joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400daad8
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rbx, r9
mov sil, r8b
mov bpl, dl
mov rdi, rcx
test rcx, rcx
jne 0x1400dab04
xor eax, eax
jmp 0x1400dab99
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and dword [rsp + 0x58], 0
movsx ecx, bpl
mov dword [rsp + 0x3c], eax
movsx eax, sil
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0xa8]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xb0]
mov dword [rsp + 0x38], ecx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x60], rax
test rbx, rbx
je 0x1400dab82
lea r8, [rsp + 0x20]
lea rdx, [0x140071150]
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x1400dab94
lea rdx, [rsp + 0x20]
lea rcx, [0x140071150]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x28]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400dabb0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
bt r8d, 0x1d
mov r15, r9
mov esi, r8d
mov r14, rcx
jae 0x1400dabea
mov rbp, qword [rsp + 0x80]
xor edi, edi
jmp 0x1400dabf2
mov rdi, qword [rsp + 0x80]
lea r13, [rdx + r9]
mov ebx, r8d
and esi, 0x1fffffff
mov r12, r13
shr r12, 0x20
and ebx, 0xc0000000
je 0x1400dac3b
xor edx, edx
mov r8, rdi
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
jne 0x1400dac2c
test ebx, ebx
jns 0x1400dac3b
xor eax, eax
jmp 0x1400dacd8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
bt ebx, 0x1e
jb 0x1400dac25
mov r9d, r12d
mov r8d, esi
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x1400dac25
test ebx, ebx
je 0x1400dac8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0xb7
test ebx, ebx
jns 0x1400dac75
cmp eax, ecx
jne 0x1400dac7f
bt ebx, 0x1e
jae 0x1400dac8a
cmp eax, ecx
jne 0x1400dac8a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400dac25
mov edx, esi
mov ecx, 1
mov r8, r15
and edx, 4
shr r8, 0x20
mov r9d, r15d
or edx, 8
shr edx, 1
cmp esi, 8
cmove edx, ecx
and qword [rsp + 0x20], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rbp, rbp
je 0x1400daccc
mov qword [rbp], rdi
jmp 0x1400dacd5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400db1b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rcx, qword [0x1401312f8]
xor edx, edx
mov r8d, 0x408
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
cmp rax, rbx
jne 0x1400db1e8
mov ecx, 2
call fcn.140060fc0
cmp eax, 4
je 0x1400db1bc
lea rcx, [rdi + 8]
mov dword [rdi + 4], 0xaa55
mov qword [rdi], 0x400
mov qword [0x1401321d8], rcx
mov eax, ebx
mov edx, 8
test al, 1
je 0x1400db215
shr eax, 1
xor eax, 0xedb88320
jmp 0x1400db217
shr eax, 1
sub rdx, 1
jne 0x1400db208
inc ebx
mov dword [rcx], eax
add rcx, 4
cmp ebx, 0x100
jl 0x1400db201
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400db238
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, qword [0x1401321d8]
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
test r10, r10
jne 0x1400db26d
call fcn.1400db1b0
mov r10, qword [0x1401321d8]
mov r9b, dil
or ebx, 0xffffffff
xor r8d, r8d
and r9b, 7
je 0x1400db291
movsx rax, r9b
sub rdi, rax
lea r8, [rdi - 0x18]
cmp qword [r8], 0
je 0x1400db291
mov ebx, dword [r8 + 8]
test rsi, rsi
je 0x1400db2b4
movzx eax, byte [rbp]
movzx ecx, bl
inc rbp
xor rcx, rax
mov eax, ebx
mov ebx, dword [r10 + rcx*4]
shr eax, 8
xor ebx, eax
sub rsi, 1
jne 0x1400db296
test r9b, 2
je 0x1400db2c9
mov eax, ebx
mov qword [r8], 1
mov qword [r8 + 8], rax
jmp 0x1400db2e3
not ebx
test rdi, rdi
je 0x1400db2e3
lea rdx, str._08X
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400dbca8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 2]
mov rcx, rdi
mov ebx, eax
movsxd rdx, r8d
call fcn.140061610
mov r11, qword [rdi]
xor eax, eax
mov word [r11], ax
mov rdx, qword [rdi]
lea r8d, [rbx + 1]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_GetWindowTextW]

Function at 0x1400dc6a4
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
and qword [rcx + 0x18], 0
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [0x1400dc614]
mov rdx, rbx
mov dword [rbx + 0x10], eax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbx + 0x18]
add rsp, 0x20
pop rbx
ret
Function at 0x1400dca14
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x38
cmp dword [0x140131830], 0
je 0x1400dca2b
cmp qword [0x140132220], 0
jne 0x1400dca86
mov rcx, qword [0x140130a70]
mov edx, 0x271b
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rcx, qword [0x140130a70]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400dca86
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x1400dca86
mov rcx, qword [0x140130a70]
and qword [rsp + 0x20], 0
lea r9, [0x1400dc9bc]
xor r8d, r8d
mov rdx, rax
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
add rsp, 0x38
ret

Function at 0x1400dcb5c
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
or qword [rsp + 0x38], 0xffffffffffffffff
lea rdx, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x38]
add rsp, 0x28
ret

Function at 0x1400dd138
Capabilities:
Get token membership

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov byte [rax + 0x10], 0
mov byte [rax + 0x11], 0
mov byte [rax + 0x12], 0
mov byte [rax + 0x13], 0
mov byte [rax + 0x14], 0
mov byte [rax + 0x15], 5
lea rax, [rax + 0x18]
lea rcx, [rsp + 0x78]
mov r9d, 0x220
mov qword [rsp + 0x50], rax
and dword [rsp + 0x48], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r8d, 0x20
mov dl, 2
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rsp + 0x70], eax
test eax, eax
je 0x1400dd1d2
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
neg eax
sbb ecx, ecx
and ecx, dword [rsp + 0x70]
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1400e6960
Capabilities:
Capture screenshot

Disassembly:
test edx, edx
js 0x1400e6ab0
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x90
and dword [rax - 0x48], 0
and dword [rax - 0x44], 0
and dword [rax - 0x40], 0
and dword [rax - 0x3c], 0
mov r14d, edx
lea rdx, [rax - 0x48]
mov r13, rcx
call qword [sym.imp.USER32.dll_GetClientRect]
mov ebp, dword [rsp + 0x68]
mov esi, dword [rsp + 0x6c]
sub ebp, dword [rsp + 0x60]
mov rcx, r13
sub esi, dword [rsp + 0x64]
call qword [sym.imp.USER32.dll_GetDC]
mov ecx, 0xf
mov r12, rax
call qword [sym.imp.USER32.dll_GetSysColor]
mov rcx, r12
mov edi, eax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, esi
mov edx, ebp
mov rcx, r12
mov rbx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
lea rcx, [rsp + 0x70]
mov rdx, rbx
mov r8, rax
call fcn.140058c5c
lea rdx, [rsp + 0x60]
mov r8d, r14d
mov rcx, rbx
call fcn.1400dcb0c
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], ebp
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
call fcn.1400e677c
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
lea rcx, [rsp + 0x70]
call fcn.140058cb0
test rbx, rbx
je 0x1400e6a7e
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
test r12, r12
je 0x1400e6a8f
mov rdx, r12
mov rcx, r13
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret
Function at 0x1400f2294
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor r12d, r12d
mov r9, rdx
mov rbx, rcx
cmp rdx, r12
je 0x1400f23fe
cmp dword [rdx], r12d
jge 0x1400f22e5
cmp dword [rdx + 4], r12d
jge 0x1400f22e5
cmp dword [rdx + 8], r12d
jge 0x1400f22e5
cmp dword [rdx + 0xc], r12d
jge 0x1400f22e5
or eax, 0xffffffff
mov word [rcx + 0x9a], ax
jmp 0x1400f23fe
mov r10d, r12d
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
movsxd r8, eax
mov eax, r10d
inc r10d
cdq
and eax, 1
xor eax, edx
sub eax, edx
movsxd rcx, eax
mov eax, dword [r9]
add r9, 4
cmp r10d, 4
lea rdx, [rcx + r8*2 + 0x22]
mov dword [rbx + rdx*4], eax
jl 0x1400f22e8
lea rdi, [rbx + 0x78]
mov ebp, 2
mov rcx, qword [rdi]
cmp rcx, r12
je 0x1400f2330
call qword [sym.imp.GDI32.dll_DeleteObject]
mov qword [rdi], r12
add rdi, 8
sub rbp, 1
jne 0x1400f2322
mov rax, qword [0x140132318]
cmp rax, r12
jne 0x1400f2359
lea ecx, [rbp + 5]
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [0x140132318], rax
mov ecx, dword [rbx + 0x8c]
mov r8d, 0x80000000
cmp ecx, r12d
jge 0x1400f237a
cmp ecx, r8d
je 0x1400f237a
mov qword [rbx + 0x78], rax
mov rax, qword [0x140132318]
mov edx, dword [rbx + 0x94]
cmp edx, r12d
jge 0x1400f2391
cmp edx, r8d
je 0x1400f2391
mov qword [rbx + 0x80], rax
cmp ecx, r12d
jl 0x1400f23a0
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbx + 0x78], rax
mov ecx, dword [rbx + 0x94]
cmp ecx, r12d
jl 0x1400f23b8
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rbx + 0x80], rax
cmp word [rbx + 0x9a], r12w
jge 0x1400f23ca
mov word [rbx + 0x9a], r12w
mov eax, dword [rbx + 0x94]
cmp eax, r12d
jl 0x1400f23fe
cmp eax, dword [rbx + 0x8c]
jne 0x1400f23fe
mov eax, dword [rbx + 0x88]
cmp dword [rbx + 0x90], eax
jne 0x1400f23fe
mov al, byte [rbx + 0xa4]
cmp al, r12b
jle 0x1400f23fe
or al, 0x80
mov byte [rbx + 0xa4], al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400f2860
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x80
mov rbp, rcx
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetParent]
mov r12, rax
test rax, rax
je 0x1400f29bf
mov rcx, qword [rbp + 0xd0]
test rcx, rcx
je 0x1400f28a6
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rbp + 0x20]
and qword [rbp + 0xd0], 0
and dword [rsp + 0x50], 0
and dword [rsp + 0x54], 0
and dword [rsp + 0x58], 0
and dword [rsp + 0x5c], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetWindowRect]
and dword [rsp + 0xa0], 0
and dword [rsp + 0xa4], 0
lea rdx, [rsp + 0xa0]
mov rcx, r12
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r8d, dword [rsp + 0xa4]
mov edx, dword [rsp + 0xa0]
mov esi, dword [rsp + 0x58]
mov edi, dword [rsp + 0x5c]
lea rcx, [rsp + 0x50]
sub esi, dword [rsp + 0x50]
sub edi, dword [rsp + 0x54]
neg r8d
neg edx
call qword [sym.imp.USER32.dll_OffsetRect]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, edi
mov edx, esi
mov rcx, r13
mov rbx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
lea rcx, [rsp + 0x60]
mov rdx, rbx
mov r8, rax
mov qword [rbp + 0xd0], rax
call fcn.140058c5c
mov eax, dword [rsp + 0x54]
and qword [rsp + 0x60], 0
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x30], eax
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
lea rcx, [rsp + 0x60]
call fcn.140058cb0
test rbx, rbx
je 0x1400f29ae
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
test r13, r13
je 0x1400f29bf
mov rdx, r13
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret

Function at 0x1400f6b58
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 0xffdf
and cx, ax
mov eax, 0x41
cmp ax, cx
je 0x1400f6b81
mov eax, 0x42
cmp ax, cx
je 0x1400f6b81
mov eax, 0xfffffffe
jmp 0x1400f6baa
mov word [rsp + 0x38], cx
mov eax, 0x3a
lea rcx, [rsp + 0x38]
xor ebx, ebx
mov word [rsp + 0x3a], ax
mov word [rsp + 0x3c], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
setne bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400f6c80
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [rsp + 0xc8]
mov qword [r11 - 0x30], rax
mov rax, qword [rsp + 0xc0]
mov qword [r11 - 0x38], rax
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x48], rax
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x50], eax
jmp 0x1400f6ce6
add rsp, 0x78
ret
Function at 0x1400fdb44
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140100414
nop
cmp dword [0x140132568], 1
je 0x1400fdaf0
mov dword [0x140132564], 1
mov byte [0x140132560], r12b
test ebx, ebx
jne 0x1400fdadc
mov rcx, qword [0x1401336b0]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400fdac9
mov rcx, qword [0x1401336a8]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x1400fda68
call fcn.1400fd260
cmp qword [rdi], rax
jne 0x1400fda68
jmp 0x1400fda4e
cmp rdi, rsi
jb 0x1400fdac9
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400fd260
mov qword [rdi], rax
call rbx
mov rcx, qword [0x1401336b0]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x1401336a8]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400fdaa7
cmp r13, rax
je 0x1400fdac7
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x1400fda4e
lea rdx, [0x140111340]
lea rcx, [0x140111328]
call fcn.1400fd898
lea rdx, [0x140111350]
lea rcx, [0x140111348]
call fcn.1400fd898
nop
test r12d, r12d
je 0x1400fdaff
mov ecx, 8
call fcn.140100314
test r12d, r12d
jne 0x1400fdb2a
mov dword [0x140132568], 1
lea ecx, [r12 + 8]
call fcn.140100314
mov ecx, r15d
call fcn.1400fd82c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400fd9b8

Function at 0x1400fdb50
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400fd9b8
Function at 0x140108d4f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14012f550]
jne 0x1400ffc9a
rol rcx, 0x10
test cx, 0xffff
jne 0x1400ffc96
repz ret
ror rcx, 0x10
jmp 0x140108ca8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140132f20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140133018]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140108d2d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140132f20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140108d4f
mov rax, qword [rsp + 0x88]
mov qword [0x140133018], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140132fb8], rax
mov rax, qword [0x140133018]
mov qword [0x140132e90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140132fa0], rax
mov dword [0x140132e80], 0xc0000409
mov dword [0x140132e84], 1
mov rax, qword [0x14012f550]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14012f558]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140132f18], eax
mov ecx, 1
call fcn.140107e94
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140124750]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140132f18], 0
jne 0x140108dd6
mov ecx, 1
call fcn.140107e94
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140109950
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400fd260
xor ebx, ebx
mov rdi, rax
cmp qword [0x1401333f8], rbx
jne 0x140109a56
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140109b2b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140109b2b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x1401247b0]
mov rcx, rsi
mov qword [0x1401333f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140133400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140133408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140133418], rax
test rax, rax
je 0x140109a4d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140133410], rax
jmp 0x140109a5d
mov rax, qword [0x140133410]
jmp 0x140109a64
mov rax, qword [0x140133410]
mov r11, qword [0x140133418]
cmp rax, rdi
je 0x140109acc
cmp r11, rdi
je 0x140109acc
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140133418]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140109acc
test rax, rax
je 0x140109acc
call rsi
test rax, rax
je 0x140109ac6
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140109ac6
test byte [rsp + 0x38], 1
jne 0x140109acc
bts ebp, 0x15
jmp 0x140109b0a
mov rcx, qword [0x140133400]
cmp rcx, rdi
je 0x140109b0a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140109b0a
call rax
mov rbx, rax
test rax, rax
je 0x140109b0a
mov rcx, qword [0x140133408]
cmp rcx, rdi
je 0x140109b0a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140109b0a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1401333f8]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140109b2b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140109b2d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x613c1446
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov edx, 1
lea rcx, section.......
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x613c1550
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x613c7024]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x613c166a
mov rax, qword [0x613c7028]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x613c159e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x613c1650
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x613c1582
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x613c16a2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x613c7028]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x613c7028]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x613c1685
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x613c1649
sub eax, 0x40
and eax, 0xffffffbf
je 0x613c1649
mov r9, rbp
add r9, qword [0x613c7028]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x613c1671
add dword [0x613c7024], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x613c15ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x613c4098]
mov edx, eax
call dbg.__report_error
mov rax, qword [0x613c7028]
mov edx, dword [r12 + 8]
lea rcx, [0x613c4060]
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, [0x613c4040]
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x613c2260
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x613c2270
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x613c2280
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x613c22c1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x613c22b8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x613c22c3
add rax, 0x28
cmp rax, r9
jne 0x613c22a4
xor eax, eax
repz ret

Function at 0x613c2370
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x613c41b0]
cmp word [rbx], 0x5a4d
je 0x613c2390
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x613c2384
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection