joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec548
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rax, rdx
xor ebp, ebp
shr rax, 0x10
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test ax, ax
je 0x1400ec5c6
add rcx, 0x38
cmp word [rdx], 0x3c
jne 0x1400ec591
call fcn.14010ec1c
jmp 0x1400ec599
xor r8d, r8d
call fcn.14010ec88
test al, al
jne 0x1400ec645
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140138320
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
call fcn.1400e1fd8
mov rcx, rax
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x1400ec5a1
call fcn.1400e1fd8
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x1400ec606
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x1400ec5a1
call fcn.1400e1fd8
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rcx, [rsi + 0x38]
xor r9d, r9d
mov rdx, rax
mov r8d, ebx
call fcn.14010efd4
test al, al
je 0x1400ec5a1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
lea rcx, [rsi + 0x38]
lea rdx, [rsp + 0x230]
call fcn.14010eb3c
mov ecx, 4
lea rdx, [rsp + 0x20]
lea r8d, [rcx + 0x7c]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rax + 0x70]
add rax, r8
movups xmmword [rdx + 0x60], xmm0
add rdx, r8
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1400ec664
movups xmm0, xmmword [rax]
mov rcx, rsi
movups xmmword [rdx], xmm0
lea rdx, [rsp + 0x20]
call fcn.1400ec1a0
jmp 0x1400ec5a3
Function at 0x140104d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
mov ecx, eax
and r10d, 7
je 0x140104da9
cmp eax, r10d
jge 0x140104d9b
mov rcx, rbx
call fcn.1400ffd3c
mov eax, dword [rbx + 0x10]
mov ecx, r10d
shr dword [rbx + 0x14], cl
sub eax, r10d
mov dword [rbx + 0x10], eax
mov ecx, eax
xor edx, edx
test eax, eax
jle 0x140104dd5
mov r8d, dword [rbx + 0x14]
lea r9, [rsp + 0x30]
mov al, byte [rbx + 0x14]
inc edx
shr r8d, 8
sub ecx, 8
mov byte [r9], al
inc r9
mov dword [rbx + 0x14], r8d
test ecx, ecx
jg 0x140104db8
mov dword [rbx + 0x10], ecx
movsxd rcx, edx
jmp 0x140104df6
mov rax, qword [rbx]
cmp rax, qword [rbx + 8]
jb 0x140104de7
xor dl, dl
jmp 0x140104def
mov dl, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140104dda
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x140104e37
lea rcx, str.zlib_corrupt
call fcn.1400ffc38
jmp 0x140104e84
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140104e4f
lea rcx, str.read_past_buffer
jmp 0x140104e30
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x140104e69
mov rcx, rbx
call fcn.140108818
test eax, eax
je 0x140104e84
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.14013cf50
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14010c3ac
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rbp, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
cmp qword [rcx + 0x710], r14
je 0x14010c45a
cmp edx, 0x100
jne 0x14010c434
cmp di, 0xd
jne 0x14010c434
cmp byte [rcx + 0x71a], r14b
je 0x14010c40b
lea ecx, [r14 + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14010c434
cmp byte [rbx + 0x71b], r14b
jne 0x14010c434
mov rcx, qword [rbx + 0x58]
test rcx, rcx
je 0x14010c430
mov byte [rsp + 0x28], r14b
lea r8, str.return
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov rdx, rbx
call fcn.1400e6608
xor eax, eax
jmp 0x14010c45f
mov rax, qword [rbx + 0x710]
mov r9, rbp
mov r8, rdi
mov edx, esi
mov rcx, qword [rax + 0x18]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r10, qword [rcx]
call qword [r10 + Ordinal_26]
jmp 0x14010c45f
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140110c34
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rax, rdx
mov r15, r9
shr rax, 0x10
mov r14, r8
mov rbx, rdx
mov rdi, rcx
test ax, ax
je 0x140110c86
cmp word [rdx], 0x3c
je 0x140110c86
call fcn.14002c5c0
mov rcx, rax
mov rdx, rbx
call fcn.1400ec17c
test rax, rax
cmovne rbx, rax
mov rax, rbx
shr rax, 0x10
test ax, ax
je 0x140110cd6
cmp word [rbx], 0x3c
mov rdx, rbx
mov rcx, rdi
jne 0x140110ca5
call fcn.14010ec1c
jmp 0x140110cad
xor r8d, r8d
call fcn.14010ec88
test al, al
jne 0x140110d67
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov rsi, qword [rdi + 0x158]
test rsi, rsi
jne 0x140110cea
call fcn.1400e1fd8
mov rsi, rax
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140110cb5
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
jne 0x140110d20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x140110cb5
mov rdx, rbx
mov qword [rdi + 0x148], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LockResource]
xor r9d, r9d
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call fcn.14010efd4
test al, al
je 0x140110cb5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov qword [rdi + 0x150], r14
mov r9, qword [rsp + 0x68]
mov rdx, r15
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call fcn.14010fc00
jmp 0x140110cb7
Function at 0x140118b88
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rdi, rdx
mov rbx, rcx
call qword [rax + 0x228]
test al, al
jne 0x140118bcd
mov eax, dword [rdi]
sub eax, 9
cmp eax, 0xc
ja 0x140118bcd
mov rcx, qword [rbx + 0x5c0]
mov rdx, rdi
test rcx, rcx
je 0x140118d70
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x140118d78
mov rcx, qword [rbx + 0x5c0]
test rcx, rcx
je 0x140118c62
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rax + 0x470], 0
je 0x140118c62
cmp dword [rdi], 0xf
jne 0x140118c62
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x218]
test al, al
je 0x140118d78
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0x8000
test di, ax
jne 0x140118c3e
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x140118c3e
lea rcx, [rbx + 0x5a8]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + Ordinal_41]
jmp 0x140118d78
mov rcx, qword [rbx + 0x5c0]
test rcx, rcx
je 0x140118d78
mov rax, qword [rcx]
xor r8d, r8d
mov edx, dword [rbx + 0x5b0]
call qword [rax + 0x20]
jmp 0x140118d78
cmp dword [rdi], 0xd
jne 0x140118cb5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x218]
test al, al
je 0x140118d78
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_145]
test al, al
je 0x140118c05
mov rcx, qword [rbx + 0x58]
lea r8, str.buttondown
mov byte [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
mov rdx, rbx
call fcn.1400e6608
jmp 0x140118c05
cmp dword [rdi], 0xe
jne 0x140118cf4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x218]
test al, al
je 0x140118d78
lea r8, str.itemclick
mov rcx, qword [rbx + 0x58]
xor r9d, r9d
mov byte [rsp + 0x28], 0
mov rdx, rbx
and qword [rsp + 0x20], 0
call fcn.1400e6608
jmp 0x140118d78
cmp dword [rdi], 0xb
jne 0x140118d31
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x218]
test al, al
je 0x140118d78
or dword [rbx + 0x5b8], 8
mov rcx, rbx
call fcn.14011aae8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_145]
test al, al
je 0x140118d78
lea r8, str.mouseenter
jmp 0x140118cd5
cmp dword [rdi], 0xa
jne 0x140118d6d
mov eax, dword [rbx + 0x5b8]
test al, 8
je 0x140118d78
and eax, 0xfffffff7
mov rcx, rbx
mov dword [rbx + 0x5b8], eax
call fcn.14011aae8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_145]
test al, al
je 0x140118d78
lea r8, str.mouseleave
jmp 0x140118cd5
mov rdx, rdi
mov rcx, rbx
call fcn.140118824
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140119274
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x730
jmp method.DuiLib::CListUI.virtual_648
Function at 0x140126708
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x1402126b0]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x30], 0
mov rdi, rcx
je 0x1401267ed
cmp qword [rcx + 0x20], 0
je 0x1401267ed
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140126768
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1401390a0
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1401267ed
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x20]
mov rdx, rbx
add rcx, 0x1f8
call fcn.1400e8e5c
mov rbx, qword [rdi + 0x20]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + gethostname]
mov byte [rsp + 0x28], 0
lea r8, str.textchanged
and qword [rsp + 0x20], 0
mov rcx, rax
xor r9d, r9d
mov rdx, rbx
call fcn.1400e6608
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rcx, rax
call fcn.1400e2340
test al, al
je 0x1401267ed
mov rcx, qword [rdi + 0x20]
call fcn.1400f3098
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140138320
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x1401291f4
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub rsp, 0x2e8
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x140129295
xor edx, edx
lea rcx, [rsp + 0x1d0]
mov r8d, 0xff
call fcn.14013d3b0
mov edx, 0xff
lea rcx, [rsp + 0x1d0]
call sub.WS2_32.dll_gethostname
lea rcx, [rsp + 0x1d0]
call sub.WS2_32.dll_gethostbyname
test rax, rax
je 0x140129295
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x20]
mov r8d, 4
mov rdx, qword [rdx]
call fcn.14013cf50
movzx ecx, byte [rsp + 0x21]
movzx eax, byte [rsp + 0x20]
shl eax, 8
add eax, ecx
movzx ecx, byte [rsp + 0x22]
shl eax, 8
add eax, ecx
movzx ecx, byte [rsp + 0x23]
shl eax, 8
add eax, ecx
jmp 0x140129297
xor eax, eax
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.140138320
add rsp, 0x2e8
ret

Function at 0x14012ebac
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x730
jmp method.DuiLib::CMenuUI.virtual_648

Function at 0x140133900
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rdx]
mov rdi, rdx
sub eax, 0xd
mov rbx, rcx
test eax, 0xfffffff7
jne 0x140133921
call fcn.14013487c
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp method.DuiLib::CListUI.virtual_648

Function at 0x140133938
Capabilities:
Log keystrokes via polling

Disassembly:
sub rcx, 0x730
jmp method.DuiLib::CListExUI.virtual_648
Function at 0x1401368e8
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1402126b0]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor ecx, ecx
mov qword [rsp + 0x20], rdx
mov edi, r8d
mov rsi, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
mov ecx, edi
mov r8, rax
call qword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ebx, eax
cmp edi, 0x21
jb 0x140136944
cmp edi, 0x28
jbe 0x140136940
lea eax, [rdi - 0x2d]
cmp eax, 1
ja 0x140136944
bts ebx, 8
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.14013d3b0
shl ebx, 0x10
lea rdx, [rsp + 0x30]
mov ecx, ebx
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
or r8d, 0xffffffff
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400e8c38
mov rax, rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140138320
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140145a0c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401459e9
call fcn.140145f60
mov dword [rax], socket
call fcn.140140390
or eax, 0xffffffff
jmp 0x140145a06
sub dword [rcx + 0x10], 1
jns 0x1401459f8
add rsp, 0x28
jmp fcn.140160958
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401459c8
Function at 0x1401480e4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140147eb8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140147eb8
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140147eb8
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140147eb8
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140147eb8
cmp dword [rcx + 0x84], 0xe
jbe 0x140147eb8
cmp dword [rcx + 0xf8], esi
je 0x140147eb8
mov ecx, r14d
call fcn.140148000
mov ecx, 2
call fcn.14015a9d4
nop
cmp byte [0x140216d08], 0
jne 0x140147f82
mov r15d, 1
mov eax, r15d
xchg dword [0x140216cfc], eax
test ebx, ebx
jne 0x140147f2b
mov rdi, qword [0x1402126b0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140216d00]
cmp rcx, rax
je 0x140147f22
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140093130]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140216f50]
jmp 0x140147f37
cmp ebx, r15d
jne 0x140147f3d
lea rcx, [0x140216f68]
call fcn.14015742c
nop
test ebx, ebx
jne 0x140147f54
lea rdx, [0x14017f538]
lea rcx, [0x14017f518]
call fcn.140157744
lea rdx, [0x14017f548]
lea rcx, [0x14017f540]
call fcn.140157744
movzx eax, byte [0x140216d08]
test esi, esi
cmove eax, r15d
mov byte [0x140216d08], al
jmp 0x140147f82
mov ecx, 2
call fcn.14015aa28
test esi, esi
jne 0x140147f99
mov ecx, r14d
call fcn.140147fb4
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140147e48
Function at 0x140160958
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401607f8
call fcn.140145f60
mov dword [rax], socket
call fcn.140140390
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401607e0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401607e0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14016082a
lock or dword [rax + 0x14], 0x10
jmp 0x1401607e0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140160847
mov rcx, qword [rbp + 0x10]
call fcn.140161858
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14015a964
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1401591cc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14016089e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1401607e0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14016090a
mov rcx, qword [rbp + 0x10]
call fcn.14015a964
cmp eax, 0xffffffff
je 0x1401608f1
mov rcx, qword [rbp + 0x10]
call fcn.14015a964
cmp eax, 0xfffffffe
je 0x1401608f1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14015a964
movsxd rdi, eax
lea rsi, [0x1402171c0]
mov rcx, rbx
sar rdi, 6
call fcn.14015a964
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401608f8
lea rax, [0x140212bd0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14016090a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140160940
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14016093c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14016093c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1401607e3
jmp 0x1401607b0

Function at 0x14016309c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401630bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140145ef0
or eax, 0xffffffff
jmp 0x1401630be
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x1400152f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001127b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012e20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012e40
xor al, al
jmp 0x140012ec1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012e53
xor al, al
jmp 0x140012ec1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012e7d
xor al, al
jmp 0x140012ec1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012e91
xor al, al
jmp 0x140012ec1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012ea3
xor al, al
jmp 0x140012ec1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012ebf
xor al, al
jmp 0x140012ec1
mov al, 1
add rsp, 0x38
ret

Function at 0x140011c20
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001139d
movzx eax, al
test eax, eax
jne 0x140011c40
mov ecx, 7
call fcn.140011316
nop
mov byte [rsp + 0x20], 0
call fcn.14001132a
mov byte [rsp + 0x21], al
cmp dword [0x14001c220], 1
jne 0x140011c64
mov ecx, 7
call fcn.140011316
nop
jmp 0x140011cbc
cmp dword [0x14001c220], 0
jne 0x140011cb7
mov dword [0x14001c220], 1
lea rdx, [0x140019660]
lea rcx, [0x140019330]
call fcn.14001119f
test eax, eax
je 0x140011c98
mov eax, 0xff
jmp 0x140011dc1
lea rdx, [0x140019220]
lea rcx, [section..rdata]
call fcn.140011320
mov dword [0x14001c220], 2
jmp 0x140011cbc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011307
call fcn.14001129e
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140011d19
mov rcx, qword [rsp + 0x30]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x140011d19
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140023020]
nop
call fcn.1400112d0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140011d4d
mov rcx, qword [rsp + 0x38]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x140011d4d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011357
nop
call fcn.140011e70
mov dword [rsp + 0x28], eax
call fcn.14001127b
movzx eax, al
test eax, eax
jne 0x140011d6c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140011d7b
call fcn.140011361
nop
xor edx, edx
mov cl, 1
call fcn.14001114f
mov eax, dword [rsp + 0x28]
jmp 0x140011dc1
add rsp, 0x68
ret