joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000963b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18001e648]
jne 0x18000581a
rol rcx, 0x10
test cx, 0xffff
jne 0x180005816
repz ret
ror rcx, 0x10
jmp 0x180009594
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18001fe30]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18001ff28]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180009619
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18001fe30]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000963b
mov rax, qword [rsp + 0x88]
mov qword [0x18001ff28], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18001fec8], rax
mov rax, qword [0x18001ff28]
mov qword [0x18001fda0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18001feb0], rax
mov dword [0x18001fd90], 0xc0000409
mov dword [0x18001fd94], 1
mov rax, qword [0x18001e648]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18001e650]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18001fe28], eax
mov ecx, 1
call fcn.180012388
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800171e0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18001fe28], 0
jne 0x1800096c2
mov ecx, 1
call fcn.180012388
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180013964
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18001e648]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000bbec
xor ebx, ebx
cmp qword [0x180020dc8], rbx
mov rdi, rax
jne 0x180013a77
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180013b4e
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180013b4e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180020dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180020dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180020dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180020de8], rax
test rax, rax
je 0x180013a6e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180020de0], rax
jmp 0x180013a7e
mov rax, qword [0x180020de0]
jmp 0x180013a85
mov rax, qword [0x180020de0]
mov r11, qword [0x180020de8]
cmp rax, rdi
je 0x180013aec
cmp r11, rdi
je 0x180013aec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180020de8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180013aec
test rax, rax
je 0x180013aec
call rsi
test rax, rax
je 0x180013ae6
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180013ae6
test byte [rsp + 0x40], 1
jne 0x180013aec
bts ebp, 0x15
jmp 0x180013b2c
mov rcx, qword [0x180020dd0]
cmp rcx, rdi
je 0x180013b2c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180013b2c
call rax
mov rbx, rax
test rax, rax
je 0x180013b2c
mov rcx, qword [0x180020dd8]
cmp rcx, rdi
je 0x180013b2c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180013b2c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180020dc8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180013b4e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180013b50
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180005800
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180001000
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov edx, dword [0x18005d200]
test edx, edx
je 0x18000103f
mov edx, edx
lea r8, [0x18005d208]
xor eax, eax
nop
cmp dword [r8], ecx
je 0x180001201
inc rax
add r8, 0x10
cmp rdx, rax
jne 0x180001020
mov eax, 0xffffffff
jmp 0x180001201
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov r11, qword [rdx + 0x30]
mov eax, 0xffffffff
test r11, r11
je 0x180001201
xor r10d, r10d
mov r9d, 0xdfdfdfdf
jmp 0x18000107f
mov r10, rsi
mov rdx, qword [rdx]
mov r11, qword [rdx + 0x30]
test r11, r11
je 0x1800010c1
mov r8, r11
movsxd r11, dword [r11 + 0x3c]
mov esi, dword [r11 + r8 + 0x88]
test rsi, rsi
je 0x180001073
mov r10d, dword [rsi + r8 + 0xc]
add rsi, r8
mov r11d, dword [r10 + r8]
and r11d, r9d
cmp r11d, 0x4c44544e
jne 0x180001070
mov r11d, dword [r10 + r8 + 4]
and r11d, r9d
mov r10, rsi
cmp r11d, 0x4c440e4c
jne 0x180001073
jmp 0x1800010cd
mov rsi, r10
test r10, r10
je 0x180001201
mov r9d, dword [rsi + 0x18]
mov r10d, dword [rsi + 0x1c]
add r10, r8
mov r11d, dword [rsi + 0x20]
add r11, r8
mov esi, dword [rsi + 0x24]
add rsi, r8
xor edx, edx
lea rdi, [0x18005d200]
jmp 0x1800010f9
test r9, r9
je 0x18000117f
dec r9d
mov ebx, dword [r11 + r9*4]
movzx ebp, word [r8 + rbx]
cmp ebp, 0x775a
jne 0x1800010f0
add rbx, r8
mov ebp, 0x428064a9
mov r14d, 1
xor r15d, r15d
nop
mov r12d, ebp
movzx r15d, word [r15 + rbx]
rol ebp, 0x18
add ebp, r15d
xor ebp, r12d
mov r15d, r14d
inc r14d
cmp byte [rbx + r15], 0
jne 0x180001120
mov ebx, edx
shl rbx, 4
mov dword [rbx + rdi + 8], ebp
movzx r14d, word [rsi + r9*2]
mov ebp, dword [r10 + r14*4]
mov dword [rbx + rdi + 0xc], ebp
mov qword [rbx + rdi + 0x10], 0
inc edx
cmp edx, 0x258
jne 0x1800010f0
mov dword [0x18005d200], 0x258
mov edx, 0x258
mov r8d, 0x257
jmp 0x18000118d
mov dword [0x18005d200], edx
mov r8d, edx
dec r8d
je 0x18000120c
xor r9d, r9d
lea r10, [0x18005d220]
mov r11d, r8d
jmp 0x1800011a8
dec r11d
cmp r9d, r8d
je 0x1800011f9
mov r11d, r11d
inc r9d
cmp edx, r9d
je 0x1800011a0
mov rsi, r11
mov rdi, r10
jmp 0x1800011c9
add rdi, 0x10
dec rsi
je 0x1800011a0
mov ebx, dword [rdi - 0x14]
mov ebp, dword [rdi - 4]
cmp ebx, ebp
jbe 0x1800011c0
mov r14d, dword [rdi - 0x18]
mov r15, qword [rdi - 0x10]
mov r12d, dword [rdi - 8]
mov dword [rdi - 0x18], r12d
mov dword [rdi - 0x14], ebp
mov r12, qword [rdi]
mov qword [rdi - 0x10], r12
mov dword [rdi - 8], r14d
mov dword [rdi - 4], ebx
mov qword [rdi], r15
jmp 0x1800011c0
test edx, edx
jne 0x180001014
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov edx, 1
jmp 0x180001014
Function at 0x180006940
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
xor esi, esi
test rcx, rcx
je 0x180006a90
mov rdi, rcx
lea rcx, str.INTEL_ISA_DISABLE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x180006a90
mov rcx, rax
movzx eax, byte [rax]
xor esi, esi
test al, al
je 0x180006a90
lea rdx, [0x18005fe00]
xor r8d, r8d
lea r9, [rcx + 1]
mov r10d, 1
xor r11d, r11d
cmp al, 0x2c
jne 0x1800069b3
nop dword [rax]
movzx eax, byte [rcx + r11 + 1]
inc r11
dec r10
inc r9
cmp al, 0x2c
je 0x1800069a0
movzx eax, al
test eax, eax
je 0x180006a90
nop
mov rax, r9
movzx ebx, byte [r9]
inc r9
cmp ebx, 0x2c
je 0x1800069e0
test ebx, ebx
je 0x1800069e0
mov r8, rax
jmp 0x1800069c0
mov rax, r8
sub rax, rcx
inc rax
cmp rax, r11
jne 0x180006a01
dec r9
movzx eax, byte [r9]
mov rcx, r9
test al, al
jne 0x18000698b
jmp 0x180006a90
cmp byte [0x18005fdf0], 0
jne 0x180006a0f
call fcn.180005e80
mov rax, rcx
neg rax
add r11, rcx
mov rbx, r8
not rbx
add rbx, r11
mov ecx, 1
jmp 0x180006a39
inc rcx
cmp rcx, 0x47
je 0x1800069ee
lea r14, [rcx + rcx*2]
mov r14, qword [rdx + r14*8 + 0x10]
test r14, r14
je 0x180006a30
xor r15d, r15d
nop word [rax + rax]
movzx ebp, byte [r11 + r15]
cmp bpl, byte [r14 + r15]
jne 0x180006a30
inc r15
mov r12, rbx
add r12, r15
jne 0x180006a50
add r14, r8
add r14, rax
cmp byte [r10 + r14], 0
jne 0x180006a30
cmp ecx, 2
jb 0x1800069ee
mov rax, rdi
call fcn.1800068e0
cmp eax, 1
adc rsi, 0
jmp 0x1800069ee
mov eax, esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x18000a7b0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x4856bb2d
call section..text
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000a7f0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x31a91101
call section..text
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000a830
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xdfc8c957
call section..text
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000a870
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xbf31c7ff
call section..text
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140002100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140002133
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002176
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140002171
cmp rbx, r11
jae 0x140002176
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140002160
cmp rbx, r11
jb 0x14000217a
xor eax, eax
jmp 0x140002186
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140003013
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140013060]
jne 0x14000251a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002516
repz ret
ror rcx, 0x10
jmp 0x140002f6c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140014620]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140014718]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140002ff1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140014620]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140003013
mov rax, qword [rsp + 0x88]
mov qword [0x140014718], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400146b8], rax
mov rax, qword [0x140014718]
mov qword [0x140014590], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400146a0], rax
mov dword [0x140014580], 0xc0000409
mov dword [0x140014584], 1
mov rax, qword [0x140013060]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140013068]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140014618], eax
mov ecx, 1
call fcn.14000786c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000e5a8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140014618], 0
jne 0x14000309a
mov ecx, 1
call fcn.14000786c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140008a98
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140013060]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140003e40
xor ebx, ebx
cmp qword [0x140015578], rbx
mov rdi, rax
jne 0x140008bab
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140008c82
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008c82
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140015578], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140015580], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140015588], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140015598], rax
test rax, rax
je 0x140008ba2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140015590], rax
jmp 0x140008bb2
mov rax, qword [0x140015590]
jmp 0x140008bb9
mov rax, qword [0x140015590]
mov r11, qword [0x140015598]
cmp rax, rdi
je 0x140008c20
cmp r11, rdi
je 0x140008c20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140015598]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140008c20
test rax, rax
je 0x140008c20
call rsi
test rax, rax
je 0x140008c1a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140008c1a
test byte [rsp + 0x40], 1
jne 0x140008c20
bts ebp, 0x15
jmp 0x140008c60
mov rcx, qword [0x140015580]
cmp rcx, rdi
je 0x140008c60
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008c60
call rax
mov rbx, rax
test rax, rax
je 0x140008c60
mov rcx, qword [0x140015588]
cmp rcx, rdi
je 0x140008c60
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008c60
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140015578]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140008c82
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140008c84
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002500
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000b1ac
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
cmp dword [0x140015678], 0
je 0x14000b28a
cmp qword [0x140015650], 0
je 0x14000b1cc
call fcn.14000b164
lea rax, [rsp + 0x50]
lea rdx, str.Control_PanelDesktop
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000b28a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, str.ScreenSaveUsePassword
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000b27f
cmp dword [rsp + 0x48], eax
je 0x14000b27f
lea rcx, str.PASSWORD.CPL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140015650], rax
test rax, rax
je 0x14000b27f
lea rdx, str.VerifyScreenSavePwd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140015658], rax
test rax, rax
je 0x14000b27a
mov ecx, 1
call fcn.14000b110
jmp 0x14000b27f
call fcn.14000b164
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret
Function at 0x14000b3d4
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [0x140015640], 0
mov rbp, r9
mov rdi, r8
mov ebx, edx
mov rsi, rcx
jne 0x14000b482
cmp dword [0x140015644], 0
jne 0x14000b482
cmp edx, 0x10
je 0x14000b59b
cmp edx, 0x8000
je 0x14000b575
cmp dword [0x140015648], 0
jne 0x14000b482
mov eax, 0x104
cmp edx, eax
ja 0x14000b4a8
je 0x14000b4f7
cmp edx, 0x18
je 0x14000b475
cmp edx, 0x1c
je 0x14000b46d
cmp edx, 0x20
je 0x14000b45e
cmp edx, 0x48
je 0x14000b455
cmp edx, 0x100
jmp 0x14000b4f5
cmp r8, 3
jmp 0x14000b4f5
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
jmp 0x14000b493
test r8, r8
jmp 0x14000b4f5
test r8d, r8d
je 0x14000b482
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
mov r9, rbp
mov r8, rdi
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_DefWindowProcA]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, edx
sub ecx, 0x200
je 0x14000b50f
mov eax, 1
sub ecx, eax
je 0x14000b4f7
sub ecx, 3
je 0x14000b4f7
sub ecx, 3
je 0x14000b4f7
cmp ecx, 0x11
jne 0x14000b482
test r8, r8
je 0x14000b493
cmp r8, 5
jbe 0x14000b4f7
cmp r8, 8
jbe 0x14000b4f2
cmp r8, 0xa
je 0x14000b482
cmp r8, 0x12
je 0x14000b4f2
cmp r8, 0x8013
jne 0x14000b4f7
jmp 0x14000b482
test al, r9b
jne 0x14000b482
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x14000b482
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11d, dword [rsp + 0x20]
sub r11d, dword [0x140016918]
je 0x14000b530
test r11d, r11d
jns 0x14000b530
neg r11d
mov eax, dword [rsp + 0x24]
sub eax, dword [0x14001691c]
je 0x14000b542
test eax, eax
jns 0x14000b542
neg eax
add eax, r11d
cmp eax, dword [0x14001438c]
jbe 0x14000b482
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageA]
mov r11, qword [rsp + 0x20]
mov qword [0x140016918], r11
jmp 0x14000b482
cmp dword [0x140015678], 0
je 0x14000b482
mov rax, qword [0x140015658]
test rax, rax
je 0x14000b466
call rax
cdqe
jmp 0x14000b493
cmp dword [0x140015678], 0
je 0x14000b482
call fcn.14000b290
test eax, eax
jne 0x14000b482
lea rcx, [0x140016918]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
jmp 0x14000b493
Function at 0x140077203
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x140087d90
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x2c8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x7a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x2e8]
mov rax, qword [0x1401a7008]
xor rax, rbp
mov qword [rbp + 0x298], rax
lea rcx, [0x1401b9255]
call fcn.14007a304
mov byte [rbp + 0x1c4], 0
lea rdx, [rbp + 0x10]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140087dff
mov eax, 1
jmp 0x140087eae
cmp dword [rbp + 0x2c0], 1
jle 0x140087e48
mov eax, 8
imul rax, rax, 1
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x2c8]
mov rax, qword [rdx + rax]
movzx eax, word [rax + rcx]
cmp eax, 0x2d
jne 0x140087e48
mov rdx, qword [rbp + 0x2c8]
mov ecx, dword [rbp + 0x2c0]
call fcn.140085160
mov byte [rbp + 0x1c4], al
jmp 0x140087e4f
mov byte [rbp + 0x1c4], 1
movzx eax, byte [rbp + 0x1c4]
test eax, eax
jne 0x140087e81
call fcn.140085da0
mov byte [rbp + 0x1c4], al
movzx eax, byte [rbp + 0x1c4]
test eax, eax
jne 0x140087e75
call fcn.140085540
movzx ecx, byte [rbp + 0x1c4]
call fcn.140087a90
call qword [sym.imp.WS2_32.dll_WSACleanup]
movzx eax, byte [rbp + 0x1c4]
test eax, eax
je 0x140087e9e
mov dword [rbp + 0x294], 1
jmp 0x140087ea8
mov dword [rbp + 0x294], 0
mov eax, dword [rbp + 0x294]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140173030]
call fcn.140079a35
mov rax, rdi
mov rcx, qword [rbp + 0x298]
xor rcx, rbp
call fcn.140078919
lea rsp, [rbp + 0x2a8]
pop rdi
pop rbp
ret
Function at 0x1400779c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400823f0
mov word [rsp + 0x20], r9w
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
lea rcx, [0x1401b9255]
call fcn.14007a304
xor eax, eax
mov word [rbp + 0x44], ax
xor eax, eax
mov word [rbp + 0x64], ax
mov eax, dword [rbp + 0x168]
and eax, 0xfffffffe
mov dword [rbp + 0x168], eax
mov dword [rbp + 4], 0
jmp 0x140082465
mov eax, dword [rbp + 4]
add eax, 2
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x168]
cmp dword [rbp + 4], eax
jae 0x140082522
movzx eax, word [rbp + 0x170]
movzx ecx, word [rbp + 0x64]
imul eax, ecx
movzx ecx, word [rbp + 0x178]
add eax, ecx
mov word [rbp + 0x64], ax
mov eax, dword [rbp + 4]
mov ecx, 1
imul rcx, rcx, 1
mov rdx, qword [rbp + 0x160]
movzx eax, byte [rdx + rax]
mov byte [rbp + rcx + 0x24], al
mov eax, dword [rbp + 4]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x160]
movzx eax, byte [rdx + rax + 1]
mov byte [rbp + rcx + 0x24], al
movzx eax, word [rbp + 0x64]
movzx ecx, word [rbp + 0x24]
xor ecx, eax
mov eax, ecx
mov word [rbp + 0x24], ax
movzx eax, word [rbp + 0x24]
movzx ecx, word [rbp + 0x44]
add ecx, eax
mov eax, ecx
mov word [rbp + 0x44], ax
mov eax, 1
imul rax, rax, 1
mov ecx, dword [rbp + 4]
mov rdx, qword [rbp + 0x160]
movzx eax, byte [rbp + rax + 0x24]
mov byte [rdx + rcx], al
mov eax, 1
imul rax, rax, 0
mov ecx, dword [rbp + 4]
mov rdx, qword [rbp + 0x160]
movzx eax, byte [rbp + rax + 0x24]
mov byte [rdx + rcx + 1], al
jmp 0x14008245c
movzx eax, word [rbp + 0x44]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140171b90]
call fcn.140079a35
mov eax, edi
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret