joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b0df0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x1400b0e06
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x40], r13
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1401181b8]
mov r13d, eax
je 0x1400b0e37
mov rcx, rbx
call fcn.1400b2a10
test al, al
je 0x1400b0e37
xor eax, eax
mov r13, qword [rsp + 0x40]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rbp
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400b0e60
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rbp
jne 0x1400b0e78
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x40]
mov rax, rbx
add rsp, 0x50
pop rbx
ret
cmp byte [0x140116910], 0
jne 0x1400b0e95
mov rdx, rbp
mov rcx, rbx
call fcn.1400b0d50
test rax, rax
jne 0x1400b0fe0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
xor r15b, r15b
xor r14b, r14b
test rbp, rbp
je 0x1400b0f1e
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r12d, eax
test eax, eax
je 0x1400b0f23
cmp dword [0x1401181b8], eax
je 0x1400b0efa
mov rcx, rbp
call fcn.1400b2a10
test al, al
jne 0x1400b0efa
mov ecx, dword [0x1401181b8]
mov r8d, 1
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r14b
test r13d, r13d
je 0x1400b0f23
cmp r12d, r13d
je 0x1400b0f23
mov r8d, 1
mov edx, r13d
mov ecx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r15b
jmp 0x1400b0f23
mov r12d, dword [rsp + 0x60]
xor edi, edi
mov rdx, rbp
mov rcx, rbx
call fcn.1400b0d50
mov rsi, rax
test rax, rax
jne 0x1400b0f87
inc edi
cmp edi, 5
jl 0x1400b0f25
xor r8d, r8d
lea ecx, [rax + 2]
xor r9d, r9d
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], r8b
call fcn.140016e50
xor r8d, r8d
lea ecx, [rsi + 2]
xor r9d, r9d
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], r8b
call fcn.140016e50
mov rdx, rbp
mov rcx, rbx
call fcn.1400b0d50
mov rsi, rax
mov rdi, qword [rsp + 0x78]
test r14b, r14b
mov r14, qword [rsp + 0x38]
je 0x1400b0fa8
mov ecx, dword [0x1401181b8]
xor r8d, r8d
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r15b, r15b
mov r15, qword [rsp + 0x30]
je 0x1400b0fc1
xor r8d, r8d
mov edx, r13d
mov ecx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r12, qword [rsp + 0x48]
test rsi, rsi
je 0x1400b0fd9
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rsi
jmp 0x1400b0fdb
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x40]
add rsp, 0x50
pop rbx
ret
Function at 0x1400b1140
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test r8b, r8b
je 0x1400b115b
call fcn.1400811d0
jmp 0x1400b116b
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
js 0x1400b11de
je 0x1400b11de
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001a70
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b11cb
add edi, esi
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x1400b11cb
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001a70
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400b11a0
mov rax, rbx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b13f0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11be0]
mov eax, 0x11ce0
call fcn.1400d1340
sub rsp, rax
movzx eax, word [rdx]
mov rdi, rcx
mov rcx, qword [rbp + 0x11c10]
cmp ax, 0x41
je 0x1400b1429
cmp ax, 0x61
jne 0x1400b1493
cmp word [rdx + 2], 0
jne 0x1400b1493
cmp word [r8], 0
jne 0x1400b1493
cmp word [r9], 0
jne 0x1400b1493
cmp word [rcx], 0
jne 0x1400b1493
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x1400b1476
cmp byte [rdi + 0x12a], 0
jne 0x1400b1476
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400b1474
mov rcx, rbx
call fcn.1400b2ac0
test al, al
je 0x1400b1476
xor ebx, ebx
cmp byte [rbp + 0x11c20], 0
je 0x1400b148b
test rbx, rbx
je 0x1400b148b
mov qword [rdi + 0xf8], rbx
mov rax, rbx
jmp 0x1400b1601
test ax, ax
jne 0x1400b14b6
cmp word [r8], ax
jne 0x1400b14b6
cmp word [r9], ax
jne 0x1400b14b6
cmp word [rcx], ax
jne 0x1400b14b6
mov rcx, rdi
call fcn.1400b1620
jmp 0x1400b1601
xor ebx, ebx
mov qword [rsp + 0x28], rcx
lea rax, [0x1400e14ec]
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rdx
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov dword [rsp + 0x30], ebx
mov qword [rbp + 0xf48], rax
mov byte [rbp + 0x1781], bl
mov dword [rbp + 0x1784], ebx
mov qword [rbp + 0x1788], rbx
mov qword [rbp + 0x1790], rbx
mov qword [rbp + 0x1798], rbx
mov dword [rbp + 0x17a0], ebx
mov qword [rbp + 0x17a8], rbx
mov qword [rbp + 0x17b8], rbx
mov qword [rbp + 0x17c0], rbx
call fcn.1400b2ce0
test eax, eax
je 0x1400b15d0
test byte [rsp + 0x30], 2
movzx eax, byte [rbp + 0x11c18]
mov byte [rbp + 0x1781], al
mov rax, qword [rbp + 0x11c28]
mov qword [rbp + 0x1798], rax
mov eax, dword [rbp + 0x11c30]
mov dword [rbp + 0x17a0], eax
je 0x1400b15d4
mov rax, qword [rbp + 0xf68]
cmp rax, 0xffff
je 0x1400b15a5
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b15d0
mov rdx, qword [rbp + 0xf68]
mov rcx, rdi
call fcn.1400b2b50
test al, al
jne 0x1400b159e
mov rcx, qword [rbp + 0xf68]
lea edx, [rbx - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x1400b15d0
mov rax, qword [rbp + 0xf68]
cmp qword [rbp + 0x17c0], rax
je 0x1400b15bf
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x17c0], rax
call fcn.1400b3200
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400b32f0
test rax, rax
jne 0x1400b15e6
xor eax, eax
jmp 0x1400b1601
lea rdx, [rsp + 0x30]
lea rcx, [0x1400b16d0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x1788]
cmp byte [rbp + 0x11c20], bl
je 0x1400b1601
test rax, rax
je 0x1400b1601
mov qword [rdi + 0xf8], rax
lea r11, [rsp + 0x11ce0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400b3200
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1890]
test rcx, rcx
je 0x1400b32dd
mov eax, dword [rbx]
test eax, eax
je 0x1400b32dd
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
test al, 1
jne 0x1400b323f
mov rax, qword [rbx + 0x1018]
cmp word [rax], si
je 0x1400b325d
lea rdx, [rbx + 0x189c]
mov r8d, 0x7fff
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400b325d
mov word [rbx + 0x189c], si
test byte [rbx], 4
je 0x1400b3276
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1898]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [rbx], 0x20
je 0x1400b32b4
mov rcx, qword [rbx + 0x1890]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400b32b4
movzx r8d, byte [rbx + 0x1850]
mov ecx, dword [rsp + 0x30]
lea rdx, [rbx + 0x11a9c]
call fcn.140078bf0
test eax, eax
jne 0x1400b32b4
mov word [rbx + 0x11a9c], si
test byte [rbx], 8
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
je 0x1400b32dd
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1189a]
mov r8d, 0x101
call qword [sym.imp.USER32.dll_GetClassNameW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400b3b90
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11cd8
call fcn.1400d1340
sub rsp, rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400b3c4e
xor r9d, r9d
lea rcx, [0x1400e14ec]
mov byte [rsp + 0x18a0], dl
mov qword [rsp + 0x1038], rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400b44a0]
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x1871], r9b
mov dword [rsp + 0x1874], r9d
mov qword [rsp + 0x1878], r9
mov qword [rsp + 0x1880], r9
mov qword [rsp + 0x1888], r9
mov dword [rsp + 0x1890], r9d
mov qword [rsp + 0x18a8], r9
mov qword [rsp + 0x18b0], r9
mov qword [rsp + 0x1898], rax
mov dword [rsp + 0x18a4], r8d
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x1878], 0
je 0x1400b3c4e
mov rax, qword [0x140111488]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b3c4e
mov edx, 1
call fcn.140001a70
mov eax, 1
add rsp, 0x11cd8
ret
Function at 0x1400b3c60
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push r12
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
movzx r12d, dl
mov rbx, rcx
jne 0x1400b3c8a
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x140111488]
mov rcx, rbx
mov rdx, rax
mov rdi, rax
call fcn.1400b4200
cmp byte [rbx], 0
mov rbp, rax
je 0x1400b3cc1
test rax, rax
jne 0x1400b3cca
jmp 0x1400b3d62
test rax, rax
jne 0x1400b3d5d
test rdi, rdi
je 0x1400b3d5d
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001a70
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b3d3f
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rsi + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x1400b3d3f
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001a70
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400b3d10
mov rax, qword [0x140111488]
mov rsi, qword [rsp + 0x38]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b3d5d
mov edx, 1
call fcn.140001a70
cmp byte [rbx], 0
je 0x1400b3d76
xor r9d, r9d
mov r8, rbp
movzx edx, r12b
mov rcx, rbx
call fcn.1400b3da0
jmp 0x1400b3d82
movzx edx, r12b
mov rcx, rbx
call fcn.1400b3f70
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400b3f70
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x11ce0
call fcn.1400d1340
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx edi, dl
mov rbx, rcx
je 0x1400b4135
xor edx, edx
call fcn.1400b4150
test eax, eax
jne 0x1400b3fb0
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
mov qword [rsp + 0x11cf0], rbp
mov qword [rsp + 0x11cf8], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x140111488]
mov rcx, rbx
mov rdx, rax
mov rsi, rax
call fcn.1400b4200
mov ecx, dword [0x14011819c]
xor ebp, ebp
test rax, rax
lea rax, [0x1400e14ec]
cmovne ecx, ebp
mov qword [rsp + 0x1048], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x1884], ebp
mov qword [rsp + 0x1888], rbp
mov qword [rsp + 0x1890], rbp
mov dword [0x14011819c], ecx
mov qword [rsp + 0x18b8], rbp
mov qword [rsp + 0x18c0], rbp
test dil, dil
je 0x1400b403a
mov byte [rsp + 0x1881], bpl
test ecx, ecx
je 0x1400b4042
mov byte [rsp + 0x1881], 1
mov rax, qword [0x1401181a8]
mov dword [rsp + 0x18a0], ecx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x1898], rax
mov rax, qword [rbx + 0x10]
lea rcx, [0x1400b4320]
mov qword [rsp + 0x18a8], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x1888]
test rax, rax
je 0x1400b40f9
lea rdx, [rsp + 0x20]
lea rcx, [0x1400b2950]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x1400b40c0
mov rcx, qword [rsp + 0x1888]
call fcn.1400b3860
mov qword [rsp + 0x1888], rbx
jmp 0x1400b40c8
mov rbx, qword [rsp + 0x1888]
mov rcx, rbx
call fcn.1400b0df0
mov rcx, qword [rsp + 0x1888]
call fcn.1400b3860
mov r11, qword [0x140111488]
mov ecx, dword [r11 + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b4125
mov edx, 1
call fcn.140001a70
jmp 0x1400b4125
mov eax, dword [0x14011819c]
test eax, eax
je 0x1400b4125
cmp eax, 1
mov dword [0x14011819c], ebp
setg al
test al, al
je 0x1400b4125
mov rcx, rsi
call fcn.1400b3860
xor edx, edx
mov rcx, rbx
call fcn.1400b3f70
mov rsi, qword [rsp + 0x11cf8]
mov rbp, qword [rsp + 0x11cf0]
mov eax, 1
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
Function at 0x1400c965c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400c94cc

Function at 0x1400d32c8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401102b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400cd0f8
xor ebx, ebx
cmp qword [0x140114a68], rbx
mov rdi, rax
jne 0x1400d33db
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400d34b2
lea rdx, [0x1400e09e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d34b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140114a68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140114a70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140114a78], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140114a88], rax
test rax, rax
je 0x1400d33d2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140114a80], rax
jmp 0x1400d33e2
mov rax, qword [0x140114a80]
jmp 0x1400d33e9
mov rax, qword [0x140114a80]
mov r11, qword [0x140114a88]
cmp rax, rdi
je 0x1400d3450
cmp r11, rdi
je 0x1400d3450
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140114a88]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400d3450
test rax, rax
je 0x1400d3450
call rsi
test rax, rax
je 0x1400d344a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400d344a
test byte [rsp + 0x40], 1
jne 0x1400d3450
bts ebp, 0x15
jmp 0x1400d3490
mov rcx, qword [0x140114a70]
cmp rcx, rdi
je 0x1400d3490
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d3490
call rax
mov rbx, rax
test rax, rax
je 0x1400d3490
mov rcx, qword [0x140114a78]
cmp rcx, rdi
je 0x1400d3490
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d3490
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140114a68]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400d34b2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400d34b4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d08b0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d561f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401102b0]
jne 0x1400d08ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1400d08c6
repz ret
ror rcx, 0x10
jmp 0x1400d5578
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140114bb0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140114ca8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400d55fd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140114bb0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400d561f
mov rax, qword [rsp + 0x88]
mov qword [0x140114ca8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140114c48], rax
mov rax, qword [0x140114ca8]
mov qword [0x140114b20], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140114c30], rax
mov dword [0x140114b10], 0xc0000409
mov dword [0x140114b14], 1
mov rax, qword [0x1401102b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401102b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140114ba8], eax
mov ecx, 1
call fcn.1400d2fe8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400e13b0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140114ba8], 0
jne 0x1400d56a6
mov ecx, 1
call fcn.1400d2fe8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x100003560
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100005110]
jne 0x10000357b
rol rcx, 0x10
test cx, 0xffff
jne 0x100003577
ret 0
ror rcx, 0x10
jmp 0x10000386c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100005640]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x100005738]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1000038f1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100005640]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x100003913
mov rax, qword [rsp + 0x88]
mov qword [0x100005738], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1000056d8], rax
mov rax, qword [0x100005738]
mov qword [0x1000055b0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000056c0], rax
mov dword [0x1000055a0], 0xc0000409
mov dword [0x1000055a4], 1
mov rax, qword [0x100005110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100005118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000012a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100003708
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100003755
cmp rcx, 0xffffffffffffffff
je 0x100003755
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000374d
cmp dword [rcx + 0x3c], edx
jl 0x10000374d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000374d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100003755
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001c48
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c92
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c92
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c92
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c92
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c92
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c94
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14022dda0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x14022ddb0]
mov dword [rax], 1
mov rax, qword [0x14022ddc0]
mov dword [rax], 1
mov rax, qword [0x14022dd10]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x14022dd90]
mov dword [0x14023500c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x14022de80]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x14022de60]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x14022dc80]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x14000da50
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x100
call sym.operator_new_unsigned_long_long_
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
movups xmmword [rax + 0x80], xmm0
movups xmmword [rax + 0x90], xmm0
movups xmmword [rax + 0xa0], xmm0
movups xmmword [rax + 0xb0], xmm0
movups xmmword [rax + 0xc0], xmm0
movups xmmword [rax + 0xd0], xmm0
movups xmmword [rax + 0xe0], xmm0
movups xmmword [rax + 0xf0], xmm0
xor eax, eax
nop dword [rax]
mov byte [rcx + rax], al
inc rax
cmp rax, 0x100
jne 0x14000dad0
mov r9, qword [rbx]
mov r10, qword [rbx + 8]
sub r10, r9
xor r8d, r8d
xor r11d, r11d
nop
movzx ebx, byte [rcx + r8]
add r11b, bl
mov rax, r8
xor edx, edx
div r10
add r11b, byte [r9 + rdx]
movzx eax, r11b
movzx edx, byte [rcx + rax]
mov byte [rcx + r8], dl
mov byte [rcx + rax], bl
inc r8
cmp r8, 0x100
jne 0x14000daf0
test rsi, rsi
je 0x14000db87
xor eax, eax
xor edx, edx
xor r8d, r8d
nop dword [rax + rax]
lea r9d, [r8 + 1]
lea r10d, [r8 + 0x100]
test r9d, r9d
cmovns r10d, r9d
and r10d, 0xffffff00
neg r10d
add r8d, r10d
inc r8d
movsxd r9, r8d
movzx r10d, byte [rcx + r9]
add dl, r10b
movzx r11d, dl
movzx ebx, byte [rcx + r11]
mov byte [rcx + r9], bl
mov byte [rcx + r11], r10b
add r10b, byte [rcx + r9]
movzx r9d, r10b
movzx r9d, byte [rcx + r9]
xor byte [rdi + rax], r9b
inc rax
cmp rsi, rax
jne 0x14000db30
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp sym.operator_delete_void_