lea r8, [rsp + 0x180]
mov edx, 0x100
lea rcx, [rsp + 0x1c0]
call fcn.14001d288
lea rcx, [rsp + 0x1c0]
call fcn.14001e2f0
add eax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [0x140041c70]
lea rdx, [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x3c0], eax
cmp dword [rsp + 0x3c0], 0
je 0x140033e82
mov ecx, dword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x140033e87
mov eax, 1
add rsp, 0x3d0
pop rdi
pop rsi
pop rbx
ret
Function at 0x140033eb0
Capabilities:
Get common file path
Set file attributes
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x370
mov dword [rsp + 0x260], 0
lea rdi, [rsp + 0x264]
xor eax, eax
mov ecx, 0xfc
rep stosb byte [rdi], al
cmp dword [rsp + 0x390], 0x10
jle 0x140033ef4
xor eax, eax
jmp 0x1400340ca
mov dword [rsp + 0x368], 0
jmp 0x140033f12
mov eax, dword [rsp + 0x368]
add eax, 1
mov dword [rsp + 0x368], eax
mov eax, dword [rsp + 0x390]
cmp dword [rsp + 0x368], eax
jge 0x140033fbe
mov eax, dword [rsp + 0x368]
lea eax, [rax*4 + 2]
cdqe
lea r9, [rsp + rax*4 + 0x260]
mov eax, dword [rsp + 0x368]
lea eax, [rax*4 + 1]
cdqe
lea r8, [rsp + rax*4 + 0x260]
mov eax, dword [rsp + 0x368]
shl eax, 2
cdqe
lea rdx, [rsp + rax*4 + 0x260]
movsxd rax, dword [rsp + 0x368]
mov rcx, qword [rsp + 0x380]
mov rcx, qword [rcx + rax*8]
call fcn.1400340e0
test eax, eax
jne 0x140033f8e
xor eax, eax
jmp 0x1400340ca
movsxd rdx, dword [rsp + 0x368]
mov eax, dword [rsp + 0x368]
lea eax, [rax*4 + 3]
movsxd rcx, eax
mov rax, qword [rsp + 0x388]
mov eax, dword [rax + rdx*4]
mov dword [rsp + rcx*4 + 0x260], eax
jmp 0x140033f01
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r8, [0x140040d24]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14001d288
lea r8, str.diskpt.crt
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.14001d288
mov edx, 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x360], rax
cmp qword [rsp + 0x360], 0xffffffffffffffff
jne 0x140034050
xor eax, eax
jmp 0x1400340ca
movsxd rax, dword [rsp + 0x390]
shl rax, 2
shl rax, 2
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, eax
lea rdx, [rsp + 0x260]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400340b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x36c], eax
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x36c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1400340ca
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x370
pop rdi
ret
Function at 0x140034630
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x360
xor eax, eax
mov word [rsp + 0x40], ax
lea rdi, [rsp + 0x42]
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
lea rcx, [rsp + 0x40]
call fcn.140032fd0
test eax, eax
jne 0x1400346db
mov dword [rsp + 0x34], 0x200
lea r9, [0x140041c98]
lea r8, [0x140041cb0]
mov edx, 0x80
lea rcx, [rsp + 0x250]
call fcn.14001d240
lea rdx, [rsp + 0x34]
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
lea r8, [0x140041d00]
lea rdx, [rsp + 0x250]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [rsp + 0x350], eax
cmp dword [rsp + 0x350], 0
je 0x1400346db
mov ecx, dword [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14003471e
jmp fcn.1400c489c
add rsp, 0x360
pop rdi
ret

Function at 0x140035e50
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140035e66
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140035e68
xor eax, eax
test eax, eax
je 0x140035e78
mov ecx, eax
call fcn.14001e5bc
or eax, 0xffffffff
jmp 0x140035e7a
xor eax, eax
add rsp, 0x28
ret
Function at 0x180001750
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
movsxd rdi, dword [rcx + 0x3c]
mov eax, 0x8664
add rdi, rcx
cmp word [rdi + 4], ax
movzx eax, word [rdi + 0x14]
lea r13, [rax + rdi + 0x18]
je 0x180001810
cmp dword [rdi + 0xa0], 0
je 0x18000189c
cmp dword [rdi + 0xa4], 0
je 0x18000189c
mov r12d, dword [rdi + 0x38]
xor ebx, ebx
cmp bx, word [rdi + 6]
jae 0x180001803
lea rsi, [r13 + 0xc]
movsxd rax, ebx
lea rdx, str..rsrc
lea rcx, [rax + rax*4]
lea rbp, [r13 + rcx*8]
mov rcx, rbp
call fcn.1800055b4
test eax, eax
je 0x1800017f5
lea rdx, str..reloc
mov rcx, rbp
call fcn.1800055b4
test eax, eax
je 0x1800017f5
mov eax, dword [rsi + 0x28]
sub eax, dword [rsi - 4]
sub eax, dword [rsi]
shr eax, 2
cmp eax, r12d
cmovb r12d, eax
movzx eax, word [rdi + 6]
inc ebx
add rsi, 0x28
cmp ebx, eax
jl 0x1800017b1
lea eax, [r12*4]
jmp 0x18000189e
cmp dword [rdi + 0xb0], 0
je 0x18000189c
cmp dword [rdi + 0xb4], 0
je 0x18000189c
mov r12d, dword [rdi + 0x38]
xor ebx, ebx
cmp bx, word [rdi + 6]
jae 0x180001892
lea rsi, [r13 + 0xc]
nop word [rax + rax]
movsxd rax, ebx
lea rdx, str..rsrc
lea rcx, [rax + rax*4]
lea rbp, [r13 + rcx*8]
mov rcx, rbp
call fcn.1800055b4
test eax, eax
je 0x180001884
lea rdx, str..reloc
mov rcx, rbp
call fcn.1800055b4
test eax, eax
je 0x180001884
mov eax, dword [rsi + 0x28]
sub eax, dword [rsi - 4]
sub eax, dword [rsi]
shr eax, 3
cmp eax, r12d
cmovb r12d, eax
movzx eax, word [rdi + 6]
inc ebx
add rsi, 0x28
cmp ebx, eax
jl 0x180001840
lea eax, [r12*8]
jmp 0x18000189e
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x1800018c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
movzx edi, word [r8 + 0xe]
movzx eax, word [r8 + 0xc]
mov rsi, r9
add edi, eax
mov r10, rcx
lea rbx, [r8 + 0x10]
je 0x180001988
mov qword [rsp + 0x60], rbp
mov ebp, dword [rsp + 0x70]
mov ecx, dword [rbx + 4]
test ecx, ecx
jns 0x180001928
test ebp, ebp
jne 0x180001907
cmp word [rbx], 0x18
je 0x180001977
btr ecx, 0x1f
lea eax, [rbp + 1]
mov r9, rsi
lea r8, [rdx + rcx]
mov rcx, r10
mov dword [rsp + 0x20], eax
call fcn.1800018c0
mov r10, qword [rsp + 0x50]
jmp 0x180001972
btr ecx, 0x1f
mov r9d, dword [rcx + rdx + 4]
mov r8d, dword [rcx + rdx]
shr r9d, 2
add r8, r10
test r9d, r9d
je 0x180001977
mov eax, dword [rsi]
add r8, 4
xor dword [r8 - 4], eax
mov ecx, dword [rsi]
mov eax, 0x8fd66c05
mul ecx
shr edx, 0x11
imul edx, edx, 0x38f40
sub ecx, edx
imul ecx, ecx, 0x2455
add ecx, 0xc091
dec r9d
mov dword [rsi], ecx
jne 0x180001941
mov rdx, qword [rsp + 0x58]
add rbx, 8
dec edi
jne 0x1800018f6
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x180001990
Capabilities:
Check mutex on windows
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x160
mov rax, qword [0x180028010]
xor rax, rsp
mov qword [rsp + 0x150], rax
movsxd rdi, dword [rcx + 0x3c]
xor r13d, r13d
mov rbp, rcx
add rdi, rcx
mov ebx, r13d
movzx eax, word [rdi + 0x14]
lea rsi, [rax + rdi + 0x18]
cmp r13w, word [rdi + 6]
jae 0x180001a01
nop word [rax + rax]
lea rdx, str..rsrc
mov rcx, rsi
call fcn.1800055b4
test eax, eax
je 0x180001a01
movzx eax, word [rdi + 6]
inc ebx
add rsi, 0x28
cmp ebx, eax
jl 0x1800019e0
movzx eax, word [rdi + 6]
cmp ebx, eax
jge 0x180001b9d
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x188], r12
mov byte [rsp + 0x40], r13b
call fcn.1800058f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.QA1Q0ZWQIE__d
lea rcx, [rsp + 0x40]
mov r8d, eax
call fcn.180005680
lea r8, [rsp + 0x40]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov r12, rax
test rax, rax
je 0x180001b95
mov edx, 0x3e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x180001b8c
mov ebx, dword [rsi + 0xc]
add rbx, rbp
mov ecx, dword [rbx]
mov dword [rsp + 0x30], ecx
test ecx, ecx
je 0x180001b83
mov eax, ecx
shr eax, 0x10
xor al, 0x76
cmp cl, al
jne 0x180001b83
mov eax, ecx
shr ecx, 8
shr eax, 0x18
xor al, 0x5a
cmp cl, al
jne 0x180001b83
mov edx, dword [rsi + 0x10]
lea r9, [rsp + 0x34]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edi, word [rbx + 0xe]
movzx eax, word [rbx + 0xc]
add edi, eax
mov dword [rbx], r13d
lea r11, [rbx + 0x10]
je 0x180001b6d
mov eax, dword [rsp + 0x30]
mov ecx, dword [r11 + 4]
test ecx, ecx
jns 0x180001b16
cmp word [r11], 0x18
je 0x180001b61
btr ecx, 0x1f
lea r9, [rsp + 0x30]
mov rdx, rbx
lea r8, [rbx + rcx]
mov rcx, rbp
mov dword [rsp + 0x20], 1
call fcn.1800018c0
mov eax, dword [rsp + 0x30]
jmp 0x180001b61
btr ecx, 0x1f
mov r9d, dword [rcx + rbx + 4]
mov r8d, dword [rcx + rbx]
shr r9d, 2
add r8, rbp
test r9d, r9d
je 0x180001b61
nop
xor dword [r8], eax
mov ecx, dword [rsp + 0x30]
mov eax, 0x8fd66c05
add r8, 4
mul ecx
shr edx, 0x11
imul ecx, ecx, 0x2455
imul edx, edx, 0x7eac6fc0
dec r9d
lea eax, [rdx + rcx + 0xc091]
mov dword [rsp + 0x30], eax
jne 0x180001b30
add r11, 8
dec edi
jne 0x180001ae1
mov edx, dword [rsi + 0x10]
mov r8d, dword [rsp + 0x34]
lea r9, [rsp + 0x34]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800058c0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret
Function at 0x180001d30
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov qword [rsp + 8], 0xfffffffffffffffe
mov eax, 0x5a4d
cmp word [rcx], ax
je 0x180001d4b
xor eax, eax
jmp 0x180001d9f
movsxd r8, dword [rcx + 0x3c]
add r8, rcx
cmp dword [r8], 0x4550
je 0x180001d5f
xor eax, eax
jmp 0x180001d9f
movzx eax, word [r8 + 0x14]
lea r9, [rax + r8 + 0x18]
xor edx, edx
mov dword [rsp], edx
movzx eax, word [r8 + 6]
cmp edx, eax
jge 0x180001d96
movsxd rax, edx
lea rcx, [rax + rax*4]
mov eax, dword [r9 + rcx*8 + 0xc]
add eax, dword [r9 + rcx*8 + 8]
cmp eax, dword [r8 + 0x50]
jbe 0x180001d92
xor eax, eax
jmp 0x180001d9f
inc edx
jmp 0x180001d6b
mov eax, 1
jmp 0x180001d9f
add rsp, 0x18
ret

Function at 0x180002850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov r13, rdx
mov rdi, rcx
mov qword [rcx], rdx
xor r12d, r12d
mov qword [rcx + 8], r12
movsxd rbx, dword [rdx + 0x3c]
add rbx, rdx
mov eax, 0x8664
cmp word [rbx + 4], ax
je 0x180002930
cmp dword [rbx + 0x88], r12d
je 0x1800029bb
cmp dword [rbx + 0x8c], r12d
je 0x1800029bb
movzx eax, word [rbx + 0x14]
lea rbp, [rax + rbx + 0x18]
mov esi, r12d
cmp r12w, word [rbx + 6]
jae 0x1800028f1
nop word [rax + rax]
lea rdx, str..rsrc
mov rcx, rbp
call fcn.1800055b4
test eax, eax
je 0x1800028f1
add rbp, 0x28
inc esi
movzx eax, word [rbx + 6]
cmp esi, eax
jl 0x1800028d0
movzx eax, word [rbx + 6]
cmp esi, eax
jge 0x1800029bb
mov ebx, dword [rbp + 0xc]
add rbx, r13
mov ecx, 0x10
call fcn.180005ae4
mov qword [rsp + 0x50], rax
test rax, rax
je 0x18000292b
mov r9, rbx
mov r8, rbx
mov rdx, r13
mov rcx, rax
call fcn.1800024b0
mov r12, rax
jmp 0x1800029b7
cmp dword [rbx + 0x98], r12d
je 0x1800029bb
cmp dword [rbx + 0x9c], r12d
je 0x1800029bb
movzx eax, word [rbx + 0x14]
lea rbp, [rax + rbx + 0x18]
mov esi, r12d
cmp r12w, word [rbx + 6]
jae 0x180002981
nop dword [rax]
lea rdx, str..rsrc
mov rcx, rbp
call fcn.1800055b4
test eax, eax
je 0x180002981
add rbp, 0x28
inc esi
movzx eax, word [rbx + 6]
cmp esi, eax
jl 0x180002960
movzx eax, word [rbx + 6]
cmp esi, eax
jge 0x1800029bb
mov ebx, dword [rbp + 0xc]
add rbx, r13
mov ecx, 0x10
call fcn.180005ae4
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1800029b7
mov r9, rbx
mov r8, rbx
mov rdx, r13
mov rcx, rax
call fcn.1800024b0
mov r12, rax
mov qword [rdi + 8], r12
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret
Function at 0x18000c7e7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180028010]
jne 0x1800058da
rol rcx, 0x10
test cx, 0xffff
jne 0x1800058d6
repz ret
ror rcx, 0x10
jmp 0x18000c740
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18003a300]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18003a3f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000c7c5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18003a300]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000c7e7
mov rax, qword [rsp + 0x88]
mov qword [0x18003a3f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18003a398], rax
mov rax, qword [0x18003a3f8]
mov qword [0x18003a270], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18003a380], rax
mov dword [0x18003a260], 0xc0000409
mov dword [0x18003a264], 1
mov rax, qword [0x180028010]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180028018]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18003a2f8], eax
mov ecx, 1
call fcn.180010b54
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180021080]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18003a2f8], 0
jne 0x18000c86e
mov ecx, 1
call fcn.180010b54
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1800156e4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180028010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.180005d3c
xor ebx, ebx
cmp qword [0x18003b0a8], rbx
mov rdi, rax
jne 0x1800157f7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1800158ce
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800158ce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18003b0a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18003b0b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18003b0b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18003b0c8], rax
test rax, rax
je 0x1800157ee
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18003b0c0], rax
jmp 0x1800157fe
mov rax, qword [0x18003b0c0]
jmp 0x180015805
mov rax, qword [0x18003b0c0]
mov r11, qword [0x18003b0c8]
cmp rax, rdi
je 0x18001586c
cmp r11, rdi
je 0x18001586c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18003b0c8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x18001586c
test rax, rax
je 0x18001586c
call rsi
test rax, rax
je 0x180015866
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180015866
test byte [rsp + 0x40], 1
jne 0x18001586c
bts ebp, 0x15
jmp 0x1800158ac
mov rcx, qword [0x18003b0b0]
cmp rcx, rdi
je 0x1800158ac
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800158ac
call rax
mov rbx, rax
test rax, rax
je 0x1800158ac
mov rcx, qword [0x18003b0b8]
cmp rcx, rdi
je 0x1800158ac
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800158ac
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18003b0a8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800158ce
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1800158d0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800058c0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180004190
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x18000e770
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x18000e7ad
test rdx, rdx
je 0x18000e7ad
mov rax, qword [rax]
cmp rax, r9
jne 0x18000e790
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret