joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x140009a8b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140009a93
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x140009aca
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140009aa0
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x140009af5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x140009b1b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x140009b00
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x14000e4c4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000e357
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e357
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e357
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e357
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e357
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e357
cmp dword [rcx + 0xf8], 0
je 0x14000e357
mov ecx, ebx
call fcn.14000e3f8
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000e1e8
cmp dword [rbp + 0x20], 0
je 0x14000e3a4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000e3ac
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000e2f0
Function at 0x1400057bc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400055ac
Function at 0x1400081c4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000824b
mov rsi, rbx
cmp word [rax], bp
je 0x14000820a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400081f4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400081f0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140008bbc
mov rdi, rax
test rax, rax
je 0x140008238
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140002cd0
mov rbp, rdi
xor ecx, ecx
call fcn.140006eec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x10000c450
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov esi, r9d
xor r9d, r9d
mov rbp, rdx
mov r12, rcx
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor r13d, r13d
lea rax, [0x1000026f0]
lea rbx, [0x1000a26b8]
mov qword [0x1000a26c8], r13
mov qword [0x1000a26b8], r13
mov byte [0x1000a26d0], 1
mov byte [0x1000a26d1], r13b
mov qword [0x1000a24a8], rax
mov qword [0x1000a1188], rbx
mov word [0x1000a26d2], r13w
mov dword [0x1000a26d4], r13d
lea rdi, [0x1000a24a8]
mov r8, qword [rdi]
lea rax, [rbx + 8]
lea rcx, [0x10000b9a8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], r13
mov r9d, 1
mov rdx, rbx
mov qword [rsp + 0x28], r13
add rdi, 8
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rbx, qword [rbx]
cmp rbx, r13
jne 0x10000c4d4
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r9d, esi
mov rdx, rbp
mov r8, rax
mov rcx, r12
call fcn.10000bfb8
mov rbx, qword [0x1000a1188]
lea rsi, [0x1000a1188]
mov edi, eax
cmp rbx, rsi
je 0x10000c570
jmp 0x10000c564
mov rcx, qword [rbx + 8]
cmp rcx, r13
je 0x10000c561
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rbx + 8], r13
mov rbx, qword [rbx]
cmp rbx, r13
jne 0x10000c54e
mov qword [0x1000a1188], rsi
lea r11, [rsp + 0x50]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100014e88
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x290
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1000a1108]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, ebp
jne 0x100015008
mov ebx, ebp
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x100014f0f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x48], rcx
cmp ebx, ebp
jne 0x100015008
mov dword [rsp + 0x40], pe_nt_image_headers64
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebp
jne 0x100014fcd
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.100014e88
mov ebx, eax
cmp eax, ebp
jne 0x100014fb4
mov dword [rsp + 0x40], pe_nt_image_headers64
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebp
je 0x100014f5b
jmp 0x100014fcd
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x100014fc9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov eax, ebx
jmp 0x10001501f
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x100014fe2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov rdx, rsi
mov rcx, rdi
call fcn.100015070
mov ebx, eax
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x100015004
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov eax, ebx
jmp 0x10001501f
mov rcx, qword [rsp + 0x48]
cmp rcx, rbp
je 0x10001501d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbp
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.10007a3b0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret
Function at 0x100015e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x490
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x1000a1108]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov r12, r9
mov rdi, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x70], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x38], rax
cmp rax, rbx
jne 0x100015ec4
call fcn.1000142e4
mov ebx, eax
jmp 0x100016000
mov r8, r12
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x100015ee7
call fcn.1000142e4
mov ebx, eax
jmp 0x100015ff6
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x40], rax
cmp rax, rbx
jne 0x100015f0c
call fcn.1000142e4
mov ebx, eax
jmp 0x100015ff6
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, edi
jae 0x100015f45
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x100015f3b
lea rcx, [rsp + 0x70]
call fcn.1000148d4
nop
mov eax, 0x8007000e
jmp 0x100016019
mov ecx, eax
cmp rcx, rbx
je 0x100015f7e
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x100015f74
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x100015f7e
lea rcx, [rsp + 0x70]
call fcn.1000142b0
jmp 0x100015f88
mov ecx, 0x80070057
call fcn.100016990
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
jmp 0x100015f9a
mov rax, qword [rsp + 0x70]
cmp rax, rbx
jne 0x100015fab
mov ebx, 0x8007000e
jmp 0x100015ff6
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x100015fd2
call fcn.1000142e4
mov ebx, eax
jmp 0x100015ff6
mov ecx, eax
mov rax, qword [rsp + 0x70]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.100015c90
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x70], rax
je 0x100016017
lea rcx, [rsp + 0x70]
call fcn.1000148d4
nop
mov eax, ebx
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.10007a3b0
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x490
pop r12
pop rdi
pop rsi
ret
Function at 0x100016b68
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x1000a2750]
test rcx, rcx
jne 0x100016b8e
call fcn.100016c1c
test eax, eax
je 0x100016bb5
mov rcx, qword [0x1000a2750]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x100016c09
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x100016bb9
xor eax, eax
jmp 0x100016c09
mov eax, dword [rax]
mov rcx, qword [0x1000a2750]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x100016be6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x100016c09
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x1000a2750]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x100016bed
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1000216b4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0x218]
mov rbx, rcx
xor r9d, r9d
mov byte [rax + 0x1bbc], 0
mov rcx, qword [rcx + 0x158]
xor r8d, r8d
mov edx, 0x14b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, qword [rbx + 0x218]
mov rbp, qword [rbx + 8]
lea rbx, [rsi + 0x3e8]
xor dil, dil
test rbx, rbx
je 0x100021717
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dil, 1
cmp qword [rsi + 0x418], 0
je 0x10002172a
mov byte [rsi + 0x420], 1
jmp 0x10002175b
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r9, [rsi + 0x3b8]
lea r8, [0x10006020c]
xor edx, edx
xor ecx, ecx
mov qword [rsi + 0x410], rbp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x418], rax
test dil, dil
je 0x10002176e
test rbx, rbx
je 0x10002176e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x100023884
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
test al, al
jne 0x1000238b8
mov eax, 0x80004005
jmp 0x100023943
mov ecx, 0xf
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x100023930
and qword [rsp + 0x28], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x34], 0
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.100069790
mov ebx, eax
call qword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
setne cl
test cl, cl
jne 0x1000238fd
mov ebx, 0x80004005
jmp 0x100023916
test ebx, ebx
jns 0x100023903
jmp 0x100023916
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.100023034
test eax, eax
jns 0x100023924
mov ebx, eax
lea rcx, [rsp + 0x28]
call fcn.10001b74c
mov eax, ebx
jmp 0x100023943
lea rcx, [rsp + 0x28]
call fcn.10001b74c
jmp 0x100023941
call qword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x100023941
mov eax, 0x80004005
jmp 0x100023943
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x100024c80
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov rsi, rcx
xor ebp, ebp
cmp qword [rcx + 0x218], rbp
jne 0x100024cb8
mov rax, 0xffffffff80004003
jmp 0x100024df7
mov eax, 0x8d0
cmp r8w, ax
jne 0x100024df5
mov rax, qword [0x1000a1180]
mov qword [rsp + 0x20], rax
mov ebx, 0x21
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.100016600
mov r8d, ebx
mov rdx, rax
mov rcx, qword [rsi + 0x150]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x20]
call fcn.1000166e4
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rbx - 8], eax
movsxd rcx, eax
mov word [rbx + rcx*2], bp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rdi, [rbx - 0xc]
cmp dword [rdi], ebp
jl 0x100024d36
mov qword [rsp + 0x50], rbx
lock add dword [rdi], 1
jmp 0x100024d5b
mov rax, qword [0x1000a1180]
mov qword [rsp + 0x50], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8, rbx
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.100016504
nop
mov rbx, qword [rsi + 0x218]
lea rcx, [rbx + 0x448]
mov r10, qword [rcx]
mov rax, qword [rsp + 0x50]
mov rdx, rax
sub r10, rax
movzx r8d, word [rdx]
movzx r9d, word [rdx + r10]
sub r8d, r9d
jne 0x100024d8e
add rdx, 2
test r9d, r9d
jne 0x100024d77
cmp r8d, ebp
je 0x100024dae
lea rdx, [rsp + 0x50]
call fcn.10001c054
inc dword [rbx + 0x528]
inc dword [rbx + 0x534]
mov rax, qword [rsp + 0x50]
lea rcx, [rax - 0xc]
lea rsi, [0x1000a1170]
or ebx, 0xffffffff
cmp rcx, rsi
je 0x100024ddc
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
cmp eax, ebp
jg 0x100024ddc
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff4
call fcn.10007a490
nop
cmp rdi, rsi
je 0x100024df5
mov eax, ebx
lock xadd dword [rdi], eax
add eax, ebx
cmp eax, ebp
jg 0x100024df5
mov rcx, rdi
call fcn.10007a490
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x100027224
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, rcx
mov ecx, dword [rcx + 0xa4]
mov ebx, 1
mov eax, ecx
mov sil, bl
and eax, 0xc
cmp al, 0xc
jne 0x100027292
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rcx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [rsp + 0x40], 0xfffffffe
movsxd rcx, eax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
movsxd rbx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r8, rbx
lea r9, [rsp + 0x30]
mov edx, 0x4e
jmp 0x1000272bc
shr ecx, 2
test bl, cl
je 0x1000272c7
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov rcx, qword [rdi + 8]
mov ebx, eax
call qword [sym.imp.USER32.dll_GetParent]
mov r9, qword [rdi + 8]
movzx r8d, bx
mov edx, VarUI4FromDisp
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10002730a
mov r8, qword [rdi + 0x50]
lea rdx, [0x100003cd0]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
seta sil
test sil, sil
je 0x10002730a
mov rcx, qword [rdi + 8]
or byte [rdi + 0x94], 2
mov r8d, ebx
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rbx, qword [rsp + 0x60]
mov al, sil
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x10002964c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rsp + 0x50]
mov eax, dword [rcx + 0x118]
mov rsi, r8
and dword [rdi], 0
mov rbx, rcx
cmp eax, 0x12
je 0x100029693
cmp eax, 0x79
jne 0x100029686
lea ecx, [rax - 0x69]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x100029693
cmp dword [rbx + 0x118], 0x20
jne 0x10002977c
cmp rsi, 0xf100
jne 0x10002977c
mov rsi, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rsi
jne 0x1000296d2
mov rcx, rbx
call fcn.10002be04
mov rcx, qword [rbx + 8]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov edx, 0x448
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10002977c
mov eax, dword [rbx + 0x118]
cmp eax, 0x20
je 0x10002977c
test byte [rbx + 0xf0], 0x40
jne 0x100029771
mov al, byte [rbx + 0xf1]
test al, 2
je 0x100029745
test al, 4
jne 0x100029745
test al, 8
je 0x100029745
or al, 4
mov r8d, 0x100000
mov edx, 0x446
movzx eax, al
mov rcx, rsi
mov byte [rbx + 0xf1], al
shl eax, 0x12
mov r9d, eax
not r9d
and r9, r8
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_UpdateWindow]
test byte [rbx + 0x98], 4
je 0x100029765
cmp qword [rbx + 0x120], 0
jne 0x100029765
call qword [sym.imp.USER32.dll_GetFocus]
mov qword [rbx + 0x120], rax
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x100029776
cmp eax, 0x20
je 0x10002977c
mov dword [rdi], 1
and byte [rbx + 0xf0], 0xbf
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x10002c100
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x1d0
mov rax, qword [0x1000a1108]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rbp, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x40c
mov r13, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
cmp eax, ebx
mov r12, rax
mov edi, ebx
jle 0x10002c230
lea rcx, [rsp + 0xa4]
xor edx, edx
mov r8d, VarUI4FromDisp
mov esi, 0x80
mov dword [rsp + 0xa0], VarUI4FromDisp
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, ebx
je 0x10002c1aa
cmp dword [rsp + 0xa4], 6
jb 0x10002c1aa
call fcn.10002d7e8
cmp al, bl
jne 0x10002c1af
mov esi, 0x6c
xor edx, edx
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x20], esi
lea r8d, [rdx + 0x78]
mov dword [rsp + 0x24], 0x11
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x20]
movsxd r8, edi
mov edx, 0x41c
mov rcx, r13
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
je 0x10002c1f0
mov rax, qword [rbp + 8]
cmp qword [rsp + 0x48], rax
je 0x10002c1fc
inc edi
cmp edi, r12d
jge 0x10002c230
jmp 0x10002c160
bt dword [rsp + 0x28], 9
jae 0x10002c230
movsxd r8, edi
xor r9d, r9d
mov edx, 0x42b
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rbp + 8]
xor r9d, r9d
lea r8d, [r9 + 0x28]
mov edx, pe_nt_image_headers64
call qword [sym.imp.USER32.dll_PostMessageW]
mov bl, 1
mov al, bl
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.10007a3b0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x100046fc4
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
lea rax, [rcx - 0x40]
neg rcx
mov rbx, r8
sbb rsi, rsi
xor r14d, r14d
mov edi, 1
and rsi, rax
mov edx, 0x959
mov rcx, qword [rsi + 8]
cmp dword [rsp + 0x60], r14d
je 0x100047084
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r13, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, rbx
or r12d, 0xffffffff
movsxd rbp, eax
mov edx, ebp
call fcn.100016600
cmp rax, r14
je 0x10004707a
mov rax, qword [rbx]
mov dword [rax - 8], ebp
mov rax, qword [rbx]
mov word [rax + rbp*2], r14w
mov rdx, qword [rbx]
cmp rdx, r14
je 0x10004707a
lea r8d, [rbp + 1]
mov rcx, r13
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, rbx
mov r12d, eax
call fcn.1000166e4
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r11, eax
mov rax, qword [rbx]
mov dword [rax - 8], r11d
mov rax, qword [rbx]
mov word [rax + r11*2], r14w
cmp r12d, ebp
jge 0x1000470c6
mov edi, r14d
jmp 0x100047094
mov r8, qword [r8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov edi, eax
cmp eax, r14d
jne 0x1000470c6
or ecx, 0xffffffff
lea rbx, [rsi + 0x40]
call qword [sym.imp.USER32.dll_MessageBeep]
lea r8, [rbx - 0x40]
neg rbx
sbb rcx, rcx
mov edx, 0x959
and rcx, r8
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret