joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp 0x140041c24
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rdx
mov r12, rcx
call fcn.14002a1d8
mov rbx, qword [rax + 0x18]
mov r8d, 0xf1
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r14d, r14d
cmp rax, r14
jne 0x140041c6a
xor eax, eax
jmp 0x140041d43
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
cmp rax, r14
je 0x140041c63
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
cmp rax, r14
je 0x140041c63
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14001c66c
mov r9d, r14d
mov rbp, rax
cmp r14w, word [rbx + 6]
jae 0x140041cdc
mov rdx, rax
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc r9d
add r8, 2
mov dword [rdx], ecx
movzx eax, word [rbx + 6]
add rdx, 4
cmp r9d, eax
jl 0x140041cc2
movzx r8d, word [rbx + 6]
mov rdx, rbp
mov rcx, r12
call fcn.140040438
mov rcx, rbp
mov esi, eax
call fcn.14001c6b8
cmp esi, r14d
je 0x140041d38
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140040c68
mov rdx, r13
mov rcx, r12
call fcn.140040d3c
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140016360
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1410e3100]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r10, r8
mov rax, rdx
lea rcx, [rsp + 0x38]
mov rdi, r9
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov r9d, 1
mov rdx, r10
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x1400163e6
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140062190
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400620c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret

Function at 0x140016ce0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rcx, rdx
mov rsi, rdx
call fcn.1400010e0
mov rcx, rbx
mov rdi, rax
call fcn.140016490
lea rdx, str.open
xor r9d, r9d
mov r8, rdi
mov rcx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov rcx, rsi
jg 0x140016d4e
call fcn.140001640
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.140001640
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14001d458
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r12, r8
mov rbx, rdx
mov r13, rcx
xor edi, edi
call fcn.14002a1d8
lea r8d, [rdi + 5]
mov rbp, qword [rax + 0x18]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbp
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
cmp rax, rdi
je 0x14001d4b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r12
mov rdx, rdi
mov rcx, r13
call fcn.14001ceec
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14001d548
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
test rdx, 0xffffffffffff0000
jne 0x14001d587
cmp dword [rcx + 0xa8], 0
jne 0x14001d587
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.14002a1d8
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.14001d4ec
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14001fb20
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.14004d04c
mov rsi, rax
test rax, rax
je 0x14001fb9c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14001fb97
cmp dword [rbx], 0x40
jb 0x14001fb97
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x14001fb97
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14001fba0
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140026ff0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x140027058
call fcn.14002a1d8
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x140027058
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
je 0x14002707a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.140026a08
mov esi, eax
test rdi, rdi
je 0x140027078
test rbx, rbx
je 0x140027078
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x140027528
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x140027566
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x14002761a
call fcn.14001e93c
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140027585
mov ecx, 0x80004005
call fcn.140001020
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1400674c8
test eax, eax
je 0x1400275ed
cmp eax, 0xc
je 0x1400275e7
cmp eax, 0x16
je 0x1400275e1
cmp eax, 0x22
je 0x1400275e1
cmp eax, 0x50
je 0x1400275ed
call fcn.14001e814
int3
call fcn.14001e814
int3
call fcn.14001e7cc
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x140027618
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14002a668
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0xa8], 0
mov edi, r9d
mov rbx, r8
mov rax, rdx
je 0x14002a6df
call fcn.14002a5f4
mov rsi, rax
test rax, rax
jne 0x14002a69b
mov eax, edi
jmp 0x14002a6f5
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
cmove edi, dword [rsp + 0x30]
jmp 0x14002a697
mov r9, qword [rcx + 0xd0]
mov r8d, edi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140041c24
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp 0x140041c24
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rdx
mov r12, rcx
call fcn.14002a1d8
mov rbx, qword [rax + 0x18]
mov r8d, 0xf1
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor r14d, r14d
cmp rax, r14
jne 0x140041c6a
xor eax, eax
jmp 0x140041d43
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
cmp rax, r14
je 0x140041c63
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
cmp rax, r14
je 0x140041c63
movzx ecx, word [rax + 6]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14001c66c
mov r9d, r14d
mov rbp, rax
cmp r14w, word [rbx + 6]
jae 0x140041cdc
mov rdx, rax
lea r8, [rbx + 8]
movzx ecx, word [r8]
inc r9d
add r8, 2
mov dword [rdx], ecx
movzx eax, word [rbx + 6]
add rdx, 4
cmp r9d, eax
jl 0x140041cc2
movzx r8d, word [rbx + 6]
mov rdx, rbp
mov rcx, r12
call fcn.140040438
mov rcx, rbp
mov esi, eax
call fcn.14001c6b8
cmp esi, r14d
je 0x140041d38
movzx ecx, word [rbx + 4]
movzx eax, word [rbx + 2]
mov dword [rsp + 0x60], eax
add eax, 7
mov dword [rsp + 0x64], ecx
mov r8, qword [rsp + 0x60]
mov dword [rsp + 0x68], eax
lea eax, [rcx + 7]
mov dword [rsp + 0x6c], eax
mov rdx, qword [rsp + 0x68]
mov rcx, r12
call fcn.140040c68
mov rdx, r13
mov rcx, r12
call fcn.140040d3c
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret

Function at 0x1400494a8
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x1400494cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.14005f5a4
add rsp, 0x20
pop rbx
ret

Function at 0x1400494d4
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x1400494f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rbx
mov ecx, eax
call fcn.14005f5a4
add rsp, 0x20
pop rbx
ret
Function at 0x14004d8e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, r8
mov rbx, rcx
lea rcx, [rsp + 0x40]
call fcn.140002520
nop
cmp rbx, 0xffffffff80000000
jne 0x14004d96c
call fcn.140029774
cmp eax, 1
jne 0x14004d96c
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x20]
call fcn.1400176f0
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400022f0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004d965
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov rbx, 0xffffffff80000001
mov r9, rdi
mov r8, rsi
mov rdx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14004d9a3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14004d9b8
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rdi, r9
mov esi, r8d
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.140002520
nop
cmp rbx, 0xffffffff80000000
jne 0x14004da44
call fcn.140029774
cmp eax, 1
jne 0x14004da44
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareClasses_
lea rcx, [rsp + 0x30]
call fcn.1400176f0
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400022f0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004da3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
mov rbx, 0xffffffff80000001
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
mov r9, rdi
mov r8d, esi
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14004da83
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140067df4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140073360
nop
cmp dword [0x1410e9510], 1
je 0x140067da0
mov dword [0x1410e950c], 1
mov byte [0x1410e9508], r12b
test ebx, ebx
jne 0x140067d8c
mov rcx, qword [0x1410eb5f0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140067d79
mov rcx, qword [0x1410eb5e8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140067d18
call fcn.140068ccc
cmp qword [rdi], rax
jne 0x140067d18
jmp 0x140067cfe
cmp rdi, rsi
jb 0x140067d79
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140068ccc
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1410eb5f0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1410eb5e8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140067d57
cmp r13, rax
je 0x140067d77
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140067cfe
lea rdx, [0x140082110]
lea rcx, [0x1400820f8]
call fcn.140067b48
lea rdx, [0x140082120]
lea rcx, [0x140082118]
call fcn.140067b48
nop
test r12d, r12d
je 0x140067daf
mov ecx, 8
call fcn.140073260
test r12d, r12d
jne 0x140067dda
mov dword [0x1410e9510], 1
lea ecx, [r12 + 8]
call fcn.140073260
mov ecx, r15d
call fcn.140067adc
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140067c68

Function at 0x140067e00
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140067c68
Function at 0x14006db03
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1410e3100]
jne 0x1400620da
rol rcx, 0x10
test cx, 0xffff
jne 0x1400620d6
repz ret
ror rcx, 0x10
jmp 0x14006da5c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1410e9620]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1410e9718]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14006dae1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1410e9620]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14006db03
mov rax, qword [rsp + 0x88]
mov qword [0x1410e9718], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1410e96b8], rax
mov rax, qword [0x1410e9718]
mov qword [0x1410e9590], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1410e96a0], rax
mov dword [0x1410e9580], 0xc0000409
mov dword [0x1410e9584], 1
mov rax, qword [0x1410e3100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1410e3108]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1410e9618], eax
mov ecx, 1
call fcn.1400746b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14009a320]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1410e9618], 0
jne 0x14006db8a
mov ecx, 1
call fcn.1400746b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140076118
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140068ccc
xor ebx, ebx
mov rdi, rax
cmp qword [0x1410ea300], rbx
jne 0x14007621e
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1400762f3
lea rdx, [0x14009bda8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400762f3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14009bd98]
mov rcx, rsi
mov qword [0x1410ea300], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x14009bd80]
mov rcx, rsi
mov qword [0x1410ea308], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x1410ea310], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1410ea320], rax
test rax, rax
je 0x140076215
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1410ea318], rax
jmp 0x140076225
mov rax, qword [0x1410ea318]
jmp 0x14007622c
mov rax, qword [0x1410ea318]
mov r11, qword [0x1410ea320]
cmp rax, rdi
je 0x140076294
cmp r11, rdi
je 0x140076294
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1410ea320]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140076294
test rax, rax
je 0x140076294
call rsi
test rax, rax
je 0x14007628e
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14007628e
test byte [rsp + 0x38], 1
jne 0x140076294
bts ebp, 0x15
jmp 0x1400762d2
mov rcx, qword [0x1410ea308]
cmp rcx, rdi
je 0x1400762d2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400762d2
call rax
mov rbx, rax
test rax, rax
je 0x1400762d2
mov rcx, qword [0x1410ea310]
cmp rcx, rdi
je 0x1400762d2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400762d2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1410ea300]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1400762f3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1400762f5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140009ab0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x140a1e1f8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1402824f0
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x140a1e1f8]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x140009c40
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x140009c5c
cmp rcx, r8
jl 0x140009c4f
mov qword [rdx + 0x80], rcx
test dword [0x140a15970], 1
je 0x140009c8b
cmp byte [rsp + 0xd0], 0
je 0x140009c8b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x1400097b0
mov rsp, r8
jmp rax