joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140053094
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14005316c
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x14005316c
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14005316c
test rsi, rsi
je 0x14005316c
xor r15d, r15d
xor ebp, ebp
xor edi, edi
call fcn.140060688
lea r8, str.AFX_DIALOG_LAYOUT
mov rdx, rsi
mov r14, qword [rax + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rsi, rax
test rax, rax
je 0x140053139
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rsi
mov rcx, r14
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14005316c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbp, rax
mov r8d, r15d
mov rdx, rbp
mov rcx, rbx
call fcn.14006836c
mov esi, eax
test rbp, rbp
je 0x14005315c
test rdi, rdi
je 0x14005315c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
test esi, esi
je 0x140053168
mov rcx, rbx
call fcn.140052d48
mov eax, esi
jmp 0x14005316e
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400540f4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rbx, r8
mov rcx, qword [rcx + 0x40]
call fcn.14006357c
mov rdi, rax
test rax, rax
je 0x140054170
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov esi, eax
test rbx, rbx
je 0x14005416b
cmp dword [rbx], 0x40
jb 0x14005416b
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
or dword [rbx + 4], 1
xor r8d, r8d
or qword [rbx + 0x30], 0xffffffffffffffff
mov edx, 0x87
mov qword [rbx + 8], rcx
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x14005416b
or dword [rbx + 4], 0x80000002
mov rax, rsi
jmp 0x140054174
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140058bdc
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rbx, rdx
mov rdi, rcx
cmp qword [rcx + 0xd0], 0
jne 0x140058c1a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x140058cc4
call fcn.14004ece8
mov rcx, rax
test rax, rax
je 0x140058cda
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14007e662.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi + 0xd0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov rax, qword [rax + 0x118]
call qword [case.0x14007e662.0]
mov rdx, rsi
or rdi, 0xffffffffffffffff
mov r9, rdi
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.1401e4e00
test eax, eax
je 0x140058c8c
cmp eax, 0xc
je 0x140058cd4
cmp eax, 0x16
je 0x140058ceb
cmp eax, 0x22
je 0x140058ceb
cmp eax, 0x50
jne 0x140058ce5
test rbx, rbx
je 0x140058c9c
mov rcx, rbx
call fcn.1401e5030
mov rbx, rax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x140058cc2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14007e662.0]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call fcn.14004d5f4
nop
mov ecx, 0x80004005
call fcn.140014fb4
nop
call fcn.14004d5d0
int3
call fcn.14004d5d0
int3

Function at 0x140060f44
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x140060fab
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140060fbf
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140060fbf
mov rcx, qword [rbx]
xor r9d, r9d
and qword [rsp + 0x28], 0
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rdx, rdi
mov rcx, rsi
call qword [case.0x14007e662.0]
jmp 0x140060fc4
cmp dword [rcx + 8], 0
je 0x140060fbf
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x140060fc4
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14006981c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x140069863
cmp dword [rcx + 0xe8], 0
jne 0x140069863
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140060688
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140069be4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140069824
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp method.CDialog.virtual_720
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov qword [rcx + 0xf0], rdx
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x10000
jae 0x140069863
cmp dword [rcx + 0xe8], 0
jne 0x140069863
movzx eax, di
mov dword [rcx + 0xe8], eax
call fcn.140060688
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.140069be4
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400698c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rbx, rdx
mov r15, rcx
xor edi, edi
call fcn.140060688
lea r8d, [rdi + 5]
mov rdx, rbx
mov rbp, qword [rax + 0x18]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x14006991c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9, rbp
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.140069954
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14006c5f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, qword [rdx + 0x10]
mov rdi, rdx
mov rbp, rcx
jne 0x14006c66b
mov rcx, qword [rdi + 8]
mov r8d, 5
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
test rax, rax
jne 0x14006c63b
call fcn.14006498c
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
test rax, rax
jne 0x14006c655
call fcn.14006498c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
jne 0x14006c66b
call fcn.14006498c
call fcn.140060688
cmp qword [rax + 0x68], 0
je 0x14006c685
mov rdx, rbx
mov rcx, rbp
call fcn.14006b9bc
mov rbx, rax
mov edx, esi
mov rcx, rbx
call fcn.14006c8e0
mov rcx, qword [rbp + 0xf8]
mov rsi, rax
test rcx, rcx
je 0x14006c6ac
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xf8], 0
test rsi, rsi
je 0x14006c6bb
mov rbx, rsi
mov qword [rbp + 0xf8], rsi
or dword [rdi + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006ef90
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax - 0x18], 0
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.1401e5c84
test eax, eax
jne 0x14006eff4
mov eax, dword [rsp + 0x30]
lea r8, str._s_s_X.tmp
mov dword [rsp + 0x28], eax
mov r9, rsi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call fcn.14001e454
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14006f006
jmp 0x14006efb4
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14006f8f8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14006f91e
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140060f44
jmp 0x14006f989
cmp byte [0x140301eb0], 0
jne 0x14006f962
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14006f952
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140301ea8], rax
jmp 0x14006f959
mov rax, qword [0x140301ea8]
mov byte [0x140301eb0], 1
jmp 0x14006f969
mov rax, qword [0x140301ea8]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x14006f983
mov r8d, dword [rbx + 8]
xor r9d, r9d
call qword [case.0x14007e662.0]
jmp 0x14006f989
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a0068
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r15, rcx
test r8, r8
jne 0x1400a0099
call fcn.140060688
mov rdi, qword [rax + 0x18]
lea r8, [0x140226f78]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
test rax, rax
je 0x1400a0102
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400a0102
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x1400a00f5
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r14
mov rcx, r15
mov r8d, eax
call fcn.1400a0120
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
jmp 0x1400a0104
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x14012a554
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x14012a6a4
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
mov qword [r11 - 0x10], rax
lea r9, [r11 + 0x20]
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edx, edx
test eax, eax
jne 0x14012a6e6
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x14012ab00
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x14012abd2
test rbx, rbx
je 0x14012abd2
test r9, r9
je 0x14012abd2
and qword [r8], 0
xor r8d, r8d
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
lea r9, [rax + 0x10]
and qword [rax - 0x18], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14012abce
cmp dword [rsp + 0x48], 3
jne 0x14012abce
test eax, eax
jne 0x14012abce
cmp dword [rdi], eax
je 0x14012abce
mov ecx, dword [rdi]
call fcn.14004d4f4
mov qword [rbx], rax
lea r9, [rsp + 0x48]
mov rcx, qword [rbp + 8]
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14012abc2
cmp dword [rsp + 0x48], 3
jne 0x14012abc2
test eax, eax
jne 0x14012abc2
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
call fcn.14004d4fc
and qword [rbx], 0
xor eax, eax
jmp 0x14012abad
call fcn.14004d5d0
int3
Function at 0x14012aea4
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14012aeb5
xor eax, eax
jmp 0x14012aee3
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14012aeec
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x14012aefd
xor eax, eax
jmp 0x14012af21
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov r9d, 3
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1401ef0b4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401eee18
Function at 0x14001102d
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140011b70
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x14001f2c0]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1400250a4]
call fcn.14001140b
nop
mov dword [rbp + 0x10], 0x238
xor edx, edx
mov ecx, 2
call fcn.1400111cc
mov qword [rbp + 0x268], rax
cmp qword [rbp + 0x268], 0xffffffffffffffff
jne 0x140011be5
xor eax, eax
jmp 0x140011c6c
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.140011280
nop
lea rdx, [rbp + 0x3c]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140011c1e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
jmp 0x140011c6c
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x268]
call fcn.1400113ac
test eax, eax
je 0x140011c5c
lea rdx, [rbp + 0x3c]
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x140011c5a
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x18]
jmp 0x140011c6c
jmp 0x140011c1e
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c3f0]
call fcn.14001137f
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400111e5
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret
Function at 0x1400111f4
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400120c0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x40]
lea rcx, [0x1400250a4]
call fcn.14001140b
nop
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0
mov eax, dword [rbp + 0x130]
mov dword [rsp + 0x20], 0x20
mov r9d, 0x1000
mov r8d, eax
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x130]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rbp + 0x128]
mov rdx, qword [rbp + 8]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x1400121a9
mov edx, 0x1f4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x1400121ae
mov eax, 0xffffffff
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011244
Capabilities:
Terminate process

Disassembly:
jmp 0x1400145b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112e4
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015900
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015920
xor al, al
jmp 0x1400159a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015933
xor al, al
jmp 0x1400159a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001595d
xor al, al
jmp 0x1400159a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015971
xor al, al
jmp 0x1400159a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015983
xor al, al
jmp 0x1400159a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001599f
xor al, al
jmp 0x1400159a1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113b6
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400118f0
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f2c0]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x1400250a4]
call fcn.14001140b
nop
mov qword [rbp + 8], 0
mov dword [rbp + 0x30], 0x238
mov dword [rbp + 0x34], 0
mov dword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov dword [rbp + 0x48], 0
mov dword [rbp + 0x4c], 0
mov dword [rbp + 0x50], 0
mov dword [rbp + 0x54], 0
mov dword [rbp + 0x58], 0
lea rax, [rbp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 0x20c
rep stosb byte [rdi], al
mov dword [rbp + 0x284], 0
xor edx, edx
mov ecx, 2
call fcn.1400111cc
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1400119a9
jmp 0x140011a1e
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011280
test eax, eax
jne 0x1400119bc
jmp 0x140011a1e
mov dword [rbp + 0x2a4], 0
jmp 0x1400119d6
mov eax, dword [rbp + 0x2a4]
inc eax
mov dword [rbp + 0x2a4], eax
cmp dword [rbp + 0x2a4], 5
jge 0x140011a0d
movsxd rax, dword [rbp + 0x2a4]
lea rcx, str.x64dbg.exe
mov rdx, qword [rcx + rax*8]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140011a0b
mov dword [rbp + 0x284], 1
jmp 0x140011a0d
jmp 0x1400119c8
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400113ac
test eax, eax
jne 0x1400119bc
cmp qword [rbp + 8], 0
je 0x140011a30
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x284]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c0f0]
call fcn.14001137f
mov eax, edi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.1400111e5
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret
Function at 0x1400137d0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011438
movzx eax, al
test eax, eax
jne 0x1400137f0
mov ecx, 7
call fcn.14001138e
nop
mov byte [rsp + 0x20], 0
call fcn.1400113a2
mov byte [rsp + 0x21], al
cmp dword [0x14001fb28], 1
jne 0x140013814
mov ecx, 7
call fcn.14001138e
nop
jmp 0x14001386c
cmp dword [0x14001fb28], 0
jne 0x140013867
mov dword [0x14001fb28], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.1400111c7
test eax, eax
je 0x140013848
mov eax, 0xff
jmp 0x140013971
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.140011398
mov dword [0x14001fb28], 2
jmp 0x14001386c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011375
call fcn.140011307
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400138c9
mov rcx, qword [rsp + 0x30]
call fcn.140011172
movzx eax, al
test eax, eax
je 0x1400138c9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.14001133e
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400138fd
mov rcx, qword [rsp + 0x38]
call fcn.140011172
movzx eax, al
test eax, eax
je 0x1400138fd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113ed
nop
call fcn.140013a20
mov dword [rsp + 0x28], eax
call fcn.1400112e4
movzx eax, al
test eax, eax
jne 0x14001391c
mov ecx, dword [rsp + 0x28]
call fcn.14001105f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001392b
call fcn.1400113fc
nop
xor edx, edx
mov cl, 1
call fcn.140011163
mov eax, dword [rsp + 0x28]
jmp 0x140013971
add rsp, 0x68
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004044f0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00404500]
mov dword [rax], 1
mov rax, qword [0x00404510]
mov dword [rax], 1
mov rax, qword [0x004044e0]
mov dword [rax], 1
mov rax, qword [0x004043d0]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x004044d0]
mov dword [0x0040700c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00404490]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00404380]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401a90
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]