joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464a00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4033ef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409d40
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462960
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4033c0
cmp byte [0x006fb851], 0
je 0x464a15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x461a60
jmp 0x4033c0

Function at 0x464a20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006fbc20]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x006fb851], 0
je 0x464a55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006fbf60]
aesenc xmm0, xmmword [0x006fbf70]
aesenc xmm0, xmmword [0x006fbf80]
movq rax, xmm0
ret
jmp 0x409f40

Function at 0x464a60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006fbc20]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x006fb851], 0
je 0x464a96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006fbf60]
aesenc xmm0, xmmword [0x006fbf70]
aesenc xmm0, xmmword [0x006fbf80]
movq rax, xmm0
ret
jmp 0x409fa0

Function at 0x4664a0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x006fbee0]
mov qword [rsp + 8], rdx
lea r8d, [0x006fb86c]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00464940
add rsp, 0x30
ret

Function at 0x4669e0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x466a0c
call fcn.00464940
shl rcx, 3
add rcx, 0x1480
mov qword [0x006fba40], rcx
ret
Function at 0x484a00
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484c4b
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x484aac
mov qword [rsp + 0x88], rax
lea rbx, [0x00586900]
mov rcx, rax
lea rax, [0x006a87a0]
call fcn.0047a320
test cl, cl
jne 0x484a91
mov rax, qword [rsp + 0x88]
call fcn.00483920
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x005c1598]
call fcn.0044e160
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.00485e40
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x484acd
lea rdx, [0x00586640]
cmp rax, rdx
jne 0x484abb
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
call fcn.004604e0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x00563de0]
call fcn.0040aae0
inc rdx
cmp rbx, rdx
jle 0x484b18
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x484aca
lea rax, [0x006a87a0]
lea rbx, [0x00586900]
lea rdi, [0x00586640]
call fcn.0047a4e0
lea rdx, [0x00586640]
nop dword [rax]
cmp rax, rdx
jne 0x484c3b
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x0055ca00]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x00570080]
nop
call fcn.0040d7c0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x006fbb60], 0
jne 0x484b7a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x484b89
mov rbx, rax
lea rax, [0x00570080]
call fcn.004139c0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.004833e0
call fcn.004605a0
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x484bd6
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x484bc8
mov dword [rsi + 0x10], edx
cmp dword [0x006fbb60], 0
jne 0x484bee
mov qword [rsi + 0x30], rcx
jmp 0x484bf7
lea rdi, [rsi + 0x30]
call fcn.00464c20
lea rax, [0x006a87a0]
lea rbx, [0x00586900]
lea rdi, [0x00586640]
call fcn.0047a4e0
lea rdx, [0x00586640]
cmp rax, rdx
jne 0x484c2c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x00563de0]
call fcn.0040aae0
mov rbx, rdx
lea rcx, [0x00563de0]
call fcn.0040aae0
nop
mov qword [rsp + 8], rax
call fcn.00462960
mov rax, qword [rsp + 8]
jmp fcn.00484a00
Function at 0x51c480
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c5db
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x006a7548]
call fcn.004cb6a0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [0x0051c600]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call fcn.00403220
xorps xmm15, xmm15
mov r14, qword [0x006fba40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x51c59b
mov rdx, qword [rsp + 0x28]
cmp rdx, rcx
jb 0x51c5d5
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x51c5ca
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rbx
sar rbx, 0x3f
and rcx, rbx
mov r8, qword [rsp + 0x38]
lea rax, [r8 + rcx]
mov rbx, rdi
lea rdx, [rsp + 0x50]
nop
call rsi
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov rcx, rbx
call fcn.00465080
call fcn.00465000
nop
nop dword [rax + rax]
call fcn.00462960
jmp fcn.0051c480
Function at 0x5379a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x537c01
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
test rax, rax
je 0x537be5
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
test rbx, rbx
jne 0x5379ed
xor ebx, ebx
xor ecx, ecx
jmp 0x537a00
mov rax, rdx
call fcn.00529160
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x537b18
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop
call fcn.00481200
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005c1540]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044e200
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403220
xorps xmm15, xmm15
mov r14, qword [0x006fba40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x537adb
xor eax, eax
lea rbx, [0x005c16d0]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0058affc]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044e2e0
jmp 0x537b08
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x005c15e8]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044e200
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rax, qword [rax + 0x18]
nop dword [rax]
call fcn.00481200
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403220
xorps xmm15, xmm15
mov r14, qword [0x006fba40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x537ba8
xor eax, eax
lea rbx, [0x005c16d0]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x0058affc]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044e2e0
jmp 0x537bd5
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x005c15e8]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044e200
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
lea rax, [0x0058b442]
mov ebx, 5
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
call fcn.00462960
mov rax, qword [rsp + 8]
jmp fcn.005379a0
Function at 0x548f80
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x548f98
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x548f98
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x548fa0
xor eax, eax
ret
cmp rbx, 3
je 0x548fac
cmp rbx, 4
jne 0x548fd9
cmp al, 0x2c
ja 0x548fc6
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x548fd6
cmp al, 0x24
je 0x548fd6
nop dword [rax]
cmp al, 0x26
jae 0x548fd6
jmp 0x548fd9
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x548fd6
cmp al, 0x5b
je 0x548fd6
cmp al, 0x5d
jne 0x548fd9
xor eax, eax
ret
cmp al, 0x2f
ja 0x549012
nop dword [rax]
cmp al, 0x26
ja 0x548ff1
cmp al, 0x24
je 0x549031
cmp al, 0x26
je 0x549031
jmp 0x5490ab
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x549031
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x5490a8
cmp al, 0x2f
je 0x549031
jmp 0x5490ab
cmp al, 0x3d
ja 0x549029
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x549031
nop
cmp al, 0x3d
je 0x549031
jmp 0x5490ab
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x5490a0
cmp rbx, 2
jg 0x549067
cmp rbx, 1
je 0x549061
nop dword [rax]
cmp rbx, 2
jne 0x5490ab
cmp al, 0x2f
je 0x549052
cmp al, 0x3b
je 0x549052
cmp al, 0x2c
jne 0x549059
mov ecx, 1
jmp 0x54905e
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x54908a
cmp al, 0x40
je 0x549079
cmp al, 0x2f
je 0x549079
cmp al, 0x3f
jne 0x549082
mov ecx, 1
nop
jmp 0x549087
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x549099
cmp rbx, 7
jne 0x5490ab
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x5490a8
cmp al, 0x7e
jne 0x5490ab
xor eax, eax
ret
cmp rbx, 7
jne 0x5490c1
cmp al, 0x21
je 0x5490bd
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x5490c1
xor eax, eax
nop
ret
mov eax, 1
ret
Function at 0x140001000
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rdi
sub rsp, 0x20
mov edi, edx
mov r11, rcx
test edx, edx
je 0x140001175
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov r8, rcx
mov eax, r9d
nop dword [rax + rax]
mov dword [r8], eax
inc eax
add r8, 4
cmp eax, 0x100
jl 0x140001030
mov ebx, 2
lea r10, [rcx + 8]
lea rbp, str.Anonymous
lea esi, [rbx + 0x3e]
nop word [rax + rax]
xor edx, edx
lea eax, [rbx - 2]
div edi
movzx r8d, byte [rdx + rbp]
add r8d, dword [r10 - 8]
add r8d, r9d
and r8d, 0x800000ff
jge 0x140001089
dec r8d
or r8d, 0xffffff00
inc r8d
movzx ecx, byte [r10 - 8]
movsxd rdx, r8d
mov eax, dword [r11 + rdx*4]
mov dword [r10 - 8], eax
mov dword [r11 + rdx*4], ecx
xor edx, edx
lea eax, [rbx - 1]
div edi
movzx r9d, byte [rdx + rbp]
add r9d, dword [r10 - 4]
add r9d, r8d
and r9d, 0x800000ff
jge 0x1400010c6
dec r9d
or r9d, 0xffffff00
inc r9d
movzx ecx, byte [r10 - 4]
movsxd rdx, r9d
mov eax, dword [r11 + rdx*4]
mov dword [r10 - 4], eax
mov dword [r11 + rdx*4], ecx
xor edx, edx
mov eax, ebx
div edi
movzx r8d, byte [rdx + rbp]
add r8d, r9d
add r8d, dword [r10]
and r8d, 0x800000ff
jge 0x140001101
dec r8d
or r8d, 0xffffff00
inc r8d
movzx ecx, byte [r10]
movsxd rdx, r8d
mov eax, dword [r11 + rdx*4]
mov dword [r10], eax
mov dword [r11 + rdx*4], ecx
xor edx, edx
lea eax, [rbx + 1]
div edi
movzx r9d, byte [rdx + rbp]
add r9d, dword [r10 + 4]
add r9d, r8d
and r9d, 0x800000ff
jge 0x14000113c
dec r9d
or r9d, 0xffffff00
inc r9d
movzx ecx, byte [r10 + 4]
movsxd rdx, r9d
add r10, 0x10
mov eax, dword [r11 + rdx*4]
add ebx, 4
dec rsi
mov dword [r10 - 0xc], eax
mov dword [r11 + rdx*4], ecx
jne 0x140001060
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.rc4_key_or_len_is_0__return_
add rsp, 0x20
pop rdi
jmp 0x1400017ac
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x1400017e6
call fcn.140002dd8
mov dword [rax], 0x16
call fcn.140002d70
or eax, 0xffffffff
jmp 0x140001850
lea rdi, [rsp + 0x48]
call fcn.140001c0c
lea rdx, [rax + 0x30]
mov ecx, 1
call fcn.140001d80
nop
call fcn.140001c0c
lea rcx, [rax + 0x30]
call fcn.140001e20
mov ebx, eax
call fcn.140001c0c
mov r9, rdi
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
lea rcx, [rax + 0x30]
call fcn.140002114
mov edi, eax
call fcn.140001c0c
lea rdx, [rax + 0x30]
mov ecx, ebx
call fcn.140001ef4
nop
call fcn.140001c0c
lea rdx, [rax + 0x30]
mov ecx, 1
call fcn.140001e00
mov eax, edi
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140001190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x14000124f
mov r11d, r8d
nop word [rax + rax]
mov eax, dword [r9 + 0x400]
inc eax
and eax, 0x800000ff
jge 0x1400011c9
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
mov dword [r9 + 0x400], eax
mov eax, dword [r9 + r8*4]
add eax, dword [r9 + 0x404]
and eax, 0x800000ff
jge 0x1400011ee
dec eax
or eax, 0xffffff00
inc eax
mov dword [r9 + 0x404], eax
movzx edx, byte [r9 + r8*4]
cdqe
mov ecx, dword [r9 + rax*4]
mov dword [r9 + r8*4], ecx
movsxd rax, dword [r9 + 0x404]
mov dword [r9 + rax*4], edx
movsxd rax, dword [r9 + 0x404]
movsxd rcx, dword [r9 + 0x400]
mov edx, dword [r9 + rax*4]
add edx, dword [r9 + rcx*4]
and edx, 0x800000ff
jge 0x140001237
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
inc r10
movzx ecx, byte [r9 + rax*4]
xor byte [r10 - 1], cl
dec r11
jne 0x1400011b0
repz ret

Function at 0x140001300
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push r12
push r13
push r14
mov rax, qword gs:[0x30]
xor r8d, r8d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov r11, qword [rcx + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
add rcx, r11
mov r13d, dword [rcx + 0x1c]
mov ebx, dword [rcx + 0x20]
mov r10d, dword [rcx + 0x24]
mov r12d, dword [rcx + 0x14]
mov r14d, dword [rcx + 0x18]
add r13, r11
add rbx, r11
add r10, r11
test r12, r12
je 0x1400013c7
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
nop dword [rax]
mov eax, dword [r13 + r8*4]
test eax, eax
je 0x1400013aa
xor edx, edx
mov ebp, eax
test r14d, r14d
je 0x1400013aa
movzx eax, word [r10 + rdx*2]
cmp rax, r8
jne 0x1400013a2
mov esi, dword [rbx + rdx*4]
lea rdi, [0x14000c658]
mov ecx, 0xf
add rsi, r11
repe cmpsb byte [rsi], byte [rdi]
je 0x1400013b4
inc rdx
cmp rdx, r14
jb 0x140001382
inc r8
cmp r8, r12
jb 0x140001370
jmp 0x1400013b8
lea rax, [r11 + rbp]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
pop r14
pop r13
pop r12
ret
Function at 0x140003338
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400031a8

Function at 0x1400066e0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14000e550]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140004068
xor ebx, ebx
cmp qword [0x14000fdb8], rbx
mov rdi, rax
jne 0x1400067f3
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400068ca
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400068ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14000fdb8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14000fdc0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14000fdc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14000fdd8], rax
test rax, rax
je 0x1400067ea
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14000fdd0], rax
jmp 0x1400067fa
mov rax, qword [0x14000fdd0]
jmp 0x140006801
mov rax, qword [0x14000fdd0]
mov r11, qword [0x14000fdd8]
cmp rax, rdi
je 0x140006868
cmp r11, rdi
je 0x140006868
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14000fdd8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140006868
test rax, rax
je 0x140006868
call rsi
test rax, rax
je 0x140006862
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140006862
test byte [rsp + 0x40], 1
jne 0x140006868
bts ebp, 0x15
jmp 0x1400068a8
mov rcx, qword [0x14000fdc0]
cmp rcx, rdi
je 0x1400068a8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400068a8
call rax
mov rbx, rax
test rax, rax
je 0x1400068a8
mov rcx, qword [0x14000fdc8]
cmp rcx, rdi
je 0x1400068a8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400068a8
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14000fdb8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400068ca
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1400068cc
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140005e60
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400087df
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14000e550]
jne 0x140005e7a
rol rcx, 0x10
test cx, 0xffff
jne 0x140005e76
repz ret
ror rcx, 0x10
jmp 0x140008738
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14000fe90]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14000ff88]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400087bd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14000fe90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400087df
mov rax, qword [rsp + 0x88]
mov qword [0x14000ff88], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14000ff28], rax
mov rax, qword [0x14000ff88]
mov qword [0x14000fe00], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14000ff10], rax
mov dword [0x14000fdf0], 0xc0000409
mov dword [0x14000fdf4], 1
mov rax, qword [0x14000e550]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14000e558]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14000fe88], eax
mov ecx, 1
call fcn.140005e80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000bc60]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14000fe88], 0
jne 0x140008866
mov ecx, 1
call fcn.140005e80
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400028b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140002927
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002927
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140002914
cmp rbx, rcx
jae 0x140002927
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400028ff
cmp rbx, rcx
jae 0x140002927
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x140002929
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140003c9c
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x14012bd38]
xor rax, rsp
mov qword [rsp + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor ebx, ebx
cmp dword [rsp + 0x30], 2
jl 0x140003ce8
mov rcx, qword [rax + 8]
lea rdx, str.runas
call fcn.1400b7028
test eax, eax
je 0x140003d2c
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, str.runas
mov dword [rsp + 0x28], 1
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta bl
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400b0010
add rsp, 0x260
pop rbx
ret