joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404d2150
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
jmp 0x1404d2164
push rdi
jmp 0x1404d2172
sub rsp, 0x20
jmp 0x1404d217b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
mov rbx, rax
cmc
cmp bpl, r14b
test rax, rax
jmp 0x1404d2192
je 0x1404d2267
mov rbp, rax
cmp word [rax], si
je 0x1404d21e7
or rax, 0xffffffffffffffff
jmp 0x1404d21ad
inc rax
jmp 0x1404d21b8
cmp word [rbp + rax*2], si
jmp 0x1404d21c2
jne 0x1404d21ad
lea rbp, [rbp + rax*2]
cmc
add rbp, 2
cmp cl, 0x6f
cmp r14b, dil
cmp word [rbp], si
jmp 0x1404d21e1
jne 0x1404d21a4
sub rbp, rbx
movsx cx, r9b
cmp dl, 0x9f
not rcx
add rbp, 2
adc ch, 0
sar rcx, cl
sar rbp, 1
rol cx, cl
add rbp, rbp
movsx rcx, di
movzx ecx, sp
mov rcx, rbp
jmp 0x1404d2217
call fcn.1404c22ba
mov rdi, rax
clc
cmp cx, cx
test rax, rax
jmp 0x1404d222b
je 0x1404d2252
mov r8, rbp
setl dh
mov rdx, rbx
xchg rcx, rcx
movsx cx, bpl
mov rcx, rax
jmp 0x1404d224a
call fcn.14049c53b
mov rsi, rdi
xor ecx, ecx
call fcn.1404c222f
mov rcx, rbx
jmp 0x1404d2261
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
shr bpl, 0x81
btr ebp, eax
mov rax, rsi
movsx edi, r11w
cmp dx, r9w
mov rsi, qword [rsp + 0x40]
rcl edi, cl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
mov dil, 0xad
xchg dil, dil
pop rdi
jmp 0x1404d229a
ret
Function at 0x1404d5216
Capabilities:
Encrypt data using rc4 prga
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx eax, r13w
cmovg rax, rax
nop
mov qword [rsp + 0x18], rbp
cmove ax, si
push rsi
cwde
push rdi
lahf
not al
movzx rax, r13w
push r14
movzx eax, r11w
mov eax, 0x1450
call fcn.140441812
sub rsp, rax
inc si
mov rax, qword [0x1400b7288]
xor rax, rsp
bt r14d, r8d
inc r14w
mov qword [rsp + 0x1440], rax
dec r10w
movsxd r10, edx
sar r14w, 0x8d
xchg r14w, ax
sbb dh, 0x26
mov rdi, rcx
mov rax, r10
bts ebp, r9d
sub bp, 0x1564
rcr ch, cl
mov ebp, r9d
bsf edx, r9d
sar rdx, cl
sar rax, 6
lea rcx, [0x1400ba940]
and r10d, 0x3f
inc r14b
and r14b, r11b
add rbp, r8
shr dl, 0x9d
mov rsi, r8
shr dl, cl
sbb dh, 0xff
xchg dx, dx
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
clc
sbb r14b, bpl
btr r14, 0x5e
mov r14, qword [rax + rdx*8 + 0x28]
xor eax, eax
mov qword [rdi], rax
test r13b, cl
mov dword [rdi + 8], eax
test r11w, 0x3be6
jmp 0x1404d52e6
cmp r8, rbp
jae 0x1404d53e6
lea rbx, [rsp + 0x40]
cmc
test r12b, 0xc4
cmp rsi, rbp
jmp 0x1404d5301
jae 0x1404d535c
mov al, byte [rsi]
jmp 0x1404d530e
inc rsi
cmp sil, 0x12
cmp al, 0xa
jmp 0x1404d531c
jne 0x1404d533a
inc dword [rdi + 8]
jmp 0x1404d532a
mov byte [rbx], 0xd
jmp 0x1404d5332
inc rbx
jmp 0x1404d533a
mov byte [rbx], al
movzx eax, r10w
inc rbx
sal al, 0x26
lea rax, [rsp + 0x143f]
cmp rbx, rax
jmp 0x1404d5356
jb 0x1404d52f9
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
sal cx, 0x6b
sub ebx, eax
not r9b
xchg r8b, cl
cdq
lea r9, [rsp + 0x30]
xchg ch, dl
mov r8d, ebx
lea rdx, [rsp + 0x40]
not cx
movsxd rcx, r13d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d5399
je 0x1404d53d1
mov eax, dword [rsp + 0x30]
cmp rdi, rdi
cmp r13d, 0x766f213f
add dword [rdi + 4], eax
stc
cmp eax, ebx
jmp 0x1404d53b8
jb 0x1404d53e6
cmp rsi, rbp
jmp 0x1404d53c6
jb 0x1404d52ef
jmp 0x1404d53e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
xadd ch, cl
movzx cx, bpl
bt ax, 0xdb
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test spl, 0xed
xor rcx, rsp
call fcn.140498899
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
jmp 0x1404d5411
mov rbp, qword [r11 + 0x30]
bswap si
mov rsp, r11
mov esi, 0x15ba03b9
not si
pop r14
movsx edi, dx
movzx di, sil
pop rdi
movsxd rsi, edi
pop rsi
jmp 0x1404d5437
ret
Function at 0x1404d5438
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx ax, ch
mov qword [rsp + 0x18], rbp
movzx rax, cx
movzx eax, cx
cdqe
push rsi
mov ah, al
push rdi
movsxd rax, r9d
cwde
mov al, 0xcd
push r14
not ax
mov eax, 0x1450
jmp 0x1404d5468
call fcn.140441812
sub rsp, rax
sub r14w, r9w
cmc
mov rax, qword [0x1400b7288]
rcl dil, 0x4f
xor rax, rsp
rol rbp, cl
mov qword [rsp + 0x1440], rax
sbb bpl, 0x7b
mov bpl, al
movsxd r10, edx
bsf r14w, dx
btr di, bp
mov rdi, rcx
mov rax, r10
bsr si, ax
mov ebp, r9d
sar rax, 6
lea rcx, [0x1400ba940]
shld rdx, r15, 0xd9
dec rsi
rcl sil, 0x8f
and r10d, 0x3f
movzx edx, sp
ror sil, cl
lea rbp, [rbp + r8]
dec rsi
mov rsi, r8
mov rax, qword [rcx + rax*8]
bt r14w, di
shrd r14, rbp, 0xc6
lea rdx, [r10 + r10*8]
bt r14d, 0x75
mov r14, qword [rax + rdx*8 + 0x28]
sub eax, eax
test r10w, bx
mov qword [rdi], rax
clc
cmp r10b, r15b
test r12d, ebp
mov dword [rdi + 8], eax
cmc
test sil, 0x54
cmp r14b, 0xa9
cmp r8, rbp
jmp 0x1404d551a
jae 0x1404d5626
lea rbx, [rsp + 0x40]
cmp r13d, ecx
jmp 0x1404d552d
cmp rsi, rbp
jae 0x1404d5595
movzx eax, word [rsi]
stc
test sil, 0xbe
add rsi, 2
stc
cmp ax, 0xa
jne 0x1404d556e
add dword [rdi + 8], 2
bswap cx
bts rcx, r8
mov ecx, 0xd
jmp 0x1404d5562
mov word [rbx], cx
add rbx, 2
test bpl, dl
clc
stc
mov word [rbx], ax
lahf
btc rax, 0x18
add rbx, 2
btc ax, 0x1a
lea rax, [rsp + 0x143e]
clc
cmp r13, rbx
cmp rbx, rax
jb 0x1404d552d
and qword [rsp + 0x20], 0
cwde
sar r8, cl
lea rax, [rsp + 0x40]
sub rbx, rax
lea r9, [rsp + 0x30]
bsr edx, r14d
clc
and dl, bpl
sar rbx, 1
xor cl, r12b
lea rdx, [rsp + 0x40]
sal ch, cl
add ebx, ebx
not cl
mov r8w, r13w
mov rcx, r14
mov r8b, r15b
bswap r8w
movsx r8, ax
mov r8d, ebx
jmp 0x1404d55df
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404d55ec
je 0x1404d5616
mov eax, dword [rsp + 0x30]
test bpl, 0x9b
add dword [rdi + 4], eax
cmp sil, dil
cmp eax, ebx
jb 0x1404d5626
cmp rsi, rbp
jb 0x1404d5520
jmp 0x1404d5626
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
xor ch, 0xfc
bswap eax
dec cx
mov rax, rdi
mov ecx, ebx
inc ecx
mov rcx, qword [rsp + 0x1440]
cmc
xor rcx, rsp
call fcn.140498899
lea r11, [rsp + 0x1450]
setge dil
movzx r14, bp
movsxd rsi, eax
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movsx r14w, r10b
sets sil
bswap esi
mov rsp, r11
jmp 0x1404d566f
pop r14
movsx di, dil
cmovs di, r12w
movsxd rdi, r14d
pop rdi
not sil
pop rsi
jmp 0x1404d5688
ret
Function at 0x1404d8e93
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
add dl, r8b
and r9d, r11d
sub rsp, 0x20
add r8d, 0x37dc5026
movsx r9w, sil
shld r9d, ebp, 0xef
mov rbx, rcx
cdq
clc
btr r9d, 0x6d
lea r9, [0x1400c8e90]
adc r8b, r8b
shrd r8d, esi, 0xa9
bt edx, 0x7e
xor ecx, ecx
movzx r8, bp
mov rdx, 0x5ea220c4
lea r8, [0x1400c8e88]
movsxd rdx, ebx
lea rdx, [0x1400cfb70]
jmp 0x1404d8ef0
call fcn.1404d91ad
test rax, rax
jmp 0x1404d8efd
je 0x1404d8f28
mov rcx, rbx
xor bh, 0xdb
btc bx, bp
bsr bx, r13w
add rsp, 0x20
xchg bl, bh
movsx ebx, cx
pop rbx
jmp switch.0x1404d8f21
jmp qword [case.0x140441720.0]
add rsp, 0x20
sete bl
mov bl, 0x57
pop rbx
jmp 0x1404d8f37
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1404d8fd4
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub bl, 0x27
sal r8b, cl
sub rsp, 0x20
mov r9b, 0x5c
cdq
bswap r8d
mov ebx, ecx
cmovge dx, sp
cwd
movsx cx, bh
lea r9, [0x1400c8ea0]
jmp 0x1404d8fff
mov ecx, 2
movsx dx, dil
movzx rdx, ax
lea r8, [0x1400c8e98]
cmove rdx, rdx
lea rdx, [0x1400cf758]
call fcn.1404d91ad
mov ecx, ebx
test bpl, r12b
test rax, rax
jmp 0x1404d9031
je 0x1404d9048
add rsp, 0x20
pop rbx
jmp 0x1404d9041
push qword [0x1400b8d90]
ret
add rsp, 0x20
setae bl
cmovs bx, r15w
not bh
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1404d905e
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
shl r9, cl
ror r8b, 0xf4
push rdi
sub rsp, 0x20
movzx r8w, spl
setl r9b
mov rbx, rdx
lea r9, [0x1400c8ea8]
mov edi, ecx
cmovo ecx, r10d
lea rdx, [0x1400cf748]
mov ecx, 3
lea r8, [0x1400c8ea0]
call fcn.1404d91ad
mov rdx, rbx
add cx, si
rol cl, 0x68
mov ecx, edi
test rax, rax
jmp 0x1404d90b3
je 0x1404d90c4
call qword [case.0x140441720.0]
jmp 0x1404d90ca
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
movsxd rdi, edx
sbb di, 0x2614
add rsp, 0x20
movsxd rdi, r13d
bswap di
movsx di, r13b
pop rdi
jmp 0x1404d90ec
ret
Function at 0x1404d9a63
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
clc
mov qword [rsp + 0x18], rsi
cmp r15w, r15w
ror sil, cl
bts si, r9w
push rdi
movzx si, r15b
sub dil, spl
sub rsp, 0x30
movzx rsi, r13w
cmc
movsxd rdi, r8d
mov r8d, ecx
bts esi, ecx
seta sil
test rsi, 0xa9117fc
mov rsi, rdx
clc
cmp rbx, 0x458d5262
test ecx, 0xfffff3ff
jmp 0x1404d9abb
jne 0x1404d9acd
cmp ecx, 0xc00
jne 0x1404d9c2c
test rsi, rsi
jne 0x1404d9ae3
test edi, edi
jmp 0x1404d9add
jg 0x1404d9c2c
test edi, edi
jmp 0x1404d9aea
js 0x1404d9c2c
sub r9d, r9d
bsr dx, r10w
xor ecx, 0x52863d45
rcr rdx, cl
lea rbp, reloc.d2d1.dll_Ordinal_1
sub ecx, 0xbde64ea
bswap r10
mov r10d, 0xe3
lahf
bt dx, r14w
lea eax, [r10 + r9]
cdq
btc cx, 3
sub eax, edx
mov edx, r8d
sar eax, 1
movsxd rcx, eax
jmp 0x1404d9b37
shl rcx, 4
clc
stc
cmp r11b, bpl
sub edx, dword [rcx + rbp]
je 0x1404d9b9c
test edx, edx
xchg ch, ch
lea ecx, [rax - 1]
jmp 0x1404d9b55
cmovns ecx, r10d
mov r10w, 0xd95
setns r10b
inc eax
shr r10d, cl
sal r10b, cl
test edx, edx
movsx r10w, sil
bswap r10d
movsxd r10, r15d
mov r10d, ecx
jmp 0x1404d9b7f
cmovns r9d, eax
cmp r10w, r15w
cmp r9d, ecx
jmp 0x1404d9b8f
jle 0x1404d9b1d
or eax, 0xffffffff
cmp rdx, r11
clc
test eax, eax
js 0x1404d9c2c
cdqe
mov edx, 0x55
xchg cl, cl
movzx cx, dil
add rax, rax
movzx ecx, dx
mov rbp, qword [rbp + rax*8 + 8]
movzx rcx, r10w
mov rcx, rbp
call fcn.140258704
mov rbx, rax
cmp spl, r14b
jmp 0x1404d9bd9
test edi, edi
jmp 0x1404d9be0
jle 0x1404d9c1f
cmp ebx, edi
jmp 0x1404d9bed
jge 0x1404d9c2c
mov rdx, rdi
xchg rcx, rcx
movzx r8w, bl
movsx r8d, dx
mov r8, rbp
mov rcx, rsi
jmp 0x1404d9c0d
call fcn.1404c2f2d
test eax, eax
jmp 0x1404d9c19
jne 0x1404d9c65
lea eax, [rbx + 1]
jmp 0x1404d9c27
jmp 0x1404d9c3a
xor eax, eax
rcl sil, cl
btr ebp, r8d
bsf bp, r14w
mov rbx, qword [rsp + 0x40]
sbb bp, r11w
mov rbp, qword [rsp + 0x48]
mov dil, r8b
shld rdi, r13, 0x1b
mov rsi, qword [rsp + 0x50]
adc dil, 0x71
add rsp, 0x30
xchg dil, dil
movsxd rdi, r13d
pop rdi
ret
and qword [rsp + 0x20], 0
xor r9d, r9d
test rbx, 0xebf7715
stc
xor r8d, r8d
cmp bpl, bl
clc
sub edx, edx
clc
sub ecx, ecx
call fcn.1404aefbc
int3
Function at 0x1404dd1db
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
cmovs r10d, edx
sal r10w, 0xd7
xor r10, 0x288a6be7
sub rsp, 0x30
bts r10w, r14w
sub eax, eax
mov r10d, ecx
cmc
test rdx, rdx
jmp 0x1404dd204
jne 0x1404dd235
call fcn.1404ae2e2
mov ebx, 0x16
jmp 0x1404dd219
mov dword [rax], ebx
jmp 0x1404dd220
call fcn.1404aef46
mov eax, ebx
movsx ebx, bx
add rsp, 0x30
pop rbx
jmp 0x1404dd234
ret
test r8, r8
jmp 0x1404dd23d
je 0x1404dd20a
movzx ecx, byte [rsp + 0x60]
test r8b, 0xf
stc
mov word [rdx], ax
lea rax, [rcx + 1]
cmp r15b, r15b
cmc
clc
cmp r8, rax
jmp 0x1404dd261
ja 0x1404dd27b
call fcn.1404ae2e2
mov ebx, 0x22
jmp 0x1404dd276
jmp 0x1404dd219
lea eax, [r9 - 2]
and rbx, r10
or bl, 0x14
mov ebx, 0x22
cmp eax, ebx
ja 0x1404dd20a
mov byte [rsp + 0x60], cl
dec ecx
mov ecx, r10d
sub ebx, 0x14422895
add rsp, 0x30
pop rbx
jmp 0x1404dd2ab
jmp 0x1404dd2b0
mov qword [rsp + 8], rbx
not r11b
ror bl, 0x73
mov qword [rsp + 0x10], rbp
rol bp, cl
not r11b
movzx r10d, r13w
mov qword [rsp + 0x18], rsi
push rdi
bts di, bp
shrd bp, sp, 0x29
push r14
push r15
adc ebp, r8d
btr rdi, 0x13
sar r10w, cl
sub rsp, 0x20
movsx edi, r10w
sub rdi, 0x1fce3670
add r10w, r9w
xor r15d, r15d
bsr r11w, r14w
ror rdi, 0xe0
mov ebp, r9d
adc rbx, 0x1ed66016
or rbx, 0x69c907d7
mov rdi, r8
and r11d, eax
mov r11, rdx
mov r10, rdx
sal rbx, 0xcb
btc bx, 0xc0
cmp dx, 0x7d7
mov ebx, r15d
cmp byte [rsp + 0x60], r15b
jmp 0x1404dd340
je 0x1404dd372
lea eax, [r15 + 0x2d]
bsf bx, r13w
neg ecx
bswap si
xchg sil, bl
mov word [rdx], ax
clc
rcl r9b, cl
cmc
lea ebx, [rax - 0x2c]
movzx r10w, r15b
dec r9b
lea r10, [rdx + 2]
sbb al, r9b
cmc
mov r8, r10
xor edx, edx
lea rsi, [r10 + 2]
cmp dil, bl
and al, r9b
mov eax, ecx
mov r9, r10
shr r14w, 0xf
movsxd r14, r8d
div ebp
add r14, 0x1a6313bc
mov ecx, eax
cmp edx, 9
movsx ax, dl
mov eax, 0x57
lea r14d, [rax - 0x27]
jmp 0x1404dd3ae
cmovbe ax, r14w
inc rbx
add ax, dx
cmp r14w, 0x7aa8
mov word [r10], ax
cmp sil, r13b
test spl, 0x43
test ecx, ecx
jmp 0x1404dd3d1
je 0x1404dd3e3
mov r10, rsi
cmp rbx, rdi
jb 0x1404dd375
cmp rbx, rdi
jmp 0x1404dd3eb
jb 0x1404dd421
mov word [r11], r15w
jmp 0x1404dd3fa
call fcn.1404ae2e2
mov ebx, 0x22
jmp 0x1404dd409
mov dword [rax], ebx
jmp 0x1404dd410
call fcn.1404aef46
mov eax, ebx
jmp 0x1404dd41c
jmp 0x1404dd476
mov word [rsi], r15w
xor al, r13b
movzx eax, word [r8]
sal cl, cl
xchg cx, cx
ror rcx, 0x8c
movzx ecx, word [r9]
test r10b, r10b
cmp r14b, 0xbd
clc
mov word [r9], ax
stc
sub r9, 2
jmp 0x1404dd453
mov word [r8], cx
test r11b, bl
add r8, 2
stc
clc
cmp r8, r9
jmp 0x1404dd468
jb 0x1404dd428
xor eax, eax
movsxd r15, ecx
dec dil
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add r15w, 0x2c9b
sub r15b, bl
mov rsi, qword [rsp + 0x50]
jmp 0x1404dd493
add rsp, 0x20
movsx r14d, r8w
movsx r15w, dl
mov r14w, 0x5757
pop r15
movzx r14w, dil
pop r14
pop rdi
jmp 0x1404dd4b4
ret
Function at 0x180002320
Capabilities:
Access peb ldr_data
Get kernel32 base address
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
mov rax, qword gs:[0x30]
xor r9d, r9d
mov ebx, ecx
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx]
mov rdi, qword [rax + 0x30]
movsxd rax, dword [rdi + 0x3c]
mov edx, dword [rax + rdi + 0x88]
add rdx, rdi
mov r13d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x20]
mov r11d, dword [rdx + 0x24]
mov r12d, dword [rdx + 0x14]
mov r14d, dword [rdx + 0x18]
add r13, rdi
add rsi, rdi
add r11, rdi
test r12, r12
je 0x1800023f2
mov qword [rsp + 0x20], rbp
nop word [rax + rax]
mov eax, dword [r13 + r9*4]
test eax, eax
je 0x1800023de
xor r8d, r8d
mov ebp, eax
test r14d, r14d
je 0x1800023de
movzx eax, word [r11 + r8*2]
cmp rax, r9
jne 0x1800023d6
mov edx, dword [rsi + r8*4]
xor ecx, ecx
add rdx, rdi
movzx eax, byte [rdx]
test al, al
je 0x1800023d2
nop dword [rax]
ror ecx, 7
movsx eax, al
inc rdx
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1800023c0
cmp ebx, ecx
je 0x1800023e8
inc r8
cmp r8, r14
jb 0x1800023a3
inc r9
cmp r9, r12
jb 0x180002390
jmp 0x1800023ed
movzx eax, byte [rdi + rbp + 4]
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r14
pop r13
pop r12
ret
Function at 0x1800024b0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x3c8]
sub rsp, 0x4c0
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov qword [rbp - 0x68], 0xf
xor ebx, ebx
mov qword [rbp - 0x70], rbx
mov byte [rbp - 0x80], bl
lea r8d, [rbx + 0x22]
lea rdx, [0x18001cc90]
lea rcx, [rbp - 0x80]
call fcn.180001530
nop
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.180002190
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.180001050
nop
mov qword [rbp + 0x3b0], rbx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.Anonymous
repne scasb al, byte [rdi]
not rcx
lea edx, [rcx - 1]
lea rcx, [rbp - 0x50]
call fcn.180005930
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.180005ac0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x40]
call fcn.180002410
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
mov ecx, 0x14044ae
call fcn.180002320
mov ecx, eax
call fcn.180005b90
mov qword [rbp + 0x3d0], rbx
mov rcx, qword [rsp + 0x40]
mov qword [rbp + 0x3d8], rcx
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x3d8]
xor r8d, r8d
lea rdx, [rbp + 0x3d0]
mov rcx, rdi
call fcn.180005ba1
mov ecx, 0x1130814d
call fcn.180002320
mov ecx, eax
call fcn.180005b90
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r8, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x40]
mov rdx, qword [rbp + 0x3d0]
mov rcx, rdi
call fcn.180005ba1
mov ecx, 0x93ec9d3d
call fcn.180002320
mov ecx, eax
call fcn.180005b90
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8, qword [rbp + 0x3d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
cmp qword [rsp + 0x48], 0x10
jb 0x180002653
mov rcx, qword [rsp + 0x30]
call fcn.1800071d0
mov qword [rsp + 0x48], 0xf
mov qword [rsp + 0x40], rbx
mov byte [rsp + 0x30], 0
cmp qword [rsp + 0x70], 0x10
jb 0x180002678
mov rcx, qword [rsp + 0x58]
call fcn.1800071d0
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x58], 0
cmp qword [rbp - 0x68], 0x10
jb 0x18000269b
mov rcx, qword [rbp - 0x80]
call fcn.1800071d0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180004910
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, rcx
cmp qword [rcx + 0x80], 0
je 0x180004b49
cmp byte [rcx + 0x89], 0
je 0x180004b49
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180004b1d
mov edx, 0xf
mov qword [rbp - 0x10], rdx
mov byte [rbp - 0x28], 0
xor ecx, ecx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], 8
lea rax, [rbp - 0x28]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], cl
xor r12d, r12d
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
nop word [rax + rax]
lea rdx, [rbp - 0x28]
cmp r9, 0x10
cmovae rdx, r10
lea r8, [rbp - 0x28]
cmovae r8, r10
mov rcx, qword [rdi + 0x80]
mov r10, qword [rcx]
mov rax, qword [rbp - 0x18]
lea r9, [rdx + rax]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x8c]
call qword [r10 + 0x30]
test eax, eax
je 0x1800049e8
dec eax
jne 0x180004ae7
jmp 0x1800049ef
mov byte [rdi + 0x89], r12b
lea rax, [rbp - 0x28]
mov r10, qword [rbp - 0x28]
mov r9, qword [rbp - 0x10]
cmp r9, 0x10
cmovae rax, r10
mov rbx, qword [rbp + 0x20]
sub rbx, rax
je 0x180004a3d
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov r9, qword [rdi + 0x98]
mov r8, rbx
mov edx, 1
call fcn.180007fb0
cmp rbx, rax
jne 0x180004b0d
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
cmp byte [rdi + 0x89], r12b
je 0x180004b3b
test rbx, rbx
jne 0x1800049a0
or rax, 0xffffffffffffffff
mov r8, qword [rbp - 0x18]
sub rax, r8
cmp rax, 8
jbe 0x180004b2e
lea rbx, [r8 + 8]
cmp rbx, 0xfffffffffffffffe
ja 0x180004b21
cmp r9, rbx
jae 0x180004a91
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.180001840
mov r9, qword [rbp - 0x10]
mov r10, qword [rbp - 0x28]
jmp 0x180004aae
test rbx, rbx
jne 0x180004ab7
mov qword [rbp - 0x18], r12
lea rax, [rbp - 0x28]
cmp r9, 0x10
cmovae rax, r10
mov byte [rax], r12b
jmp 0x18000498b
test rbx, rbx
je 0x1800049a0
lea rcx, [rbp - 0x28]
cmp r9, 0x10
cmovae rcx, r10
mov rax, qword [rbp - 0x18]
xor edx, edx
mov qword [rcx + rax], rdx
mov qword [rbp - 0x18], rbx
lea rax, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rax, qword [rbp - 0x28]
mov byte [rax + rbx], dl
jmp 0x18000498b
sub eax, 2
je 0x180004b00
cmp qword [rbp - 0x10], 0x10
jb 0x180004b1d
mov rcx, qword [rbp - 0x28]
call fcn.1800071d0
xor al, al
jmp 0x180004b4b
cmp qword [rbp - 0x10], 0x10
jb 0x180004b49
mov rcx, qword [rbp - 0x28]
jmp 0x180004b44
cmp qword [rbp - 0x10], 0x10
jb 0x180004b1d
mov rcx, qword [rbp - 0x28]
call fcn.1800071d0
xor al, al
jmp 0x180004b4b
lea rcx, str.string_too_long
call fcn.180005bdc
int3
lea rcx, str.string_too_long
call fcn.180005bdc
nop
cmp r9, 0x10
jb 0x180004b49
mov rcx, r10
call fcn.1800071d0
mov al, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x1800154f8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180022410]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000c778
xor ebx, ebx
cmp qword [0x180023a08], rbx
mov rdi, rax
jne 0x18001560b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1800156e2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800156e2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180023a08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180023a10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180023a18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180023a28], rax
test rax, rax
je 0x180015602
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180023a20], rax
jmp 0x180015612
mov rax, qword [0x180023a20]
jmp 0x180015619
mov rax, qword [0x180023a20]
mov r11, qword [0x180023a28]
cmp rax, rdi
je 0x180015680
cmp r11, rdi
je 0x180015680
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180023a28]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180015680
test rax, rax
je 0x180015680
call rsi
test rax, rax
je 0x18001567a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18001567a
test byte [rsp + 0x40], 1
jne 0x180015680
bts ebp, 0x15
jmp 0x1800156c0
mov rcx, qword [0x180023a10]
cmp rcx, rdi
je 0x1800156c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800156c0
call rax
mov rbx, rax
test rax, rax
je 0x1800156c0
mov rcx, qword [0x180023a18]
cmp rcx, rdi
je 0x1800156c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800156c0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180023a08]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800156e2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1800156e4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180010c70
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret