joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054940
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140074010]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx eax, byte [0x14007e0ac]
test al, al
jne 0x140054996
movsxd rax, dword [0x14007c55c]
lea rcx, [0x140067dd0]
mov rcx, qword [rcx + rax*8]
call fcn.14003c590
test al, al
je 0x140054b3f
mov byte [0x14007e0ac], 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140058a00
add rsp, 0x58
ret
cmp al, 1
jne 0x140054b3f
mov qword [rsp + 0x60], rbx
lea rcx, [0x1400624f0]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x50], rdi
vmovaps xmmword [rsp + 0x40], xmm6
call fcn.14003c590
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400549e2
imul rax, rax, 0x64
jmp 0x140054a00
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffffffbd3e27f
lea rdi, [rax + 0x42c1d80]
cmp rax, rcx
jl 0x140054a20
movabs rdi, 0x7fffffffffffffff
vmovsd xmm6, qword [0x1400699a8]
movabs rsi, 0x311cdad160000
movabs rbp, 0x112e0be826d694b3
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140054a5e
imul rbx, rax, 0x64
jmp 0x140054a7f
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x140054aee
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rdx, rax, 0x64
mov rax, rdi
sub rax, rbx
vxorps xmm0, xmm0, xmm0
vcvtsi2sd xmm0, xmm0, rax
vcomisd xmm0, xmm6
lea rcx, [rdx + rsi]
ja 0x140054aab
lea rcx, [rax + rdx]
add rax, rdx
add rdx, rsi
vcomisd xmm0, xmm6
cmovbe rdx, rax
mov rax, rbp
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x20], rdx
sub ecx, eax
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140054a40
vmovaps xmm6, xmmword [rsp + 0x40]
lea rbx, [0x140067b30]
mov rsi, qword [rsp + 0x70]
lea rdi, [0x140067dc8]
mov rbp, qword [rsp + 0x68]
nop dword [rax]
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140054b2c
mov eax, dword [rbx]
mov dword [0x14007c55c], eax
mov byte [0x14007e0ac], 0
add rbx, 4
cmp rbx, rdi
jne 0x140054b10
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140058a00
add rsp, 0x58
ret
Function at 0x14005833c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400583c0
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140061b20]
cmp byte [rcx + rax], 0
je 0x1400583c0
dec r8
sub rdx, 1
jne 0x1400583a6
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140059710
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005975a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005975a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005975a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005975a
cmp dword [rcx + 0x84], 0xe
jbe 0x14005975a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005975c
xor al, al
add rsp, 0x28
ret
Function at 0x1400c2c00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10090
call fcn.1400c7090
sub rsp, rax
mov rax, qword [0x140107238]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx edx, byte [rcx]
lea rbx, [rsp + 0x30]
xor eax, eax
mov rsi, rcx
mov word [rsp + 0x80], ax
mov word [rsp + 0x30], ax
lea edi, [rax + 0x28]
test dl, dl
je 0x1400c2cc2
nop dword [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1400c2c6d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1400c2c60
cmp rcx, 1
jb 0x1400c2d1a
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400c2c90
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400d61b4
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400c2c50
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400c2cf3
lea rcx, [rsp + 0x80]
call fcn.1400d8ff4
jmp 0x1400c2cf5
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400c6dc0
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400caf80
int3
Function at 0x1400c68b0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140107238]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
lea edi, [rax + 0x28]
test dl, dl
je 0x1400c6955
nop dword [rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1400c690d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1400c6900
cmp rcx, 1
jb 0x1400c6986
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400c6923
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400d61b4
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400c68f0
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c6dc0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.1400caf80
int3
Function at 0x1400c6a90
Capabilities:
Set environment variable

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0xb0
mov rax, qword [0x140107238]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [0x14010d920]
mov rbp, r8
mov rsi, rdx
mov r14, rcx
test rax, rax
jne 0x1400c6ae0
lea rcx, [0x1400e70d4]
call qword [sym.imp.python310.dll_PyImport_ImportModule]
mov qword [0x14010d920], rax
test rax, rax
je 0x1400c6d1a
mov qword [rsp + 0xa8], rbx
lea rdx, str.environ
mov qword [rsp + 0xa0], rdi
mov rcx, rax
mov qword [rsp + 0x98], r13
mov qword [rsp + 0x90], r15
call qword [sym.imp.python310.dll_PyObject_GetAttrString]
mov rcx, rsi
mov r15, rax
call qword [sym.imp.python310.dll_PyUnicode_FromString]
movzx edx, byte [rsi]
lea rbx, [rsp + 0x30]
xor ecx, ecx
mov r13, rax
mov word [rsp + 0x30], cx
lea edi, [rcx + 0x28]
test rbp, rbp
je 0x1400c6c16
test dl, dl
je 0x1400c6bb2
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1400c6b5d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1400c6b50
cmp rcx, 1
jb 0x1400c6d20
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400c6b80
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400d61b4
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400c6b40
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, rbp
call qword [sym.imp.python310.dll_PyUnicode_FromWideChar]
mov rdx, r13
mov rcx, r15
mov r8, rax
mov rbx, rax
call qword [sym.imp.python310.dll_PyObject_SetItem]
test eax, eax
je 0x1400c6bfd
mov ecx, 1
call qword [sym.imp.python310.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python310.dll_Py_Exit]
int3
sub qword [rbx], 1
jne 0x1400c6cb7
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x1400c6cb7
test dl, dl
je 0x1400c6c92
nop word [rax + rax]
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x1400c6c3d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x1400c6c30
cmp rcx, 1
jb 0x1400c6d14
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
nop word [rax + rax]
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x1400c6c60
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.1400d61b4
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x1400c6c20
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, r13
mov rcx, r15
call qword [sym.imp.python310.dll_PyObject_DelItem]
test eax, eax
je 0x1400c6cb7
mov rcx, r14
call fcn.1400ae2a0
sub qword [r13], 1
jne 0x1400c6cc8
mov rax, qword [r13 + 8]
mov rcx, r13
call qword [rax + 0x30]
sub qword [r15], 1
jne 0x1400c6cd8
mov rax, qword [r15 + 8]
mov rcx, r15
call qword [rax + 0x30]
mov r13, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c6dc0
add rsp, 0xb0
pop r14
pop rsi
pop rbp
ret
call fcn.1400caf80
int3
call fcn.1400caf80
int3
call fcn.1400caf80
int3
Function at 0x1400c7808
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c7852
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c7852
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c7852
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c7852
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c7852
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c7854
xor al, al
add rsp, 0x28
ret

Function at 0x1400cc7f8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400cc663
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400cc663
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400cc663
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400cc663
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400cc663
cmp dword [rcx + 0x84], 0xe
jbe 0x1400cc663
cmp dword [rcx + 0xf8], 0
je 0x1400cc663
mov ecx, ebx
call fcn.1400cc714
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400cc4f0
nop
cmp dword [rbp + 0x20], 0
je 0x1400cc6b1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400cc6bc
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400cc5f4
Function at 0x1400de260
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400de2e7
mov rsi, rbx
cmp word [rax], bp
je 0x1400de2a6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400de290
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400de28c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400d97e0
mov rdi, rax
test rax, rax
je 0x1400de2d4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400c7bb0
mov rbp, rdi
xor ecx, ecx
call fcn.1400da328
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e1e5c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400e1e72
mov al, 1
jmp 0x1400e1ed2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400e1e83
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400e1ed0
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400dea04
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400e1ed0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400e1ed0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400e1ed0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400e1ed2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140001ef8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f44
xor al, al
add rsp, 0x28
ret
Function at 0x180001bb0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x230
mov rbx, rcx
mov ecx, 0xff
call fcn.18002387c
mov rdx, qword [str.SoftwareSaschArt_]
or rcx, 0xffffffffffffffff
mov rsi, rax
lea rax, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov qword [rax], rdx
mov rdx, qword [0x180070938]
mov qword [rax + 8], rdx
movzx edx, word [0x180070940]
mov word [rax + 0x10], dx
movzx edx, byte [0x180070942]
mov byte [rax + 0x12], dl
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180001c10
lea rax, [rsp + 0x268]
lea rdx, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x180001c5d
lea rax, [0x18007092f]
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x268]
lea rax, [rsp + 0x258]
lea r9, [rsp + 0x260]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x130]
lea rdx, str.Serial
xor r8d, r8d
mov dword [rsp + 0x260], 1
mov dword [rsp + 0x258], 0xff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x268]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x130]
mov rcx, rsi
sub rcx, rax
lea rdx, [rsp + 0x130]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x180001cd1
mov rax, rsi
add rsp, 0x230
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000ed70
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x290
mov r9, rcx
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180085d80]
mov rsi, rdx
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x18000ee51
lea r8, [0x180085d80]
lea rdx, str._s_s.key
lea rcx, [rsp + 0x180]
call fcn.1800262b4
or rcx, 0xffffffffffffffff
xor eax, eax
xor ebx, ebx
mov rdi, rsi
mov rdx, rsi
repne scasb al, byte [rdi]
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rbx
not rcx
mov byte [rsp + 0x58], bl
lea r8, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.18000c130
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x180]
call fcn.18000ea90
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
mov rdx, rsi
mov qword [rsp + 0x70], 0xf
repne scasb al, byte [rdi]
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x58], bl
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.18000c130
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x180]
call fcn.18000ea90
test al, al
setne al
jmp 0x18000ef80
mov rax, qword [str.SoftwareSaschArt_]
lea rcx, [rsp + 0x80]
lea rdi, [rsp + 0x80]
mov qword [rcx], rax
mov rax, qword [0x180070938]
mov qword [rcx + 8], rax
movzx eax, word [0x180070940]
mov word [rcx + 0x10], ax
movzx eax, byte [0x180070942]
mov byte [rcx + 0x12], al
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18000eea0
lea rax, [rsp + 0x2b8]
lea rdx, [rsp + 0x80]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18000ef36
xor ebx, ebx
lea rax, [rsp + 0x2b0]
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x2b8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x2b0], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x18000ef36
xor al, al
jmp 0x18000ef80
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
lea rdx, str.Serial
lea r9d, [rax + 1]
not rcx
xor r8d, r8d
dec rcx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x2b8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x18000ef32
mov rcx, qword [rsp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180019600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0xe4], 0
mov rax, rdx
je 0x180019631
mov r8, qword [rcx + 0xd8]
test r8, r8
je 0x180019638
cmp byte [r8], 0
je 0x180019638
lea r9, [rcx + 0x10]
lea rdx, [rcx + 0x88]
mov rcx, rax
jmp fcn.18001c0d0
mov byte [0x180085eb0], 0
mov al, 1
ret
Function at 0x18002e584
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x18002e3f8

Function at 0x180038877
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180083e60]
jne 0x18002bcda
rol rcx, 0x10
test cx, 0xffff
jne 0x18002bcd6
repz ret
ror rcx, 0x10
jmp 0x1800387d0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180086b20]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180086c18]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180038855
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180086b20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180038877
mov rax, qword [rsp + 0x88]
mov qword [0x180086c18], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180086bb8], rax
mov rax, qword [0x180086c18]
mov qword [0x180086a90], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180086ba0], rax
mov dword [0x180086a80], 0xc0000409
mov dword [0x180086a84], 1
mov rax, qword [0x180083e60]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180083e68]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180086b18], eax
mov ecx, 1
call fcn.18003119c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800772e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180086b18], 0
jne 0x1800388fe
mov ecx, 1
call fcn.18003119c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180038efc
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18002ec8c
xor ebx, ebx
mov rdi, rax
cmp qword [0x180087078], rbx
jne 0x180039002
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800390d7
lea rdx, [0x180077c70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800390d7
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180087078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180087080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180087088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180087098], rax
test rax, rax
je 0x180038ff9
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180087090], rax
jmp 0x180039009
mov rax, qword [0x180087090]
jmp 0x180039010
mov rax, qword [0x180087090]
mov r11, qword [0x180087098]
cmp rax, rdi
je 0x180039078
cmp r11, rdi
je 0x180039078
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180087098]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180039078
test rax, rax
je 0x180039078
call rsi
test rax, rax
je 0x180039072
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180039072
test byte [rsp + 0x38], 1
jne 0x180039078
bts ebp, 0x15
jmp 0x1800390b6
mov rcx, qword [0x180087080]
cmp rcx, rdi
je 0x1800390b6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800390b6
call rax
mov rbx, rax
test rax, rax
je 0x1800390b6
mov rcx, qword [0x180087088]
cmp rcx, rdi
je 0x1800390b6
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800390b6
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180087078]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800390d7
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800390d9
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18006ace0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x18006acf9
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x180079b20]
cmp r11d, 8
jb 0x18006adf2
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x18006ad20
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x18006ae20
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r11d, 0xffffffff
jne 0x18006ae00
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x1400aa1ea
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1401bd400
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.1401bc410
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401bd435
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x140282020]
jmp 0x1401bd43f
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret