joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004167f
Capabilities:
Terminate process

Disassembly:
jmp 0x14006cf20
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x128]
mov qword [rbp + 0xc8], 0xfffffffffffffffe
lea rcx, [0x14011b10f]
call fcn.14003f7fd
nop
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll_exit]
nop
mov rax, qword [rbp + 0x100]
add rax, 0x320
mov rcx, rax
call fcn.14004012b
nop
mov rax, qword [rbp + 0x100]
add rax, 0x2f8
mov rcx, rax
call fcn.14004003b
nop
mov rax, qword [rbp + 0x100]
add rax, 0x2c8
mov rcx, rax
call fcn.1400413a0
nop
mov rax, qword [rbp + 0x100]
add rax, 0x200
mov rcx, rax
call fcn.14003fd34
nop
mov rax, qword [rbp + 0x100]
add rax, 0x1d0
mov rcx, rax
call fcn.1400413a0
nop
mov rax, qword [rbp + 0x100]
add rax, 0x140
mov rcx, rax
call fcn.14003f3ed
nop
mov rax, qword [rbp + 0x100]
add rax, 0x128
mov rcx, rax
call fcn.14003f3ed
nop
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140041cd8
Capabilities:
Create process on windows

Disassembly:
jmp 0x14007add0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1f8
lea rbp, [rsp + 0x20]
mov rdi, rsp
mov ecx, 0x7e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x218]
mov rax, qword [0x140106018]
xor rax, rbp
mov qword [rbp + 0x1c8], rax
lea rcx, [0x14011b10f]
call fcn.14003f7fd
lea rcx, [rbp + 8]
call fcn.14003fb27
mov dword [rbp + 0x50], 0x70
lea rax, [rbp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
lea rax, str.runas
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 8]
call fcn.140040612
mov qword [rbp + 0x68], rax
lea rax, str._ignoreinstances
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x58], 0
mov dword [rbp + 0x80], 0xa
lea rcx, [rbp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x14007ae95
mov byte [rbp + 0x194], 0
lea rcx, [rbp + 8]
call fcn.1400413a0
movzx eax, byte [rbp + 0x194]
jmp 0x14007aec1
mov rax, qword [rbp + 0x1f0]
mov byte [rax], 0
mov byte [rbp + 0x1b4], 1
lea rcx, [rbp + 8]
call fcn.1400413a0
movzx eax, byte [rbp + 0x1b4]
jmp 0x14007aec1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400d9340]
call fcn.1400419f4
mov rax, rdi
mov rcx, qword [rbp + 0x1c8]
xor rcx, rbp
call fcn.14003fb63
lea rsp, [rbp + 0x1d8]
pop rdi
pop rbp
ret
Function at 0x613c1430
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xf0], rcx
mov dword [rbp + 0xdc], 0
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0xffffffffffffffff
jne 0x613c147b
mov eax, 0
jmp 0x613c1509
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32First
test eax, eax
jne 0x613c14b3
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x613c1509
lea rax, [rbp - 0x60]
add rax, 0x2c
mov rdx, rax
mov rcx, qword [rbp + 0xf0]
call sym.strcmp
test eax, eax
jne 0x613c14d9
mov eax, dword [rbp - 0x58]
mov dword [rbp + 0xdc], eax
jmp 0x613c14f0
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xd0]
mov rcx, rax
call sym.Process32Next
test eax, eax
jne 0x613c14b3
mov rax, qword [rbp + 0xd0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0xdc]
add rsp, 0x160
pop rbp
ret

Function at 0x613c1861
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call rax
mov rcx, qword [rbp + 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
je 0x613c1915
mov rdx, qword [rbp + 0x18]
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x14]
lea rax, [rbp - 0x10]
mov r9, rdx
mov r8d, 0x40
movabs rdx, 0x38d7ea4c67fff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x40]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp + 8], rax
mov eax, 1
add rsp, 0x60
pop rbp
ret
Function at 0x613c1d80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x613c8024]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x613c1e9a
mov rax, qword [0x613c8028]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x613c1dce
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x613c1e80
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x613c1db2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x613c1ed2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x613c8028]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x613c8028]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x613c1eb5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x613c1e79
sub eax, 0x40
and eax, 0xffffffbf
je 0x613c1e79
mov r9, rbp
add r9, qword [0x613c8028]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x613c1ea1
add dword [0x613c8024], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x613c1ddb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x613c8028]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x613c2a90
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x613c2aa0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x613c2ab0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x613c2af1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x613c2ae8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x613c2af3
add rax, 0x28
cmp rax, r9
jne 0x613c2ad4
xor eax, eax
repz ret

Function at 0x613c2ba0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x613c5190]
cmp word [rbx], 0x5a4d
je 0x613c2bc0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x613c2bb4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x613c2e20
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x613c8900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x613c88e0]
test rbx, rbx
je 0x613c2e74
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x613c2e6b
test rsi, rsi
je 0x613c2e6b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x613c2e50
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x613c8900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x1400110d2
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x1400122c0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x148]
lea rcx, [0x14002a0a6]
call fcn.140011410
mov dword [rbp + 4], 0
jmp 0x140012315
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 4
jge 0x1400123f2
movsxd rax, dword [rbp + 0x130]
imul rax, rax, 0x80
lea rcx, [section..data]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0x138]
imul rcx, rcx, 0x20
add rax, rcx
movsxd rcx, dword [rbp + 4]
mov eax, dword [rax + rcx*8]
add eax, dword [rbp + 0x120]
lea eax, [rax + rax + 5]
mov word [rbp + 0x24], ax
movsxd rax, dword [rbp + 0x130]
imul rax, rax, 0x80
lea rcx, [section..data]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0x138]
imul rcx, rcx, 0x20
add rax, rcx
movsxd rcx, dword [rbp + 4]
mov eax, dword [rax + rcx*8 + 4]
mov ecx, dword [rbp + 0x128]
lea eax, [rax + rcx + 1]
mov word [rbp + 0x26], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rbp + 0x24]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp dword [rbp + 0x140], 0
je 0x1400123c8
mov dword [rbp + 0xf4], 3
jmp 0x1400123d2
mov dword [rbp + 0xf4], 0
movsxd rax, dword [rbp + 0xf4]
lea rcx, [0x140023380]
lea rax, [rcx + rax*4]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_puts]
jmp 0x14001230d
lea rcx, [rbp - 0x20]
lea rdx, [0x14001e390]
call fcn.14001139d
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011154
Capabilities:
Execute command

Disassembly:
jmp 0x140013d40
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14002a0a6]
call fcn.140011410
lea rcx, [0x14001fbe8]
call qword [sym.imp.ucrtbased.dll_system]
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
inc eax
mov dword [0x140023b14], eax
call qword [sym.imp.ucrtbased.dll_rand]
cdq
mov ecx, 0x14
idiv ecx
mov eax, edx
inc eax
mov dword [0x140023b18], eax
mov eax, dword [0x140023b14]
mov ecx, dword [0x140023b18]
sub ecx, eax
mov eax, ecx
mov ecx, eax
call fcn.1400113e8
cmp eax, 8
jg 0x140013d80
mov dword [rbp + 4], 0
jmp 0x140013dc5
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xc
jge 0x140013e43
mov dword [rbp + 0x24], 0
jmp 0x140013ddc
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x16
jge 0x140013e3e
cmp dword [rbp + 0x24], 0
je 0x140013dfa
cmp dword [rbp + 0x24], 0x15
je 0x140013dfa
cmp dword [rbp + 4], 0
je 0x140013dfa
cmp dword [rbp + 4], 0xb
jne 0x140013e1c
movsxd rax, dword [rbp + 4]
imul rax, rax, 0x58
lea rcx, [0x1400236c0]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0x24]
mov dword [rax + rcx*4], 2
jmp 0x140013e3c
movsxd rax, dword [rbp + 4]
imul rax, rax, 0x58
lea rcx, [0x1400236c0]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0x24]
mov dword [rax + rcx*4], 0
jmp 0x140013dd4
jmp 0x140013dbd
mov eax, dword [0x140023af0]
add eax, 0x3e8
mov dword [0x140023af0], eax
call fcn.140011262
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011258
Capabilities:
Terminate process

Disassembly:
jmp 0x140016cb0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112f8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017ff0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018010
xor al, al
jmp 0x140018091
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018023
xor al, al
jmp 0x140018091
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001804d
xor al, al
jmp 0x140018091
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018061
xor al, al
jmp 0x140018091
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018073
xor al, al
jmp 0x140018091
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001808f
xor al, al
jmp 0x140018091
mov al, 1
add rsp, 0x38
ret
Function at 0x140011442
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140012e30
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x148]
lea rcx, [0x14002a0a6]
call fcn.140011410
mov dword [rbp + 4], 0
jmp 0x140012e77
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 4
jge 0x140012f54
movsxd rax, dword [0x140023ae8]
imul rax, rax, 0x80
lea rcx, [section..data]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [0x140023aec]
imul rcx, rcx, 0x20
add rax, rcx
movsxd rcx, dword [rbp + 4]
mov eax, dword [rax + rcx*8]
add eax, dword [0x140023ae0]
lea eax, [rax + rax + 5]
mov word [rbp + 0x24], ax
movsxd rax, dword [0x140023ae8]
imul rax, rax, 0x80
lea rcx, [section..data]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [0x140023aec]
imul rcx, rcx, 0x20
add rax, rcx
movsxd rcx, dword [rbp + 4]
mov eax, dword [rax + rcx*8 + 4]
mov ecx, dword [0x140023ae4]
lea eax, [rax + rcx + 1]
mov word [rbp + 0x26], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rbp + 0x24]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
cmp dword [rbp + 0x120], 0
je 0x140012f2a
mov dword [rbp + 0xf4], 1
jmp 0x140012f34
mov dword [rbp + 0xf4], 0
movsxd rax, dword [rbp + 0xf4]
lea rcx, [0x140023380]
lea rax, [rcx + rax*4]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_puts]
jmp 0x140012e6f
mov ecx, dword [0x140023ae4]
call fcn.140011267
lea rcx, [rbp - 0x20]
lea rdx, [0x14001e1d0]
call fcn.14001139d
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400c4b9f
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1400de6d0
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x72
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402b5058]
xor rax, rbp
mov qword [rbp + 0x278], rax
lea rcx, [0x1402d20fe]
call fcn.1400c96f9
lea rcx, str.shutdown__a
call fcn.1400c682d
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x10]
mov rcx, qword [0x1402b7920]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x128]
call fcn.1400c6738
nop
lea r8, [rbp + 0x128]
lea rdx, str.shutdown__s__f___t
lea rcx, [rbp + 0x168]
call fcn.1400c4393
lea rcx, [rbp + 0x168]
call fcn.1400c4807
mov rcx, rax
call fcn.1400c682d
mov dword [rbp + 0x1a4], eax
lea rcx, [0x1402643dc]
call fcn.1400c682d
cmp dword [rbp + 0x1a4], 0
jne 0x1400de7a8
mov r9d, 0x40
lea r8, str.Erfolg
lea rdx, str.Fertig
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1400de7c4
mov r9d, 0x10
lea r8, str.Fehler
lea rdx, str.Error.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp + 0x168]
call fcn.1400c5013
nop
lea rcx, [rbp + 0x128]
call fcn.1400c5013
lea rcx, [rbp - 0x20]
lea rdx, [0x140261d30]
call fcn.1400c8790
mov rcx, qword [rbp + 0x278]
xor rcx, rbp
call fcn.1400c69ae
lea rsp, [rbp + 0x288]
pop rdi
pop rbp
ret

Function at 0x1400c4f23
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140117da0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140117dc8
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x30]
cmp qword [rsp], rax
jae 0x140117e12
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp + 0x20]
imul rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x140117dbd
mov rax, qword [rsp + 0x20]
add rsp, 0x18
ret
Function at 0x1400c5220
Capabilities:
Get graphical window text

Disassembly:
jmp 0x1400dde30
push rbp
push rdi
sub rsp, 0x3b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402b5058]
xor rax, rbp
mov qword [rbp + 0x388], rax
lea rcx, [0x1402d20fe]
call fcn.1400c96f9
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x10]
mov rcx, qword [0x1402b7910]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x128]
call fcn.1400c6738
nop
lea r8, [rbp + 0x128]
lea rdx, str.certutil__hashfile
lea rcx, [rbp + 0x348]
call fcn.1400c4393
mov qword [rbp + 0x378], rax
mov rax, qword [rbp + 0x378]
mov qword [rbp + 0x380], rax
lea r8, str._MD5
mov rdx, qword [rbp + 0x380]
lea rcx, [rbp + 0x168]
call fcn.1400c8f10
nop
lea rcx, [rbp + 0x348]
call fcn.1400c5013
lea rcx, [rbp + 0x168]
call fcn.1400c4807
mov rcx, rax
call fcn.1400c682d
mov dword [rbp + 0x1a4], eax
cmp dword [rbp + 0x1a4], 0
jne 0x1400ddf32
lea rdx, str.Hash_erfolgreich_generiert.
lea rcx, [0x1402b7c10]
call fcn.1400c4965
lea rdx, [0x1400c436b]
mov rcx, rax
call fcn.1400c6bfc
jmp 0x1400ddf55
lea rdx, str.Fehler_beim_Generieren_des_Hashes.
lea rcx, [0x1402b7d90]
call fcn.1400c4965
lea rdx, [0x1400c436b]
mov rcx, rax
call fcn.1400c6bfc
nop
lea rcx, [rbp + 0x168]
call fcn.1400c5013
nop
lea rcx, [rbp + 0x128]
call fcn.1400c5013
lea rcx, [rbp - 0x20]
lea rdx, [0x1402625d0]
call fcn.1400c8790
mov rcx, qword [rbp + 0x388]
xor rcx, rbp
call fcn.1400c69ae
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret
Function at 0x1400c6698
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1401ccd50
mov rax, rcx
neg rcx
test rax, 7
je 0x1401ccd6d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1401ccdc8
test al, 7
jne 0x1401ccd60
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1401ccd81
mov rdx, qword [rax - 8]
test dl, dl
je 0x1401ccdf2
test dh, dh
je 0x1401ccdec
shr rdx, 0x10
test dl, dl
je 0x1401ccde6
test dh, dh
je 0x1401ccde0
shr rdx, 0x10
test dl, dl
je 0x1401ccdda
test dh, dh
je 0x1401ccdd4
shr edx, 0x10
test dl, dl
je 0x1401ccdce
test dh, dh
jne 0x1401ccd81
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1400c66e3
Capabilities:
Query environment variable

Disassembly:
jmp 0x14022dea0
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14022da20
lea rcx, [rsp + 0x20]
call fcn.14022da70
movzx eax, al
test eax, eax
jne 0x14022dee5
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x20]
call fcn.14022da50
mov rax, qword [rsp + 0x40]
jmp 0x14022dfdf
lea rcx, [rsp + 0x20]
call fcn.14022db70
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
call fcn.14022db10
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r9d, 0x40
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, rax
call fcn.1400c6a8a
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400c6008
lea rcx, [rsp + 0x28]
call fcn.1400c6f76
movzx eax, al
test eax, eax
jne 0x14022df7f
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.1400c853d
lea rcx, [rsp + 0x20]
call fcn.14022da50
mov rax, qword [rsp + 0x50]
jmp 0x14022dfdf
lea rcx, [rsp + 0x20]
call fcn.14022db70
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call fcn.1400c95f0
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x38]
shl rax, 1
mov r8, rax
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.1400c69cc
lea rcx, [rsp + 0x28]
call fcn.1400ca01d
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x28]
call fcn.1400c853d
lea rcx, [rsp + 0x20]
call fcn.14022da50
mov rax, qword [rsp + 0x68]
add rsp, 0x78
ret
Function at 0x1400c6c33
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401728e0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140172260
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14017291f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1402d3020]
jmp 0x140172929
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x1400c6e9f
Capabilities:
Query environment variable

Disassembly:
jmp 0x14022dbf0
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14022da20
lea rcx, [rsp + 0x40]
call fcn.14022dba0
movzx eax, al
test eax, eax
jne 0x14022dc38
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.14022da50
mov rax, qword [rsp + 0x70]
jmp 0x14022de09
lea rcx, [rsp + 0x40]
call fcn.14022db70
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14022db10
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.14022db70
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1400c8141
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14022dcde
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.14022da50
mov rax, qword [rsp + 0x80]
jmp 0x14022de09
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1400c6a8a
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c685f
lea rcx, [rsp + 0x48]
call fcn.1400c6251
movzx eax, al
test eax, eax
jne 0x14022dd45
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1400c4d89
lea rcx, [rsp + 0x40]
call fcn.14022da50
mov rax, qword [rsp + 0x88]
jmp 0x14022de09
lea rcx, [rsp + 0x48]
call fcn.1400c73bd
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.14022db70
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1400c8141
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x14022dddb
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1400c4d89
lea rcx, [rsp + 0x40]
call fcn.14022da50
mov rax, qword [rsp + 0xa0]
jmp 0x14022de09
lea rcx, [rsp + 0x48]
call fcn.1400c6814
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1400c4d89
lea rcx, [rsp + 0x40]
call fcn.14022da50
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret