joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050030
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x58], 0
call fcn.140040680
test al, al
je 0x140050072
test rdx, rdx
je 0x140050072
test r8, r8
je 0x140050072
and qword [rsp + 0x20], 0
lea rbx, [rcx + 0x28]
lea r9, [rsp + 0x58]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140050072
mov rcx, rbx
call fcn.140040650
mov eax, dword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret

Function at 0x1400503e0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp dl, 1
jne 0x140050417
mov edx, 0x1388
call fcn.1400419b0
test al, al
jne 0x140050434
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
jmp 0x14005042a
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x20
pop rbx
ret

Function at 0x140050750
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x40
mov ebx, dword [rsp + 0x80]
xor edi, edi
mov esi, r9d
mov rbp, r8
mov r12, rdx
mov r13, rcx
mov byte [0x1400ab24a], dil
test ebx, ebx
je 0x1400507c6
mov byte [0x1400ab24b], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x80]
lea r8, [0x140050630]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x34], ebx
call fcn.14001ab28
mov rdi, rax
mov r9d, esi
mov r8, rbp
mov rdx, r12
mov rcx, r13
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
test rdi, rdi
je 0x1400507fb
or edx, 0xffffffff
mov rcx, rdi
mov byte [0x1400ab24b], 0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
or eax, 0xffffffff
cmp byte [0x1400ab24a], 1
cmove ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r13
pop r12
pop rdi
ret
Function at 0x140051080
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r14d, r14d
mov r12, r9
mov rax, rdx
lea ebx, [r14 + 1]
mov edi, r14d
mov ebp, r14d
cmp word [rdx], r14w
jne 0x1400510be
xor al, al
jmp 0x14005120a
or edx, 0xffffffff
mov rcx, rax
call fcn.140017480
mov rsi, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xa0]
mov rcx, rax
mov byte [rsi], r14b
mov byte [r15], r14b
mov qword [rsp + 0x30], rax
mov byte [r12], r14b
mov byte [r13], r14b
call fcn.140019370
lea rcx, [rbx + rax]
call fcn.140017e24
mov rdx, qword [rsp + 0x30]
mov r14, rax
movsxd rax, edi
mov cl, byte [rax + rdx]
cmp cl, 0x2b
je 0x14005112c
cmp cl, 0x5e
je 0x140051127
cmp cl, 0x21
je 0x140051127
cmp cl, 0x23
jne 0x140051152
cmp cl, 0x2b
jne 0x140051132
mov byte [r12], bl
jmp 0x14005114e
cmp cl, 0x5e
jne 0x14005113d
mov byte [r13], bl
jmp 0x14005114e
cmp cl, 0x21
jne 0x140051147
mov byte [r15], bl
jmp 0x14005114e
cmp cl, 0x23
jne 0x14005114e
mov byte [rsi], bl
add edi, ebx
jmp 0x14005110d
mov rsi, qword [rsp + 0x90]
movsxd rax, edi
add edi, ebx
mov cl, byte [rax + rdx]
mov dword [rsp + 0x88], edi
cmp cl, 0x7b
jne 0x1400511c8
mov rcx, qword [rsp + 0x80]
lea rax, [rsp + 0x88]
mov r8, rdx
mov r9, r14
mov dl, 0x7d
mov qword [rsp + 0x20], rax
call fcn.140043410
test eax, eax
jne 0x140051236
lea rdi, [0x1400a9890]
mov rcx, qword [rdi]
mov rdx, r14
call fcn.14002e240
test eax, eax
je 0x1400511c0
lea rax, reloc.WSOCK32.dll_accept
add rdi, 8
add ebp, ebx
cmp rdi, rax
jl 0x14005119f
cmp ebp, 0x62
jne 0x140051222
mov cl, byte [r14]
call qword [sym.imp.USER32.dll_VkKeyScanA]
movsx ecx, ax
bt ecx, 9
mov dword [rsi], ecx
jae 0x1400511dd
mov byte [r13], bl
bt ecx, 0xa
jae 0x1400511e6
mov byte [r15], bl
bt ecx, 8
jae 0x1400511f0
mov byte [r12], bl
mov rcx, qword [rsp + 0x30]
and dword [rsi], 0xff
call fcn.140018614
mov rcx, r14
call fcn.140018614
mov al, bl
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140000000]
movsxd rax, ebp
cmp byte [rax + rcx + 0xa9ba0], 0
je 0x14005123a
xor bl, bl
jmp 0x1400511f0
mov eax, dword [rcx + rax*4 + 0xa9c10]
mov dword [rsi], eax
jmp 0x1400511f0
Function at 0x140051250
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x120
mov ebx, edx
mov rdi, rcx
xor edx, edx
mov ecx, ebx
mov bpl, r8b
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp qword [rdi + 0x68], 0
mov esi, eax
je 0x140051329
cmp ebx, 0x14
je 0x140051329
cmp ebx, 0x90
je 0x140051329
cmp ebx, 0x91
je 0x140051329
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
shl esi, 0x10
mov eax, 0xc0000001
mov r9d, esi
mov r8b, 1
or r9, rax
cmp bpl, r8b
je 0x1400512d7
mov edx, ebx
mov rcx, rdi
call fcn.140043470
cmp al, r8b
jne 0x1400512dc
bts r9, 0x18
mov eax, dword [rdi + 0x60]
test r8b, al
jne 0x1400512ef
bt eax, 8
jb 0x1400512ef
cmp ebx, 0x12
jne 0x140051305
test al, 8
jne 0x140051305
bt eax, 0xb
jb 0x140051305
bts r9, 0x1d
mov edx, 0x105
jmp 0x14005130a
mov edx, 0x101
mov rcx, qword [rdi + 0x68]
mov r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
xor byte [rsp + rbx + 0x20], 0x80
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x14005135a
mov r8b, 1
cmp bpl, r8b
je 0x140051346
mov edx, ebx
mov rcx, rdi
call fcn.140043470
cmp al, r8b
mov r8d, 2
jne 0x14005134c
mov r8d, 3
xor r9d, r9d
mov dl, sil
mov cl, bl
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
jmp fcn.140043890

Function at 0x140051380
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x120
mov ebx, edx
mov rdi, rcx
xor edx, edx
mov ecx, ebx
mov bpl, r8b
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp qword [rdi + 0x68], 0
mov esi, eax
je 0x140051452
cmp ebx, 0x14
je 0x140051452
cmp ebx, 0x90
je 0x140051452
cmp ebx, 0x91
je 0x140051452
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
or byte [rsp + rbx + 0x20], 0x80
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
shl esi, 0x10
mov r9d, esi
or r9, 1
cmp bpl, 1
je 0x140051411
mov edx, ebx
mov rcx, rdi
call fcn.140043470
cmp al, 1
jne 0x140051416
bts r9, 0x18
mov eax, dword [rdi + 0x60]
test al, 1
jne 0x140051428
bt eax, 8
jb 0x140051428
cmp ebx, 0x12
jne 0x14005143e
test al, 8
jne 0x14005143e
bt eax, 0xb
jb 0x14005143e
bts r9, 0x1d
mov edx, 0x104
jmp 0x140051443
mov edx, 0x100
mov rcx, qword [rdi + 0x68]
mov r8, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14005147f
cmp bpl, 1
je 0x14005146b
mov edx, ebx
mov rcx, rdi
call fcn.140043470
cmp al, 1
je 0x14005146b
xor r8d, r8d
jmp 0x140051471
mov r8d, 1
xor r9d, r9d
mov dl, sil
mov cl, bl
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
jmp fcn.140043880
Function at 0x1400514b0
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov bl, r8b
mov edi, edx
mov rsi, rcx
call fcn.140051380
mov r8b, bl
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140051250
Function at 0x140051960
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x120
bt edx, 9
mov rbx, rcx
jae 0x14005197f
or dword [rcx + 0x60], 8
bt edx, 0xa
jae 0x140051989
or dword [rcx + 0x60], 1
bt edx, 8
jae 0x140051993
or dword [rcx + 0x60], 2
mov eax, dword [rcx + 0x60]
test al, 8
je 0x1400519a6
bt eax, 0xb
jae 0x1400519a6
xor eax, 8
mov dword [rcx + 0x60], eax
mov eax, dword [rcx + 0x60]
test al, 1
je 0x1400519b9
bt eax, 8
jae 0x1400519b9
xor eax, 1
mov dword [rcx + 0x60], eax
mov eax, dword [rcx + 0x60]
test al, 2
je 0x1400519cc
bt eax, 9
jae 0x1400519cc
xor eax, 2
mov dword [rcx + 0x60], eax
mov eax, dword [rcx + 0x60]
test al, 0x10
je 0x1400519df
bt eax, 0xc
jae 0x1400519df
xor eax, 0x10
mov dword [rcx + 0x60], eax
xor edi, edi
cmp qword [rcx + 0x68], rdi
je 0x140051a56
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r11d, dword [rbx + 0x60]
mov eax, r11d
and eax, 0x800
neg eax
sbb al, al
and al, byte [rsp + 0x31]
mov byte [rsp + 0x31], al
mov eax, r11d
and eax, 0x100
neg eax
sbb al, al
and al, byte [rsp + 0x32]
bt r11d, 9
mov byte [rsp + 0x32], al
jb 0x140051a32
mov eax, dword [rbx + 0x78]
mov byte [rsp + 0x30], dil
mov byte [rsp + rax + 0x20], dil
and r11d, 0x1000
lea rcx, [rsp + 0x20]
neg r11d
sbb al, al
and al, byte [rsp + 0x7b]
mov byte [rsp + 0x7b], al
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140051b58
mov esi, reloc.WSOCK32.dll_recvfrom
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x8000
test di, ax
jne 0x140051a7a
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051a8e
bt dword [rbx + 0x60], 0xb
jb 0x140051a8e
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140051250
mov esi, reloc.WSOCK32.dll_select
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140051aad
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051ac1
bt dword [rbx + 0x60], 8
jb 0x140051ac1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140051250
mov ecx, dword [rbx + 0x78]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140051add
mov ecx, dword [rbx + 0x78]
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051af2
bt dword [rbx + 0x60], 9
jb 0x140051af2
mov edx, dword [rbx + 0x78]
xor r8d, r8d
mov rcx, rbx
call fcn.140051250
mov esi, RegisterTypeLib
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140051b11
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051b25
bt dword [rbx + 0x60], 0xa
jb 0x140051b25
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140051250
mov esi, 0x5b
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x140051b44
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
je 0x140051b58
bt dword [rbx + 0x60], 0xc
jb 0x140051b58
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140051250
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140051b70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
xor edx, edx
mov edi, r8d
mov rbx, rcx
call fcn.140051960
mov edx, dword [rbx + 0x60]
mov rcx, rbx
call fcn.140051720
test edi, edi
je 0x140051baf
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400514b0
sub edi, 1
jne 0x140051b9d
mov edx, dword [rbx + 0x60]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400514f0

Function at 0x140051bd0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov ecx, edx
mov bl, r8b
mov esi, edx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
and dil, 1
cmp bl, dil
je 0x140051c47
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov dl, al
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbp
call fcn.140043880
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov cl, sil
lea r8d, [r9 + 2]
mov dl, al
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbp
call fcn.140043890
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov al, dil
add rsp, 0x20
pop rdi
ret

Function at 0x140051c90
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rcx, qword [r8]
mov rdi, rdx
mov rsi, r8
mov r12d, dword [rcx + rdx]
lea rax, [rcx + 4]
mov qword [r8], rax
lea eax, [r12 + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140017e24
lea ecx, [r12 + r12]
movsxd rbx, ecx
mov rcx, qword [rsi]
mov rbp, rax
lea rdx, [rdi + rcx]
mov r8, rbx
mov rcx, rax
call fcn.140018630
add qword [rsi], rbx
xor eax, eax
cmp r12d, eax
movsxd r11, r12d
mov word [rbp + r11*2], ax
jle 0x140051d23
mov rax, rbp
mov rcx, r12
xor word [rax], r12w
add rax, 2
sub rcx, 1
jne 0x140051d15
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x140052a50
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp r8b, 1
jne 0x140052a83
call fcn.140044a90
test al, al
jne 0x140052aa3
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
jmp 0x140052a99
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
add rsp, 0x20
pop rbx
ret

Function at 0x140052e60
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdx, qword [rcx]
mov r8b, 1
mov rdi, rcx
call fcn.140052a50
xor edx, edx
test ebx, ebx
lea ebx, [rdx + 0x25]
mov ecx, ebx
jns 0x140052ebd
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov r8, rbx
shl eax, 0x10
mov edx, 0x100
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8, rbx
jmp 0x140052ef9
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi]
mov edx, 0x100
shl eax, 0x10
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov r9d, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, reloc.OLEAUT32.dll_SafeArrayRedim
mov rcx, qword [rdi]
shl eax, 0x10
mov edx, 0x101
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rdi]
xor r8d, r8d
mov rcx, rdi
call fcn.140052a50
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140054f40
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
sub rsp, 0x30
lea rcx, [0x1400bbcd0]
mov r12d, r9d
mov rbp, r8
mov rsi, rdx
call fcn.14003f110
movsxd rcx, eax
mov rax, qword [0x1400bbd70]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx]
cmp rbp, rsi
jne 0x140054fc4
cmp qword [rbx + 0x2a8], 0
je 0x140055036
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
and qword [rsp + 0x28], 0
mov rcx, qword [rbx + 0x2a8]
mov qword [rsp + 0x20], rsi
mov r8d, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x54]
xor edx, edx
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x140055058
lea rcx, [0x1400bbcd0]
mov rdx, rbp
call fcn.14004ecd0
cmp eax, 0xffffffff
je 0x140055036
movsxd rdi, eax
mov rax, qword [0x1400bbd98]
mov rcx, qword [rax + rdi*8]
mov rdx, qword [rcx]
mov al, byte [rdx + 0xd4]
cmp al, 0xe
je 0x140055036
cmp al, 0xf
je 0x140055036
cmp al, 0x13
je 0x140055036
cmp al, 0x10
je 0x140055036
cmp qword [rdx + 0x10], 0
je 0x140055036
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11, qword [0x1400bbd98]
and qword [rsp + 0x28], 0
mov rax, qword [r11 + rdi*8]
mov rcx, qword [rax]
mov rax, qword [rbx]
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rax
jmp 0x140054fad
movzx r9d, word [rsp + 0x70]
movzx eax, r12w
mov r8, rbp
shl r9d, 0x10
mov edx, 0x7b
mov rcx, rsi
or r9, rax
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x140058600
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov ebx, r9d
mov esi, r8d
mov rdi, rdx
call fcn.14004f480
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.14004f3b0
test esi, esi
je 0x140058655
mov rbx, rsi
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0xff
call fcn.14004f440
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x140058638
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140058970
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [reloc.WSOCK32.dll_accept], 1
jne 0x140058982
call fcn.14004f650
mov rax, qword [0x1400bb2d8]
pxor xmm0, xmm0
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400bb2d8], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x14009d7d8]
add rsp, 0x28
ret

Function at 0x1400589e0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
sub dword [reloc.WSOCK32.dll_accept], 1
jne 0x1400589f2
call fcn.14004f650
mov rax, qword [0x1400bb2d8]
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400bb2d8], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
add rsp, 0x28
ret

Function at 0x140059890
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov bl, dl
lea rdx, [rsp + 0x60]
call fcn.140015a00
lea rcx, [rsp + 0x60]
call fcn.140041ff0
xor edi, edi
cmp al, dil
jne 0x1400598be
xor al, al
jmp 0x140059923
lea rcx, [rsp + 0x60]
cmp bl, dil
jne 0x1400598d5
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, edi
setne al
jmp 0x140059923
call fcn.140018b4c
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov word [rsp + rax*2 + 0x62], di
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x30], rax
mov eax, 0x614
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, edi
sete al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x140059940
Capabilities:
Copy file
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x480
mov rbx, rdx
lea rdx, [rsp + 0x270]
mov dil, r8b
call fcn.140015a00
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140015a00
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ebx, ebx
cmp eax, ebx
jne 0x1400599c2
cmp dil, bl
je 0x1400599bb
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call fcn.140018cec
cmp eax, ebx
je 0x1400599b4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x140059a6e
xor al, al
jmp 0x140059a6e
lea rcx, [rsp + 0x270]
call fcn.140041ff0
cmp al, bl
je 0x1400599bb
lea rcx, [rsp + 0x60]
call fcn.140041ff0
cmp al, bl
je 0x140059a7f
cmp dil, bl
je 0x1400599bb
lea rdx, str..
lea rcx, [rsp + 0x270]
call fcn.140018114
lea rcx, [rsp + 0x270]
call fcn.140018b4c
lea rcx, [rsp + 0x60]
mov word [rsp + rax*2 + 0x272], bx
call fcn.140018b4c
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
lea rax, [rsp + 0x270]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
mov eax, 0x614
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 2
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
sete al
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rdi
ret
lea rcx, [rsp + 0x60]
call fcn.140041c00
cmp al, bl
je 0x1400599bb
lea rcx, [rsp + 0x60]
call fcn.140041ff0
cmp al, bl
jmp 0x1400599e8

Function at 0x140059ab0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xcd0
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov bpl, bl
call fcn.140015a00
lea rcx, [rsp + 0x30]
call fcn.140041ff0
cmp al, bl
je 0x140059af5
lea rdx, str..
lea rcx, [rsp + 0x30]
call fcn.140018114
lea rax, [rsp + 0xac0]
lea r9, [rsp + 0x8b0]
lea r8, [rsp + 0x490]
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.1400198fc
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dil, 1
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140059bb6
cmp dil, 1
jne 0x140059bb6
test byte [rsp + 0x240], 0x10
jne 0x140059b9c
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x30]
mov bpl, dil
call fcn.140018140
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x30]
call fcn.140018114
lea rdx, [rsp + 0x26c]
lea rcx, [rsp + 0x30]
call fcn.140018114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x140059bb9
lea rdx, [rsp + 0x240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jne 0x140059b43
mov dil, bl
jmp 0x140059b43
mov bl, bpl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0xcd0]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret