joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fce0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor r14d, r14d
mov rdi, rdx
mov r13, rcx
mov edx, dword [rcx]
mov dword [rsp + 0x38], 0x7d0
jmp 0x43fd08
mov r14d, ebx
lea ebx, [r14 + 1]
cmp ebx, edx
jge 0x43fee1
mov rax, qword [rdi]
movsxd rsi, ebx
lea rbp, [rsi*8]
mov rcx, qword [rax + rsi*8]
cmp byte [rcx], 0x40
jne 0x43fd05
sub dword [rsp + 0x38], 1
je 0x43ff3b
lea rdx, [0x004cb7e9]
add rcx, 1
call sub.msvcrt.dll_fopen
test rax, rax
mov r12, rax
je 0x43fed8
xor edx, edx
mov r8d, 2
mov rcx, rax
call sub.msvcrt.dll_fseek
cmp eax, 0xffffffff
je 0x43fed0
mov rcx, r12
call sub.msvcrt.dll_ftell
movsxd r15, eax
cmp r15d, 0xffffffff
je 0x43fed0
xor r8d, r8d
xor edx, edx
mov rcx, r12
call sub.msvcrt.dll_fseek
cmp eax, 0xffffffff
je 0x43fed0
lea rcx, [r15 + 1]
call fcn.004386c0
mov edx, 1
mov r9, r12
mov r8, r15
mov rcx, rax
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll_fread
cmp r15, rax
mov rdx, rax
je 0x43fdd9
mov rcx, r12
mov qword [rsp + 0x28], rax
call sub.msvcrt.dll_ferror
test eax, eax
mov rdx, qword [rsp + 0x28]
jne 0x43fed0
mov rax, qword [rsp + 0x20]
mov byte [rax + rdx], 0
movzx eax, byte [rax]
test al, al
je 0x43fe16
lea rcx, [0x004cacc0]
test byte [rcx + rax*2], 0x40
je 0x43fef2
mov rax, qword [rsp + 0x20]
jmp 0x43fe0b
test byte [rcx + rdx*2], 0x40
je 0x43fef2
add rax, 1
movzx edx, byte [rax]
test dl, dl
jne 0x43fe01
mov ecx, 8
call fcn.004386c0
mov rcx, qword [rdi]
mov qword [rax], 0
mov r15, rax
call fcn.0043f900
xor r10d, r10d
mov qword [rdi], rax
xor r9d, r9d
xor r8d, r8d
movsxd rdx, dword [r13]
mov rcx, rax
mov dword [rsp + 0x3c], r10d
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
lea rdx, [r8 + rdx + 1]
shl rdx, 3
call fcn.00438740
mov edx, dword [r13]
mov r8, qword [rsp + 0x28]
mov qword [rdi], rax
sub edx, ebx
add r8, rsi
movsxd rbx, edx
lea rcx, [rax + r8*8]
lea rdx, [rax + rbp + 8]
lea r8, [rbx*8]
mov ebx, r14d
call sub.msvcrt.dll_memmove
mov r9, qword [rsp + 0x30]
mov rcx, rbp
add rcx, qword [rdi]
mov rdx, r15
mov r8, r9
call sub.msvcrt.dll_memcpy
mov eax, dword [r13]
mov r10d, dword [rsp + 0x3c]
mov rcx, r15
lea eax, [r10 + rax - 1]
mov dword [r13], eax
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x20]
call sub.msvcrt.dll_free
nop dword [rax]
mov rcx, r12
call sub.msvcrt.dll_fclose
mov edx, dword [r13]
jmp 0x43fd05
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x20]
call fcn.0043fa10
mov rcx, qword [rdi]
mov rdx, qword [rax]
mov r15, rax
mov qword [rsp + 0x28], rdx
call fcn.0043f900
mov rdx, qword [rsp + 0x28]
mov qword [rdi], rax
test rdx, rdx
je 0x43ff61
xor r8d, r8d
nop
add r8, 1
cmp qword [r15 + r8*8], 0
lea r9, [r8*8]
jne 0x43ff20
mov r10d, r8d
jmp 0x43fe3e
mov rbx, qword [rax]
call qword [sym.imp.msvcrt.dll___iob_func]
lea rdx, str._s:_error:_too_many___files_encountered_n
lea rcx, [rax + 0x60]
mov r8, rbx
call fcn.0043f8d0
mov ecx, 1
call fcn.0044fe30
xor r10d, r10d
xor r9d, r9d
xor r8d, r8d
jmp 0x43fe3e
Function at 0x44fcb0
Capabilities:
Hash data with md5

Disassembly:
push rsi
push rbx
sub rsp, 0xc8
lea rbx, [rsp + 0x20]
mov rsi, r8
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov r8, rbx
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
call fcn.0044fb20
mov rdx, rsi
mov rcx, rbx
call fcn.0044fa70
add rsp, 0xc8
pop rbx
pop rsi
ret

Function at 0x44fd20
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push r13
mov eax, 0x1118
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.00459890
sub rsp, rax
mov ebp, 0x1000
lea rsi, [rsp + 0xc0]
lea r12, [rsp + 0x20]
mov rdi, rcx
mov r13, rdx
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
xor ebx, ebx
jmp 0x44fd95
test rax, rax
je 0x44fdb8
lea rcx, [rsi + rbx]
mov r8, rbp
mov r9, rdi
sub r8, rbx
mov edx, 1
call sub.msvcrt.dll_fread
add rbx, rax
cmp rbx, 0xfff
jbe 0x44fd90
test rax, rax
je 0x44fdd0
mov r8, r12
mov edx, 0x1000
mov rcx, rsi
call fcn.0044f1e0
jmp 0x44fd85
mov rcx, rdi
call sub.msvcrt.dll_ferror
test eax, eax
mov edi, eax
jne 0x44fe05
test rbx, rbx
lea rbp, [rsp + 0x20]
jne 0x44fe0c
mov rdx, r13
mov rcx, rbp
call fcn.0044fa70
mov eax, edi
add rsp, 0x1118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov edi, 1
jmp 0x44fdf3
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.0044fb20
jmp 0x44fde8
Function at 0x458aa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov ecx, dword [0x004dc294]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x458c85
mov rax, qword [0x004dc298]
xor ebx, ebx
nop
mov r9, qword [rax + 8]
cmp rsi, r9
jb 0x458aec
mov rdx, qword [rax + 0x10]
mov edx, dword [rdx + 8]
add r9, rdx
cmp rsi, r9
jb 0x458bc0
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x458ad0
mov rcx, rsi
call fcn.00459600
test rax, rax
mov r12, rax
je 0x458ca9
movsxd rbx, ebx
lea r13, [rsp + 0x30]
lea r14, [rbx + rbx*2]
shl r14, 3
mov rbx, r14
add rbx, qword [0x004dc298]
mov qword [rbx + 0x10], rax
mov dword [rbx], 0
call fcn.00459740
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov rdx, r13
mov qword [rbx + 8], rax
mov rax, qword [0x004dc298]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r14 + 8]
call rbx
test rax, rax
je 0x458c8c
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x458c40
add dword [0x004dc294], 1
mov r8d, 0x30
mov rdx, r13
mov rcx, rsi
call rbx
test rax, rax
je 0x458cb8
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x458bd0
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_memcpy
lea r13, [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x458b7b
cmp eax, 0x40
je 0x458b9b
lea r12, [rsp + 0x2c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r12
call rbx
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x54]
cmp eax, 0x40
je 0x458c27
cmp eax, 4
je 0x458c27
mov r9, r12
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call rbx
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp eax, 0x40
je 0x458b74
add r14, qword [0x004dc298]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov r9, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x458b74
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00458a30
xor ebx, ebx
jmp 0x458af7
mov rax, qword [0x004dc298]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r14 + 8]
call fcn.00458a30
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00458a30
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rsi
mov edx, 0x30
call fcn.00458a30
nop
nop dword [rax]
Function at 0x459290
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004dc860]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004dc840]
test rbx, rbx
je 0x4592e4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4592db
test rsi, rsi
je 0x4592db
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4592c0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004dc860]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x459500
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x459540
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x459537
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x459542
add rax, 0x28
cmp rax, r9
jne 0x459524
xor eax, eax
repz ret

Function at 0x459600
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp word [0x00400000], 0x5a4d
lea rbx, [0x00400000]
mov rsi, rcx
je 0x459624
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
call fcn.004594c0
test eax, eax
je 0x45961b
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.00459500
Function at 0x45d640
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x130
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x45d80e
cmp byte [rbx], 0
je 0x45d7d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x45d7f0
test al, 0x10
je 0x45d7d0
lea rdi, [rsp + 0x20]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
mov rbx, rdi
call sub.msvcrt.dll__fullpath
mov r8d, dword [rbx]
add rbx, 4
lea eax, [r8 - 0x1010101]
not r8d
and eax, r8d
and eax, 0x80808080
je 0x45d69d
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
cmove rbx, rdx
add al, al
sbb rbx, 3
sub rbx, rdi
lea rcx, [rbx + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x45d7ff
lea r9, [rax + 0x244]
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, r9
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0x244], 0
mov r9, rax
je 0x45d730
movzx eax, byte [rsi + rbx + 0x243]
cmp al, 0x2f
je 0x45d730
cmp al, 0x5c
je 0x45d730
mov r8d, 0x5c
mov word [r9 + rbx], r8w
nop dword [rax + rax]
mov rcx, r9
mov eax, dword [rcx]
add rcx, 4
lea edx, [rax - 0x1010101]
not eax
and edx, eax
and edx, 0x80808080
je 0x45d733
mov eax, edx
shr eax, 0x10
test edx, 0x8080
cmove edx, eax
lea rax, [rcx + 2]
cmove rcx, rax
add dl, dl
mov eax, 0x2a
sbb rcx, 3
xor edx, edx
mov word [rcx], ax
mov word [rsi + 0x12c], dx
lea rdx, [rsi + 0x130]
xor ecx, ecx
xor eax, eax
mov qword [rsi + 0x238], 0xffffffffffffffff
mov word [rsi + 0x12e], cx
mov rdi, rdx
mov ecx, 0x20
mov dword [rsi + 0x240], 0
mov dword [rsi + 0x128], 0
rep stosq qword [rdi], rax
mov rax, rsi
mov dword [rdi], 0
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
xor eax, eax
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
call sub.msvcrt.dll__errno
mov dword [rax], 2
xor eax, eax
jmp 0x45d7bd
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
xor eax, eax
jmp 0x45d7bd
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
xor eax, eax
jmp 0x45d7bd
Function at 0x466d40
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00471b98], eax
je 0x466d5a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x4672b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x004dd338], 1
je 0x4672c6
call fcn.00467220
mov ecx, dword [0x00471b98]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x4672f0
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00467160
cmp qword [0x004e0050], 0
mov rsi, rax
je 0x4672da
test rax, rax
je 0x4672da
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rsi + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x60], 0xffffffffffffffff
mov dword [rsi + 0xb0], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4673d8
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xb8], eax
movzx eax, byte [rsi + 0x40]
mov rdx, rsi
mov dword [rsi + 0xb4], 0
mov ecx, dword [0x00471b98]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4673d8
mov rbx, rsi
jmp 0x4672da
call sub.msvcrt.dll_abort
nop
nop
Function at 0x140006904
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000694e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000694e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000694e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000694e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000694e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006950
xor al, al
add rsp, 0x28
ret

Function at 0x14000fd20
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fd7c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fd7c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fd7c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fd7c
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fd7c
cmp dword [rcx + 0xf8], 0
je 0x14000fd7c
mov ecx, ebx
call fcn.14000ff90
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x14009fd10]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140010110
cmp dword [rsp + 0x60], 0
jne 0x14000fdbf
mov ecx, ebx
call fcn.140010010
int3
add rsp, 0x40
pop rbx
ret

Function at 0x14000fdd0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fe32
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fe32
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x14000fe32
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x14000fe32
cmp dword [rdx + 0x84], 0xe
jbe 0x14000fe32
cmp dword [rdx + 0xf8], 0
je 0x14000fe32
mov ecx, ebx
call fcn.14000ff90
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x14009fd10]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140010110
cmp dword [rsp + 0x60], 0
jne 0x14000fe75
mov ecx, ebx
call fcn.140010010
int3
add rsp, 0x40
pop rbx
ret
Function at 0x140010820
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x14009d180]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14001085c
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.1400068c0
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140010918
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x14001097e
test ebx, ebx
jne 0x14001097e
lea ecx, [rax + 2]
call fcn.1400068c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140006150
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret

Function at 0x141032de8
Capabilities:
Encode data using xor

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141032e11
pop rbp
sub rbp, 0x29
sub rbp, 0x1032de8
jmp 0x141032e71
sub rsp, 0x20
jmp 0x141032e81
mov rax, 0x1032de8
add rax, rbp
add rax, 0xcb
mov rcx, 0x64a
mov rdx, 0x3a6ed8f2
xor byte [rax], dl
inc rax
dec rcx
jne 0x141032ea0
jmp 0x141032eb7
mov edx, 0x7b791b7b
invalid
Function at 0x1400174eb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x140013c0a
rol rcx, 0x10
test cx, 0xffff
jne 0x140013c06
repz ret
ror rcx, 0x10
jmp 0x140017444
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140026610]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140026708]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400174c9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140026610]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400174eb
mov rax, qword [rsp + 0x88]
mov qword [0x140026708], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400266a8], rax
mov rax, qword [0x140026708]
mov qword [0x140026580], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140026690], rax
mov dword [0x140026570], 0xc0000409
mov dword [0x140026574], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140025008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140026608], eax
mov ecx, 1
call fcn.14001a004
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400224a8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140026608], 0
jne 0x140017572
mov ecx, 1
call fcn.14001a004
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140017d40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.140019fc0
nop
cmp dword [0x140026b48], 1
je 0x140017cec
mov dword [0x140026b44], 1
mov byte [0x140026b40], r12b
test ebx, ebx
jne 0x140017cd8
mov rcx, qword [0x140027590]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140017cc5
mov rcx, qword [0x140027588]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140017c64
call fcn.140018b34
cmp qword [rdi], rax
jne 0x140017c64
jmp 0x140017c4a
cmp rdi, rsi
jb 0x140017cc5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140018b34
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140027590]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140027588]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x140017ca3
cmp r13, rax
je 0x140017cc3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140017c4a
lea rdx, [0x140022300]
lea rcx, [0x1400222e8]
call fcn.140017a94
lea rdx, [0x140022310]
lea rcx, [0x140022308]
call fcn.140017a94
nop
test r12d, r12d
je 0x140017cfb
mov ecx, 8
call fcn.140019ec0
test r12d, r12d
jne 0x140017d26
mov dword [0x140026b48], 1
lea ecx, [r12 + 8]
call fcn.140019ec0
mov ecx, r15d
call fcn.140017a28
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x140017bb4

Function at 0x140017d4c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x140017bb4
Function at 0x14001eee8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140018b34
xor ebx, ebx
mov rdi, rax
cmp qword [0x140027328], rbx
jne 0x14001efee
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14001f0c3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001f0c3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140027328], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140027330], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140027338], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140027348], rax
test rax, rax
je 0x14001efe5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140027340], rax
jmp 0x14001eff5
mov rax, qword [0x140027340]
jmp 0x14001effc
mov rax, qword [0x140027340]
mov r11, qword [0x140027348]
cmp rax, rdi
je 0x14001f064
cmp r11, rdi
je 0x14001f064
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140027348]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14001f064
test rax, rax
je 0x14001f064
call rsi
test rax, rax
je 0x14001f05e
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001f05e
test byte [rsp + 0x38], 1
jne 0x14001f064
bts ebp, 0x15
jmp 0x14001f0a2
mov rcx, qword [0x140027330]
cmp rcx, rdi
je 0x14001f0a2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001f0a2
call rax
mov rbx, rax
test rax, rax
je 0x14001f0a2
mov rcx, qword [0x140027338]
cmp rcx, rdi
je 0x14001f0a2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001f0a2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140027328]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001f0c3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14001f0c5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret