joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065ca0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov rbx, qword [rdx]
mov rbp, rcx
lea rcx, [rsp + 0x50]
mov esi, r8d
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11d, dword [rsp + 0x50]
mov eax, dword [rsp + 0x54]
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov dword [rdi + 0x26c], r11d
mov dword [rdi + 0x270], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x54]
cmp eax, dword [rdi + 0x274]
jne 0x140065d06
cmp ecx, dword [rdi + 0x278]
je 0x140065d2e
cmp esi, 1
mov dword [rdi + 0x274], eax
mov dword [rdi + 0x278], ecx
jl 0x140065d2e
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8, rdi
mov rcx, rbp
mov edx, 0xfffffff5
call fcn.14005ec30
mov ecx, dword [rbp + 0x18]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rbp + 0x1c]
movzx r12d, ax
shr r12d, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
cmp r12d, dword [rdi + 0x27c]
je 0x140065dd4
cmp esi, 1
jl 0x140065dd4
cmp byte [rdi + 0x2b8], 0
je 0x140065dd4
mov eax, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x50]
mov r8, rdi
mov rcx, rbp
mov dword [rsp + 0x20], eax
test r12d, r12d
je 0x140065d84
mov edx, 0xfffffff9
jmp 0x140065dc8
mov edx, 0xfffffff8
call fcn.14005ec30
cmp byte [rdi + 0x284], 0
je 0x140065dcd
mov rcx, qword [rdi]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9d, dword [rsp + 0x50]
mov r8, rdi
bt eax, 0x18
mov eax, dword [rsp + 0x54]
mov rcx, rbp
mov dword [rsp + 0x20], eax
mov edx, 0xfffffffa
jb 0x140065dc8
mov edx, 0xfffffff4
call fcn.14005ec30
mov byte [rdi + 0x284], 0
test esi, esi
je 0x140065ddf
mov dword [rdi + 0x27c], r12d
cmp ebx, dword [rdi + 0x280]
je 0x140065e12
cmp esi, 1
jl 0x140065e12
mov eax, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x50]
mov r8, rdi
mov rcx, rbp
mov edx, 0xfffffff7
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140065e0d
mov edx, 0xfffffff6
call fcn.14005ec30
test esi, esi
je 0x140065e1c
mov dword [rdi + 0x280], ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x14006d050
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov r13b, dl
mov rbp, rcx
lea rdx, str.open
lea rcx, [rsp + 0x20]
mov edi, r9d
mov rbx, r8
call fcn.1400022f0
xor r15d, r15d
lea rcx, [rsp + 0x40]
lea r8d, [r15 + 0x70]
xor edx, edx
mov r12, r15
mov rsi, r15
lea r14d, [r15 + 1]
call fcn.140018a40
cmp edi, 2
jb 0x14006d0d9
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.140058e00
cmp word [rax], r15w
je 0x14006d0d9
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.140058e00
mov rcx, rax
call fcn.140015940
mov r12, rax
cmp edi, 3
jb 0x14006d0f6
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.140058e00
mov rcx, rax
call fcn.140015940
mov rsi, rax
cmp edi, 4
jb 0x14006d128
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call fcn.140058e00
cmp word [rax], r15w
je 0x14006d128
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x18]
call fcn.140001280
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.140013690
cmp edi, 5
jb 0x14006d13e
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x20]
call fcn.140001d20
movzx r14d, ax
mov edi, WSAStartup
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8, rdi
call fcn.140018a40
mov rax, qword [rsp + 0x20]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 8]
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], r15
mov rcx, qword [rax]
call fcn.140058e00
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x58], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
cmp r12, r15
je 0x14006d1a7
mov rcx, r12
call fcn.1400185f4
cmp rsi, r15
je 0x14006d1b4
mov rcx, rsi
call fcn.1400185f4
cmp ebx, r15d
jne 0x14006d1e2
xor r8d, r8d
mov rcx, rbp
lea edi, [r8 + 1]
mov edx, edi
call fcn.140003d50
mov rbx, qword [rsp + 0x100]
mov rcx, rbx
call fcn.140003c60
mov dword [rbx + 8], edi
mov dword [rbx], r15d
jmp 0x14006d225
cmp r13b, r15b
je 0x14006d1f8
mov rax, qword [rsp + 0xa8]
mov qword [rbp + 0x618], rax
jmp 0x14006d225
mov rbx, qword [rsp + 0x100]
mov rcx, rbx
call fcn.140003c60
mov rcx, qword [rsp + 0xa8]
mov edi, 1
mov dword [rbx + 8], edi
mov dword [rbx], edi
cmp rcx, r15
je 0x14006d225
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x20]
call fcn.1400036e0
lea r11, [rsp + 0xb0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006d8c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
mov eax, 0x2060
call fcn.140030df0
sub rsp, rax
lea rcx, [rsp + 0x20]
mov rbp, rdx
call fcn.140008640
lea rcx, [rsp + 0x40]
call fcn.140008640
mov rcx, rbp
call fcn.140058e00
xor r12d, r12d
movzx ecx, word [rax]
mov rsi, rax
mov dil, r12b
mov rbx, r12
cmp cx, r12w
je 0x14006da45
lea r13d, [r12 + 0x25]
inc rbx
cmp cx, r13w
jne 0x14006d9f3
cmp word [rsi + rbx*2], r13w
jne 0x14006d94a
lea rcx, [rsp + 0x20]
mov edx, r13d
mov dil, 1
call fcn.140059640
inc rbx
jmp 0x14006da00
lea rdx, [0x140096618]
lea rcx, [rsp + 0x40]
call fcn.140011cb0
jmp 0x14006d974
cmp r11w, r12w
je 0x14006d97f
lea rcx, [rsp + 0x40]
movzx edx, r11w
call fcn.140059640
inc rbx
movzx r11d, word [rsi + rbx*2]
cmp r11w, r13w
jne 0x14006d95d
cmp word [rsi + rbx*2], r12w
je 0x14006da10
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0xfff
inc rbx
mov word [rsp + 0x60], r12w
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
cmp eax, r12d
je 0x14006d9c2
lea rdx, [rsp + 0x60]
call fcn.1400121b0
mov dil, 1
jmp 0x14006da00
lea rdx, [0x14009d944]
mov dil, 1
call fcn.1400121b0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140063280
lea rdx, [0x14009d944]
lea rcx, [rsp + 0x20]
call fcn.1400121b0
jmp 0x14006da00
movzx edx, cx
lea rcx, [rsp + 0x20]
call fcn.140059640
mov cx, word [rsi + rbx*2]
cmp cx, r12w
jne 0x14006d91e
jmp 0x14006da33
lea rdx, [0x14009d944]
lea rcx, [rsp + 0x20]
mov dil, 1
call fcn.1400121b0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140063280
cmp dil, r12b
je 0x14006da45
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400146c0
lea rcx, [rsp + 0x40]
call fcn.1400036e0
lea rcx, [rsp + 0x20]
call fcn.1400036e0
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x14007a170
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov rax, rdx
mov rdi, rcx
or edx, 0xffffffff
mov rcx, rax
mov rbx, r8
call fcn.140017380
mov r8b, 1
mov rdx, rbx
mov rcx, rdi
xor esi, esi
xor r13b, r13b
mov rbp, rax
xor r14d, r14d
mov qword [rdi + 0x68], rbx
call fcn.1400435d0
mov rcx, rbp
call fcn.140019350
lea rcx, [rax + 1]
call fcn.140017e04
cmp byte [rdi + 8], 1
mov r12, rax
jne 0x14007a1ed
lea edx, [rsi + 0x14]
xor r8d, r8d
mov rcx, rdi
call fcn.140051c60
mov rcx, rdi
mov r13b, al
call fcn.140043450
mov r14d, eax
mov bl, byte [rbp]
jmp 0x14007a2a3
inc esi
mov dword [rsp + 0x60], esi
cmp bl, 0x21
je 0x14007a299
cmp bl, 0x23
je 0x14007a293
cmp bl, 0x2b
je 0x14007a28d
cmp bl, 0x5e
je 0x14007a287
mov rcx, rdi
cmp bl, 0x7b
je 0x14007a23d
call fcn.140051090
mov r8d, 1
mov dl, bl
mov rcx, rdi
call fcn.14005aa60
and dword [rdi + 0x60], 0x3f00
jmp 0x14007a29d
lea rax, [rsp + 0x60]
mov r9, r12
mov r8, rbp
mov dl, 0x7d
mov qword [rsp + 0x20], rax
call fcn.1400432b0
mov rcx, rdi
test eax, eax
je 0x14007a26a
mov r8d, 1
mov dl, 0x7b
call fcn.14005aa60
jmp 0x14007a29d
call fcn.140051090
mov rdx, r12
mov rcx, rdi
call fcn.140079cc0
and dword [rdi + 0x60], 0x3f00
mov esi, dword [rsp + 0x60]
jmp 0x14007a29d
or dword [rdi + 0x60], 8
jmp 0x14007a29d
or dword [rdi + 0x60], 2
jmp 0x14007a29d
or dword [rdi + 0x60], 0x10
jmp 0x14007a29d
or dword [rdi + 0x60], 1
movsxd rax, esi
mov bl, byte [rax + rbp]
test bl, bl
jne 0x14007a1f5
cmp byte [rdi + 8], 1
jne 0x14007a2cc
mov edx, r14d
mov rcx, rdi
call fcn.1400517b0
mov r8b, r13b
mov edx, reloc.WSOCK32.dll_sendto
mov rcx, rdi
call fcn.140051c60
mov rcx, rbp
call fcn.1400185f4
mov rcx, r12
call fcn.1400185f4
mov rdx, qword [rdi + 0x68]
xor r8d, r8d
mov rcx, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
jmp fcn.1400435d0
Function at 0x14066c058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14066c1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14066c089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066c06f
add dl, dl
jne 0x14066c096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066c0f6
xor eax, eax
add dl, dl
jne 0x14066c0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14066c1ad
add dl, dl
jne 0x14066c0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14066c0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14066c0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14066c0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14066c0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14066c07e
mov eax, 1
add dl, dl
jne 0x14066c106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14066c113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066c0fb
sub eax, ebx
mov ebx, 1
jne 0x14066c14c
mov ecx, 1
add dl, dl
jne 0x14066c12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14066c13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066c123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066c07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14066c168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14066c175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14066c15d
cmp eax, 0x7d00
jae 0x14066c19b
cmp eax, 0x500
jb 0x14066c196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066c07e
cmp eax, 0x7f
ja 0x14066c19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14066c07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14066c1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14066c07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400040e8
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea r9, [0x140027838]
lea r8, [0x140036900]
lea rdx, str.runas
xor ecx, ecx
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x140004160
lea rdx, str.Failed_to_start_elevated_process__ShellExecute_returned__d_
lea rcx, [rsp + 0x30]
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [0x1400282f8]
lea rdx, [rsp + 0x30]
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140009080
add rsp, 0xc8
ret

Function at 0x140004198
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push rbx
sub rsp, 0x310
mov rax, qword [0x1400342a0]
xor rax, rsp
mov qword [rsp + 0x300], rax
lea rdx, [rsp + 0xe0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0xe0]
lea rdx, str._s.bat
lea rcx, [rsp + 0x1f0]
call fcn.14000c5f0
lea rdx, [0x140028384]
lea rcx, [rsp + 0x1f0]
call fcn.14000c580
lea rdx, str.:Repeat_n
mov rcx, rax
mov rbx, rax
call fcn.14000a190
lea r8, [rsp + 0xe0]
lea rdx, str.del___s__n
mov rcx, rbx
call fcn.14000a190
lea r8, [rsp + 0xe0]
lea rdx, str.if_exist___s__goto_Repeat_n
mov rcx, rbx
call fcn.14000a190
lea r8, [rsp + 0x1f0]
lea rdx, str.del___s__n
mov rcx, rbx
call fcn.14000a190
mov rcx, rbx
call fcn.14000ab20
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8, rbx
xor edx, edx
call fcn.140008a00
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [0x1400276a8]
lea rdx, [rsp + 0x1f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0x44
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], bx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
je 0x140004325
mov rcx, qword [rsp + 0x58]
lea edx, [rbx - 0xf]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea edx, [rbx + 0xf]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.140009080
add rsp, 0x310
pop rbx
ret
Function at 0x14000def4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.1400133a8
nop
cmp dword [0x140035940], 1
je 0x14000dea0
mov dword [0x14003593c], 1
mov byte [0x140035938], r12b
test ebx, ebx
jne 0x14000de8c
mov rcx, qword [0x140037f88]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000de79
mov rcx, qword [0x140037f80]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14000de18
call fcn.14001174c
cmp qword [rdi], rax
jne 0x14000de18
jmp 0x14000ddfe
cmp rdi, rsi
jb 0x14000de79
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.14001174c
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140037f88]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140037f80]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14000de57
cmp r13, rax
je 0x14000de77
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14000ddfe
lea rdx, [0x1400275c0]
lea rcx, [0x1400275a0]
call fcn.14000dbb8
lea rdx, [0x1400275d0]
lea rcx, [0x1400275c8]
call fcn.14000dbb8
nop
test r12d, r12d
je 0x14000deaf
mov ecx, 8
call fcn.140013288
test r12d, r12d
jne 0x14000deda
mov dword [0x140035940], 1
lea ecx, [r12 + 8]
call fcn.140013288
mov ecx, r15d
call fcn.14000db4c
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000dd68

Function at 0x14000df00
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14000dd68
Function at 0x14000e2a3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400342a0]
jne 0x14000909a
rol rcx, 0x10
test cx, 0xffff
jne 0x140009096
repz ret
ror rcx, 0x10
jmp 0x14000e1fc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140035a00]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x140035af8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000e281
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140035a00]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000e2a3
mov rax, qword [rsp + 0x88]
mov qword [0x140035af8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140035a98], rax
mov rax, qword [0x140035af8]
mov qword [0x140035970], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140035a80], rax
mov dword [0x140035960], 0xc0000409
mov dword [0x140035964], 1
mov rax, qword [0x1400342a0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400342a8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400359f8], eax
mov ecx, 1
call fcn.14001ac0c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14002deb0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400359f8], 0
jne 0x14000e32a
mov ecx, 1
call fcn.14001ac0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400077b0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x490], rbx
mov rax, qword [0x140072010]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov dword [rbp], 0x438
mov edx, dword [rcx + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
lea rcx, [rbp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140007820
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000789a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000784b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14005c210
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14000789a
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x30]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x14000789d
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x1400078aa
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x1400078c2
inc rbx
test eax, eax
jne 0x1400078b0
test ecx, ecx
mov rcx, rsi
je 0x140007922
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140007811
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000791e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140007919
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007999
mov rcx, r8
call fcn.14005b5fc
xor eax, eax
jmp 0x140007965
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140007962
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000795d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007999
mov rcx, r8
call fcn.14005b5fc
mov rax, rbx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.14005b160
mov rbx, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140007bc0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rdi
mov rax, qword [0x140072010]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov dword [rbp], 0x238
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
nop word [rax + rax]
lea rcx, [rbp + 0x2c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140007c40
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140007cba
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140007c6b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14005c210
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140007cba
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x2c]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x140007cbd
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x140007cca
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140007ce2
inc rbx
test eax, eax
jne 0x140007cd0
test ecx, ecx
mov rcx, rsi
je 0x140007d42
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140007c30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140007d3e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140007d39
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007dc3
mov rcx, r8
call fcn.14005b5fc
xor eax, eax
jmp 0x140007d83
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov ebx, dword [rbp + 8]
cmp rdx, 0x10
jb 0x140007d81
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140007d7c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007dc3
mov rcx, r8
call fcn.14005b5fc
mov eax, ebx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.14005b160
mov rbx, qword [rbp + 0x270]
mov rsi, qword [rbp + 0x280]
mov rdi, qword [rbp + 0x288]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3