joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004a1d0
Capabilities:
Create http request
Get http content length
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov dword [rsp + 0x60], 8
mov r14, rdx
mov dword [rsp + 0x50], ebx
xor edx, edx
mov dword [rsp + 0x68], ebx
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, str.HTTPREAD
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x28], rbx
lea rdx, str.http:__ossweb_img.qq.com_images_lol_img_item_2056.png
mov rcx, rax
mov dword [rsp + 0x20], 0x80000002
xor r9d, r9d
xor r8d, r8d
mov rsi, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rsp + 0x50]
mov edx, 0x20000005
mov rdi, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x18004a293
mov ecx, eax
mov qword [r14], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x68]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x18004a2a9
xor r8d, r8d
lea rdx, str.http:__ossweb_img.qq.com_images_lol_img_item_2056.png
lea rcx, str._Error_Http:_s__ReadFileLen:_d_n
call fcn.18001cf40
test rdi, rdi
je 0x18004a2b7
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test rsi, rsi
je 0x18004a2c5
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x18004f210
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x148]
mov rsi, rcx
mov edi, r8d
mov rbx, rdx
movabs rcx, 0x100000001b3
movabs r10, 0xcbf29ce484222325
mov r11, qword [rax + 0x28]
nop word [rax + rax]
movsx r9, byte [r11]
lea r11, [r11 + 1]
xor r10, r9
imul r10, rcx
test r9b, r9b
jne 0x18004f250
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], r10
lea rcx, [0x18006cc60]
call fcn.1800163e0
mov rdx, qword [rax + 8]
cmp qword [rax], rdx
je 0x18004f470
lea rdx, [rsp + 0x30]
lea rcx, [0x18006cc60]
call fcn.1800163e0
movsxd rcx, dword [rsi + 0x28]
mov rax, qword [rax]
movss xmm2, dword [rax + rcx*4 - 4]
lea eax, [rdi - 4]
xor ecx, ecx
cmp eax, 1
jbe 0x18004f37b
movss xmm0, dword [rbx + 0x15b8]
lea rdx, [rbx + 0x4e18]
cmp edi, 3
jne 0x18004f340
mov r8d, ecx
mov r9, rdx
mov rax, qword [r9]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f2ed
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0xc2e
je 0x18004f2fc
inc r8
add r9, 8
cmp r8, 6
jl 0x18004f2d1
jmp 0x18004f304
addss xmm0, dword [0x18006290c]
mov rax, qword [rdx]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f320
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0xc01
je 0x18004f332
inc rcx
add rdx, 8
cmp rcx, 6
jl 0x18004f304
jmp 0x18004f43e
addss xmm0, dword [0x180062918]
jmp 0x18004f43e
mov rax, qword [rdx]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f35c
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0xc59
je 0x18004f36e
inc rcx
add rdx, 8
cmp rcx, 6
jl 0x18004f340
jmp 0x18004f43e
addss xmm0, dword [0x1800628fc]
jmp 0x18004f43e
mov rdx, rcx
lea rax, [rbx + 0x5134]
cmp dword [rax], 0x209b
je 0x18004f3a2
inc rdx
add rax, 4
cmp rdx, 6
jl 0x18004f385
movss xmm0, dword [rsp + 0x30]
jmp 0x18004f3b0
movss xmm0, dword [rsp + 0x30]
addss xmm0, dword [0x180062904]
lea rdx, [rbx + 0x4e18]
mov r8, rcx
mov r9, rdx
nop dword [rax]
mov rax, qword [r9]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f3dc
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0xc56
je 0x18004f3eb
inc r8
add r9, 8
cmp r8, 6
jl 0x18004f3c0
jmp 0x18004f3f3
addss xmm0, dword [0x1800628f4]
mov rax, qword [rdx]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18004f40f
mov rax, qword [rax + 0x30]
cmp dword [rax + 0x9c], 0x19dd
je 0x18004f41e
inc rcx
add rdx, 8
cmp rcx, 6
jl 0x18004f3f3
jmp 0x18004f426
addss xmm0, dword [0x180062904]
movabs rax, qword [0x1419926e0]
cmp dword [rax + 8], 0xc
jne 0x18004f43e
addss xmm0, dword [0x180062938]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18004f45d
movaps xmm1, xmm0
addss xmm1, dword [0x180062948]
divss xmm0, xmm1
mulss xmm0, xmm2
subss xmm2, xmm0
movaps xmm0, xmm2
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xorps xmm0, xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18004f490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rcx + 0x148]
mov rbx, rcx
movabs rcx, 0x100000001b3
movabs r10, 0xcbf29ce484222325
mov r11, qword [rax + 0x28]
nop dword [rax + rax]
movsx r9, byte [r11]
lea r11, [r11 + 1]
xor r10, r9
imul r10, rcx
test r9b, r9b
jne 0x18004f4c0
mov rax, qword [0x18006cc48]
mov rcx, qword [0x18006cc50]
movaps xmmword [rsp + 0x20], xmm7
cmp rax, rcx
je 0x18004f504
nop dword [rax]
cmp qword [rax + 8], rdx
jne 0x18004f4fb
cmp qword [rax], r10
je 0x18004f512
add rax, 0x18
cmp rax, rcx
jne 0x18004f4f0
xorps xmm0, xmm0
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret
movss xmm7, dword [rax + 0x10]
ucomiss xmm7, dword [0x1800629a8]
jp 0x18004f522
je 0x18004f504
movabs rax, 0x14199f6d8
movaps xmmword [rsp + 0x30], xmm6
mov rcx, rbx
movss xmm6, dword [rax]
call fcn.18004f210
addss xmm0, xmm7
xorps xmm1, xmm1
movaps xmm7, xmmword [rsp + 0x20]
subss xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
maxss xmm0, xmm1
add rsp, 0x40
pop rbx
ret

Function at 0x180054340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x90
lea r10, [rcx + 0x4138]
mov dword [r10 + 0x38], r8d
mov r11, qword [r10 + 0x18]
movabs rbx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
nop dword [rax]
movsx rcx, byte [r11]
lea r11, [r11 + 1]
xor r9, rcx
imul r9, rbx
test cl, cl
jne 0x180054370
movabs rax, 0x2374c594f5e76f06
cmp r9, rax
jne 0x1800543ab
lea eax, [r8 - 0x1d]
cmp eax, 7
ja 0x180054422
mov byte [r10 + 0x9c], cl
jmp 0x180054457
movabs rax, 0xf9bdf861cccd5fd1
cmp r9, rax
jne 0x1800543d0
lea eax, [r8 - 0x1a]
cmp eax, 6
ja 0x180054422
mov byte [r10 + 0x9c], 0
jmp 0x180054457
movabs rax, 0xb4d052affec8dc8e
cmp r9, rax
jne 0x1800543e5
cmp r8d, 0x10
jmp 0x1800543f8
movabs rax, 0x311a797a90e58f21
cmp r9, rax
jne 0x180054404
cmp r8d, 6
jne 0x180054422
mov byte [r10 + 0x9c], 0
jmp 0x180054457
movabs rcx, 0x2f2959b508f215d2
movabs rax, 0xecc3c7c77aebb7ea
cmp r9, rcx
je 0x180054445
cmp r9, rax
je 0x180054445
cmp byte [r10 + 0x9c], 0xff
je 0x180054457
movabs rax, 0xeb5bc0df5355fba6
cmp r9, rax
je 0x180054457
mov byte [r10 + 0x9c], 0xff
jmp 0x180054457
cmp r8d, 7
jne 0x180054472
cmp r9, rcx
je 0x18005447d
mov rax, qword [r10]
mov qword [r10 + 8], rax
mov dl, 1
mov rcx, r10
movabs rax, 0x1401a75a0
call rax
nop
add rsp, 0x90
pop rbx
ret
cmp r8d, 6
jne 0x180054450
cmp r9, rax
jne 0x180054450
mov rax, qword [r10]
mov qword [r10 + 8], rax
mov dword [rsp + 0x80], 1
mov byte [rsp + 0x78], 0
xor eax, eax
mov dword [rsp + 0x70], eax
lea rcx, [0x1800623f8]
mov qword [rsp + 0x68], rcx
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x50], 0xff
mov byte [rsp + 0x48], al
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x38], al
mov byte [rsp + 0x30], al
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], al
xor r9d, r9d
mov rcx, r10
movabs rax, 0x1401bd980
call rax
nop
add rsp, 0x90
pop rbx
ret
Function at 0x180054570
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 8
movzx eax, byte [rcx + 0x2b]
mov rdx, rcx
xor r10d, r10d
mov dword [r11 + 8], r10d
mov rax, qword [rcx + rax*8 + 8]
movabs rcx, 0x1415636b0
mov qword [r11 + 0x10], rax
movdqu xmm3, xmmword [rcx]
movzx ecx, byte [rdx + 0x29]
test cl, cl
je 0x1800546bf
lea r8, [r11 + 0x10]
lea r9, [r11 + 8]
sub r8, rdx
sub r9, rdx
test cl, 0xf8
jbe 0x18005467d
lea rax, [r11 + 0x10]
mov qword [r11 + 0x18], rbx
sub r8, rax
mov qword [rsp], rdi
lea rax, [r11 + 0x10]
sub r9, rax
lea rcx, [r11 + 0x10]
sub rcx, 0x20
lea rax, [rsp + 0x18]
lea rbx, [r8 + rdx]
lea rdi, [r8 + rdx]
mov r8, rdx
lea r11, [r9 + rdx]
sub r8, rax
movdqu xmm0, xmmword [rbx + rcx + 0x20]
add r10, 8
movdqu xmm1, xmmword [r8 + rcx + 0x20]
lea rcx, [rcx + 0x40]
andnps xmm1, xmm3
xorps xmm1, xmm0
movups xmmword [rdi + rcx - 0x20], xmm1
movdqu xmm0, xmmword [r11 + rcx - 0x20]
movdqu xmm1, xmmword [r8 + rcx - 0x10]
andnps xmm1, xmm3
xorps xmm1, xmm0
movups xmmword [r11 + rcx - 0x20], xmm1
movdqu xmm0, xmmword [rcx]
movdqu xmm2, xmmword [r8 + rcx]
andnps xmm2, xmm3
xorps xmm2, xmm0
movups xmmword [rcx], xmm2
movdqu xmm1, xmmword [r8 + rcx + 0x10]
movdqu xmm0, xmmword [r11 + rcx]
andnps xmm1, xmm3
xorps xmm1, xmm0
movups xmmword [r11 + rcx], xmm1
movzx r9d, byte [rdx + 0x29]
mov eax, r9d
and eax, 0xf8
cmp r10, rax
jb 0x1800545f4
mov rax, qword [rsp + 0x18]
movzx ecx, r9b
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x20]
movzx r8d, cl
cmp r10, r8
jae 0x180054708
test cl, cl
je 0x180054708
lea rcx, [rsp + 0x18]
sub rdx, rcx
lea rax, [rsp + 0x18]
nop
mov rcx, qword [rdx + rax]
lea rax, [rax + 8]
not rcx
xor qword [rax - 8], rcx
sub r8, 1
jne 0x1800546a0
mov rax, qword [rsp + 0x18]
add rsp, 8
ret
movzx r8d, byte [rdx + 0x2a]
test r8b, r8b
je 0x180054708
mov ecx, 8
sub cl, r8b
cmp cl, 8
jae 0x180054708
movzx eax, cl
lea rcx, [rsp + 0x18]
add rcx, rax
lea rax, [rsp + 0x18]
sub rdx, rax
nop dword [rax]
movzx eax, byte [rdx + rcx]
lea rcx, [rcx + 1]
not al
xor byte [rcx - 1], al
sub r8, 1
jne 0x1800546f0
mov rax, qword [rsp + 0x18]
add rsp, 8
ret
Function at 0x14000daa4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x14000daf7
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14000dabc
jmp 0x14000db04
cmp dword [rcx], 0x4e0
jb 0x14000db04
call fcn.140010dc8
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1400101b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13d8
call fcn.14009b3a0
sub rsp, rax
mov rax, qword [0x14012a980]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
or dword [rsp + 0x13b4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x34], eax
mov r8d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [rsp + rdx*4 + 0x34], ecx
mov eax, ecx
inc rdx
cmp rdx, r8
jb 0x1400101ee
mov r9d, 0x63
mov dword [rsp + 0x30], r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
lea r8d, [r9 - 0x40]
call fcn.140002044
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.14009b400
add rsp, 0x13d8
ret

Function at 0x140010dc8
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140010ddf
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140010e2c
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x140030d9c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14012a980]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.14001aa50
mov rcx, qword [0x14012d8d8]
lea rdx, [rbp - 0x18]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rbp - 0x10]
sub ecx, dword [rbp - 0x18]
movd xmm1, ecx
mov ecx, dword [rbp - 0xc]
sub ecx, dword [rbp - 0x14]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rbp - 0x20]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 0x20]
xorps xmm1, xmm1
sub rax, qword [0x14012d8e0]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14012d8e8]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rbp - 0x20]
mov qword [0x14012d8e0], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x128], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x129], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x12b], 0
mov byte [rdi + 0x12a], al
call fcn.14001aa50
cmp byte [rax + 0x3a7], 0
lea rbx, [rax + 0x110]
je 0x140030ec5
cvttss2si ecx, dword [rbx]
lea rdx, [rbp - 0x30]
cvttss2si eax, dword [rax + 0x114]
mov dword [rbp - 0x30], ecx
mov rcx, qword [0x14012d8d8]
mov dword [rbp - 0x2c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x2c]
mov ecx, dword [rbp - 0x30]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx], eax
mov dword [rbx + 4], eax
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x14012d8d8]
jne 0x140030f1a
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140030f1a
mov rcx, qword [0x14012d8d8]
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140030f1a
movd xmm0, dword [rbp - 0x28]
movd xmm1, dword [rbp - 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140030f28
or eax, 0xffffffff
jmp 0x140030f2d
call fcn.14001aa8c
cmp dword [0x140103178], eax
je 0x140030f40
mov dword [0x140103178], eax
call fcn.140030f68
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14009b400
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1400627e8
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x88
mov rax, qword [0x14012a980]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
cmp dword [rsp + 0x90], 0
jl 0x140062842
cmp dword [rsp + 0x90], 0x7e
jge 0x140062842
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x90]
lea rcx, [0x140128ff0]
call fcn.140062f5c
nop
lea rcx, [rsp + 0x50]
call fcn.140052da8
nop
cmp qword [rsp + 0x30], 0
jne 0x140062869
lea rdx, [0x1400ac7b8]
lea rcx, [rsp + 0x50]
call fcn.140055b84
nop
jmp 0x140062879
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140055b84
nop
cmp dword [rsp + 0xa0], 1
jne 0x140062895
lea rdx, [0x1400ac7c8]
lea rcx, [rsp + 0x50]
call fcn.140055b84
nop
movss xmm2, dword [0x1400a726c]
movss xmm1, dword [0x1400cf8a4]
lea rcx, [rsp + 0x48]
call fcn.140053c54
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call fcn.1400697c0
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140034e00
movzx eax, al
test eax, eax
je 0x14006290a
cmp dword [rsp + 0xa0], 0
jne 0x14006290a
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x50]
call fcn.14000c894
nop
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14009b400
add rsp, 0x88
ret
Function at 0x140062cb0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x1400aca58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400aca48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140062d39
lea rcx, [0x1400aca70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140062d39
lea rcx, [0x1400aca84]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140062d39
xor al, al
jmp 0x140062deb
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400aca90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140062dbb
lea rcx, [0x1400acac8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140062dbb
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x1400acad0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140062dbb
xor al, al
jmp 0x140062deb
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x14012dfb8]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x14012dfd8]
call sub.VCRUNTIME140.dll_memcpy
mov al, 1
add rsp, 0x38
ret

Function at 0x140062e1c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x14012a980]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x30], 0x130
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x140062e5f
xor al, al
jmp 0x140062ec7
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x140062e81
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140062ec7
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140062ea7
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140062ec7
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140062e81
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14009b400
add rsp, 0x178
ret
Function at 0x1400642f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140064322
xor eax, eax
jmp 0x140064378
mov r8d, 0x1e
lea rdx, [0x14012dfd8]
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x140064d3c
Capabilities:
Execute command

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14012a980]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.140057b30
mov rcx, rax
call fcn.14005632c
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009b400
add rsp, 0x58
ret
Function at 0x1400652ac
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x4b8
mov rax, qword [0x14012a980]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
xor r8d, r8d
lea rdx, str.C:HMProtection
lea rcx, [rsp + 0x3a0]
call fcn.14003c040
nop
xor r8d, r8d
lea rdx, str.C:Windows_System32_4082
lea rcx, [rsp + 0x3e0]
call fcn.14003c040
nop
xor r8d, r8d
lea rdx, str.HMProtection.vznsoftware
lea rcx, [rsp + 0x400]
call fcn.14003c040
nop
lea r8, [rsp + 0x400]
lea rdx, [rsp + 0x3a0]
lea rcx, [rsp + 0x380]
call fcn.140057170
nop
lea rcx, [rsp + 0x400]
call fcn.140055914
nop
lea rcx, [rsp + 0x3a0]
call fcn.14006fd3c
movzx eax, al
test eax, eax
jne 0x14006535b
lea rcx, [rsp + 0x3a0]
call fcn.14006b934
nop
lea rcx, [rsp + 0x3e0]
call fcn.14006fd3c
movzx eax, al
test eax, eax
jne 0x14006537d
lea rcx, [rsp + 0x3e0]
call fcn.14006b934
nop
lea rcx, [rsp + 0x380]
call fcn.14006fd3c
movzx eax, al
test eax, eax
jne 0x1400653eb
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x160]
call fcn.14003cc2c
nop
lea rdx, str.HMProtectionLoggedfalse
lea rcx, [rsp + 0x160]
call fcn.1400015e0
lea rcx, [rsp + 0x160]
call fcn.14006b5b4
nop
lea rcx, [rsp + 0x160]
call fcn.14005af94
nop
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x50]
call fcn.14003cb9c
nop
lea rcx, [rsp + 0x3c0]
call fcn.140052da8
nop
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x50]
call fcn.140072588
movzx eax, al
test eax, eax
je 0x140065473
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x50]
call fcn.14004a618
lea rcx, [rsp + 0x50]
call fcn.14006b560
nop
lea rdx, [0x1400ab518]
lea rcx, [rsp + 0x3c0]
call fcn.14003d70c
movzx eax, al
test eax, eax
je 0x140065473
mov byte [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x140065547
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x270]
call fcn.14003cc2c
nop
lea rdx, str.HMProtectionLoggedtrue
lea rcx, [rsp + 0x270]
call fcn.1400015e0
lea rcx, [rsp + 0x270]
call fcn.14006b5b4
call fcn.14006ed9c
nop
lea rdx, [rsp + 0x420]
lea rcx, [rsp + 0x31]
call fcn.1400592a0
mov rcx, rax
call fcn.140056a6c
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x32]
call fcn.140058c2c
mov rcx, rax
call fcn.14005692c
mov qword [rsp + 0x40], rax
mov r9d, 0x40
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
call fcn.140064d3c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rsp + 0x270]
call fcn.14005af94
nop
lea rcx, [rsp + 0x3c0]
call fcn.14000c894
nop
lea rcx, [rsp + 0x50]
call fcn.14005af5c
nop
lea rcx, [rsp + 0x380]
call fcn.140055914
nop
lea rcx, [rsp + 0x3e0]
call fcn.140055914
nop
lea rcx, [rsp + 0x3a0]
call fcn.140055914
nop
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.14009b400
add rsp, 0x4b8
ret